Private VLAN support on Cisco SF220

Hi!
is there a plan to add support of Private VLANs on SF220?

Hi,
We currently do not have plans to support Private VLANs.

Similar Messages

Private VLAN support on actual HW

Hi all,
I'm currently thinking about a private Vlan based solution for a special demand.
Now for my initial investigation i need tio have something like a Pvlan HW support matrix.
Means I'd like to know which switches in cisco portfolio supporting PVLAN's.
Additional I'm wondering cause most of the PVLAN documentation relative old.
How about PVLAN support. Is Pvlan on Access switches still (and in future) featured by Cisco?
thanks for your comments
Dieter

Hi Dieter,
You could see this detail using Cisco Feature Navigator tool which is avilable on the cisco web site.
1. Go to below site
http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp
2. Select the Feature button and type the Feature which you would like verify. If you press continue button, you can supported code as well as platform
If you would like to know about any specific product support detail, please inform me, i can share information whether it supports or not.
Inform me if you need more detail.
Regards,
Aru

Private Vlan support on CAT3850

Hello , i need to configure private vlans on Catalyst 3850 .
On this page is said that 3850 does support this technology
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps12686/qa_c67-722110.html
But i can't configure it because there is no such commands in CLI
3850(config-vlan)#pri?
% Unrecognized command
Does it support it or will it support private vlans in future?

Dmitry
There does seem to be conflicting information. The link you provide does say they are supported but looking at the config guide it says -
Restrictions for VLANs
The following are restrictions for VLANs:
The switch supports per-VLAN spanning-tree plus (PVST+) or rapid PVST+ with a maximum of 128 spanning-tree instances. One spanning-tree instance is allowed per VLAN.
The switch supports IEEE 802.1Q trunking methods for sending VLAN traffic over Ethernet ports.
Configuring an interface VLAN router's MAC address is not supported. The interface VLAN already has an MAC address assigned by default.
Private VLANs are not supported on the switch.
You cannot have a switch stack containing a mix of Catalyst 3850 and Catalyst 3650 switches.
full link -
http://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3se/vlan/configuration_guide/b_vlan_3se_3850_cg_chapter_0100.html
So it looks like with this release at least, they are not available. I don't know whether they are scheduled to be included in a later release of the software.
Perhaps someone from Cisco can comment. The product page certainly needs updating as it seems the configuration guide is the correct one.
Edit - i have posted a link to this thread in the Technical Documentation forum to ask for clarification although a Cisco person is still not guaranteed to answer.
Jon

Private-VLan Cisco 2975

Hi guys,
I got an issue configuring Private-VLans on a cisco 2975 i know that it's not supported but it's there a way that i can configure a switchport on a Cisco 2975 switch and be able to communicate witch a Private-VLan on a 3750 switch

Hi Eduardo,
To prune a set of VLANs from a trunk manually, you should use the command
switchport trunk allowed vlan remove vlan-list
If, for example, 100 was the primary VLAN and 101, 102, 103 and 199 were the secondary VLANs associated with this primary VLAN, the command would be:
switchport trunk allowed vlan remove 100-103,199
Be careful when you do this in your production network. This command will cause that these VLANs are immediately disallowed on this trunk. If there are any clients in the removed VLANs on the 2975 switch, they will lose connectivity with the remainder of the network until you configure a separate connection between the 3750 and the 2975 placed into the particular secondary community VLAN.
Best regards,
Peter

Private vlan and HSRP

Hi, guys. I have a question about Private Vlan and HSRP implement. In my network topology, there are 2 switch 6509 as core switches and Internet outlet. There are a 3750 as a distribute swtich, and 3550 as a access swtich. the topology is as below:
| |
7609----7609
| |
3750
|
3550
|
servers
Now there are some Server will connect to 3550, and 3750 and 3550 will be treated as Layer 2 switch, that is these servers's default gateway will be on vlan interface on 7609, and I have configured HSRP between the vlan on 2 6509. My question is how to implement private vlan on 3550 with HSRP on 7609, so that these servers can have redundancy gateway, and be kept isolated between other servers.

It looks like the 3550 do not support private VLAN.
http://www.cisco.com/en/US/products/hw/switches/ps4324/products_tech_note09186a0080094830.shtml
More info. on private VLAN :
http://www.cisco.com/en/US/products/hw/switches/ps4324/products_configuration_guide_chapter09186a00802c30c4.html#wp1138148
Did you configure the VLAN trunking between 7609, 3750 and 3550 ? Once we enable the VLAN trunking then the server can plug to the assigned VLAN and communicate to the 7609 via the trunk w/o interference w/ other VLAN. However, you have to enable the VLAN routing at 7609 to make it able to connect to other VLAN user if you want.
Hope this helps.

Private-VLAN trunk on 3560X

Hi,
I need to create Private-VLANs on 3650X, but is possible to configure this technology with 3560X switch and IOS 12.2(55)SE5?. I attach the topology.
I want to configure the private VLANs on the VLAN 30, the isolated VLAN is the number 100 and the community VLAN is the 200. I guess that the interfaces trunk has to be set as promiscuous mode, is that correct?
If the trunk is configuring as promiscuous mode, what happened with the others VLANs (10, 20 and 40), and what is the correct configuration for the interfaces trunk?

Hi,
Follow the config guide on how to configure private vlans:
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_53_se/configuration/guide/3750xscg/swpvlan.html
HTH

Private VLAN Promiscuous Trunk Port - Switches which support this function

Can anyone confirm if the "Private VLAN Promiscuous Trunk Port" feature is supported in any lower end switches such as Nexus 5548/5672 or 4500X? According to the feature navigator support seems to be restricted to the Catalyst 4500 range (excluding the 4500X) as shown below. If the feature is going to be supported in the Cat 3850 this would be good to know, thanks

4500x Yes
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_26674-01.html
Nexus 5k Yes
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/layer2/521_n1_3/b_5k_Layer2_Config_521N13/b_5k_Layer2_Config_521N13_chapter_0100.html
3850s
They dont support pvs at all yet
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/vlan/configuration_guide/b_vlan_3se_3850_cg/b_vlan_3se_3850_cg_chapter_0100.html
Restrictions for VLANs
The following are restrictions for VLANs:
The switch supports per-VLAN spanning-tree plus (PVST+) or rapid PVST+ with a maximum of 128 spanning-tree instances. One spanning-tree instance is allowed per VLAN.
The switch supports IEEE 802.1Q trunking methods for sending VLAN traffic over Ethernet ports.
Configuring an interface VLAN router's MAC address is not supported. The interface VLAN already has an MAC address assigned by default.
Private VLANs are not supported on the switch.
You cannot have a switch stack containing a mix of Catalyst 3850 and Catalyst 3650 switches.

Cisco 7606 stacked VLAN support

Hi All,
Does Cisco 7606 GigabitEthernet modules support stacked VLAN (two VLAN tags)?
If yes, how do I configure it?
Thanks in advance.
Regards,
Sarah

Hi Sean,
Yes, it is QinQ tunneling. I am using Cat6k-Sup720.
Cisco7606(config-vlan)#?
VLAN configuration commands:
are Maximum number of All Route Explorer hops for this VLAN (or
zero if none specified)
backupcrf Backup CRF mode of the VLAN
bridge Bridging characteristics of the VLAN
exit Apply changes, bump revision number, and exit mode
media Media type of the VLAN
mtu VLAN Maximum Transmission Unit
name Ascii name of the VLAN
no Negate a command or set its defaults
parent ID number of the Parent VLAN of FDDI or Token Ring type VLANs
private-vlan Configure a private VLAN
remote-span Configure as Remote SPAN VLAN
ring Ring number of FDDI or Token Ring type VLANs
said IEEE 802.10 SAID
shutdown Shutdown VLAN switching
state Operational state of the VLAN
ste Maximum number of Spanning Tree Explorer hops for this VLAN (or
zero if none specified)
stp Spanning tree characteristics of the VLAN
tb-vlan1 ID number of the first translational VLAN for this VLAN (or
zero if none)
tb-vlan2 ID number of the second translational VLAN for this VLAN (or
zero if none)
Regards,
Sarah

Hi all, need advice on OSPF and private vlans

Hi all.
I have a project to complete and need some help on the possible solution I can use.
Basically we have ospf area 0 and the users in question are in ospf area 7 and is a stub.
I need to route the traffic from these users out through area 0 through 3 core devices, onto an external firewall interface to be placed onto the vpn that sits on it. The firewall is not included in the ospf domain.
My thinking was that the firewall has a default route back into the ospf domain so dont need to worry about traffic coming in, however my job is to segregate these users and take them out of our core network and place them onto an external network via this vpn.
Not sure how to achieve this apart from static routing redistributed but surely this does not seperate their traffic only points the route to ospf?!
I was thinking I might have to use private vlans or policy routing but when I try policy routing the policy gets ignored due to normal forwarding.
Any help and advice would be greatly appreciated.
Cheers
Steve

Steve
Thanks, that helps.
GRE is defintely out because apart from the 6500 GRE tunneling is not supported on the Cisco switches.
It's good that area 7 is only for these users and not mixed up with other users.
So if i understand correcty the 4500 interface connecting to the 6500 is in area 0 and the interface connecting to the 3550 is in area.
Or is the 3550 connected to both areas and the 4500 totally in area 0 ?
Can you confirm the above ?
In terms of keeping them separate there are 2 possible choices. You can either -
1) use VRF-LIte, although i'm not sure whether the HP switch would support this. With VRF-Lite you are in effect creating virtual devices on the same physical device. This means each virtual device has it's own routing and forwarding table so it is quite secure because you would only populate the routing table with the routes needed so there would be no way for users to jump to thes rest of your networks.
The downside is that is can become quite complex to configure. If the 4500 is only used to connect are 7 to area 0 then that would not be a problem but the connection from the 6500 to the HP could and i don't even know whether the HP supports VRF-Lite functionality let alone how to configure it on that switch.
But it would, at least from the 4500 to 6500 to HP provide complete separation in terms of routing and forwarding. Once it got to the HP it wouldn't but that might not be an issue.
2) Use PBR (possibly together with acls). This is easier to configure ie. you configure PBR on the 4500 and the 6500 to get the traffic to the HP switch. But you do not get the actual separation you get with VRF-Lite ie. the traffic simply overrides the existing routing tables.
The other thing to bear in mind with PBR is that you also have to configure the return traffic as well so each device would need multiple PBR configs.
Again i don't know whether the HP supports PBR but it may not be an issue depending on what the routing is on the HP.
You could also use a combination of the above ie VRF-Lite between the Cisco switches and then PBR for the last hop to the HP device.
I should say i don't have a huge amount of experience with VRF-Lite but that should not necessarily stop you using it if it is what you need. There are lots of other people on here so i'm sure there will be other people who can help if i can't.
It still depends on how much separation is required. VRF-Lite is definitely seen as a way to separate traffic running across a shared infrastructure, PBR is not really seen in the same way. So it may well be worth going back to find out exactly what "segregating" user traffic means.
I don't want to confuse the issue but it's still not entirely clear what the actual requirement is.
Jon

Private Vlan and Switchport Protected

Dear All,
My core switch is 4500 which support Private Vlan. However, I have several closet switch (2950) which only support Switchport Protected. 4500 and each 2950 are connected with trunk using fiber.
How can I config PC at 2950_Switch1 cannot communicate to PC at 2950_Switch2 (all fastethernet port on both 2950 are at the same vlan and same subnet)?
Thanks.
C.K.

Hi C.k.,
I believe you can use switchport protected feature along with port blocking feature to accomplish this. First have your switch ports configured as protected ports on which you dont want the traffic to flow and then configure those ports to deny unknown unicast and multicast using the " port-blocking feature ".
Try that and let us know.
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12120ea2/2950scg/swtrafc.htm#wp1174968
HTH,
-amit singh

Private vlans

Hi I'm trying to configure some private vlans on a cat 3550, I cant really find any good configuration example
can anyone provide me with a Config example
cheers
per

PVLAN capabilities on 3550 are very limited. 3550 does not support Community and Isolated VLANs but only Protected ports. The following pages should help
http://www.cisco.com/warp/public/473/63.html#topic1
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12225see/scg/swtrafc.htm#wp1158863
PS: Remember to rate useful posts.

SF 300 private-vlan

Hi,
I am working on a SF 300 . I favor the cli over the web-interface.
I will like to make a private-vlan community but do not know if my sequence of commands are right or allowed.
Can someone point me in the right direction please ?
MedSwitch#configure terminal
MedSwitch(config)#vlan da
MedSwitch(config-vlan)#vlan 50
MedSwitch(config-vlan)#private-lan community
% Unrecognized command
This is my first experience with cisco switches. I am a beginner.
Thanks.
-Luis

Hi Luis, this switch does not support private vlan. You may use protected port features (PVE, private vlan edge). This concept means if there is a port with protected port toggle, any other protected port cannot communicate amongst themselves. This behaves sort of like an "isolated port". However, any port that is not a protected port may communicate to the protected port which operates similar to a "promiscuous port".
If you need vlan separation it will be accomplished through ACL or routing functions.
-Tom
Please mark answered for helpful posts

Catalyst series - Private VLAN over trunk

Hey every body
I was planning to implement a Cisco Nexus 5596 in a data center as it supports private VLAN over trunk.
But now, I av been forced to use a Cisco Catalyst series instead of the Nexus one.
Based on the feature that is very important for my manager (private VLAN over trunk), which Catalyst switch can be replaced with the Nexus 5596? In other words, what Catalyst series switch works at the same scale and efficiency of Nexus 5596 and supports private VLAN over trunk feature?
Cheers

4500x Yes
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_26674-01.html
Nexus 5k Yes
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/layer2/521_n1_3/b_5k_Layer2_Config_521N13/b_5k_Layer2_Config_521N13_chapter_0100.html
3850s
They dont support pvs at all yet
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/vlan/configuration_guide/b_vlan_3se_3850_cg/b_vlan_3se_3850_cg_chapter_0100.html
Restrictions for VLANs
The following are restrictions for VLANs:
The switch supports per-VLAN spanning-tree plus (PVST+) or rapid PVST+ with a maximum of 128 spanning-tree instances. One spanning-tree instance is allowed per VLAN.
The switch supports IEEE 802.1Q trunking methods for sending VLAN traffic over Ethernet ports.
Configuring an interface VLAN router's MAC address is not supported. The interface VLAN already has an MAC address assigned by default.
Private VLANs are not supported on the switch.
You cannot have a switch stack containing a mix of Catalyst 3850 and Catalyst 3650 switches.

Port-channel with Private VLANs on Nexus1000v

Hi all,
It says that private vlans are not supported on port-channel ports ont Nexus 1000v L2 Switching Guide.
AFAIK, if you have two ports between ESX VEM and physical switch and both these ports are configured as 802.1Q and carrying the same VLANs, when the port which carries the traffic at the moment fails, the other port do not failover automatically. This is mentioned in "Nexus 1000v Deployment Guide version 2" as ,
"Individual Uplinks : A standard uplink is an uplink that is not a member of a PortChannel from the VEM to a physical switch. It provides
no capability to load balance across multiple standard uplink links and no high-availability characteristics. When a standard uplink fails, no secondary link exists to take over. Defining two standard uplinks to carry the same VLAN involves the risk of creating loops within the environment and is an unsupported configuration. Cisco NX-OS will post warnings when such a condition occurs. "
Does anyone have any idea in order for the attached topology to work. Do I have to forward each and every VLAN from different ports ? If I do that how am I going to manage different VLANs and still have that hosts in the same primary VLAN with same IP subnet ?
Thanks in advance.
Dumlu

Hi,
You can't have M and F ports in single port channel irrespective what code version you are running , it will throw error on you..
nor you can have m1 port channel one side and another f port channel other side , port channel

Private vlan with MVR or any related solution

I would like to enable MVR on C4507R+E on trunk port. Actually my current network setup is connecting two uplink from this switch to aggregation router as layer 2. And CPE is connected down this switch with private vlan configuration. I have attached interface configurations with this.
I have to apply “mvr vlan 101 receiver vlan 104” in gig 1/1 interface to map the MVR vlan. But that is not supporting when the link is configured as “switchport mode private-vlan trunk”. Only this command is allowing if I configured as “swithport mode trunk”. But if it is normal trunk, private vlan services are not working. Please suggest your solution for this problem.
According to cisco we can’t enable MVR in private vlan trunk port. Is there any other solution for this than ACL to block the stream from CPE to upwards at 4507 switch?
(mvr working, but private vlan is not working)
interface GigabitEthernet1/1
switchport private-vlan trunk allowed vlan 101-104
switchport private-vlan association trunk 200 102
switchport private-vlan association trunk 300 101
switchport mode trunk
mvr type source
mvr vlan 101 receiver vlan 104
mvr immediate
spanning-tree guard loop
end
(private vlan working, but mvr is not working)
interface GigabitEthernet1/2
description "connected to CPE"
switchport private-vlan trunk allowed vlan 101-104
switchport private-vlan association trunk 200 102
switchport private-vlan association trunk 300 101
switchport mode private-vlan trunk
mvr type receiver
mvr immediate
spanning-tree guard loop
end

Hey,
Correct, only one Isolated primary vlan is associated with Primary private vlan. Snippet from configuration guide:
"A primary VLAN can have one isolated VLAN and multiple community VLANs associated with it. An isolated or community VLAN can have only one primary VLAN associated with it."
HTH.
Regards,
RS

Private VLAN support on Cisco SF220

Similar Messages

Maybe you are looking for