Nexus 1000v / pvlan promiscuous trunk / Cross-host communication.

Question

Hello,
We are planning the deployment of Nexus 1000v with “promiscuous trunk” uplink ports. We want to be sure cross-host in isolated pvlan will not be possible .
Looking at the picture, I was wondering if the communication between VM-A on ESX1 and VM-B on ESX 2 (both on isolated pvlan) will be impossible as expected.
Example: If VM-A on ESX 1 tries to send traffic to VM-B on ESX-2, the vlan 11 tag is remapped to vlan 10 tag at the outgoing uplink on ESX 1.
Then the flow arrives on ESX 2 with vlan 10 tag on the promiscuous trunk. I understand the promiscuous port can talk to all secondary pvlans, so VM-A can in this case talk with VM-B.
Is my understanding correct ?
Or does the Nexus 1000v have an enhanced cross-VEM mechanism which allow to check the source mac address and know that it comes from pan isolated pvlan and as a result cannot communicate.
Best regards.
Karim  

Answer 1

Hello Karim,
N1k enforces pVLANs across all hosts.  Think of all the N1k VEMs as a single switch.  In your example, VM-A will not be able to talk with VM-B.  We accomplish this isolation by poisoning VEM mac address tables with a null destination.  For example, ESX1 would contain a dynamic entry for VM-B that points to a null LTL value.  If VM-A attempted to send traffic to VM-B's mac, it would not leave the host.
Please be aware that N1k can only enforce pVLANs for traffic behind the VEMs.  If you have other servers in VLAN 10 on the blue switch, it would be seen as a promiscuous port from N1k standpoint.  Additional configuration would be required to prevent communication.