Problems setting up public/private vlans on sg300-52 switches

Question

A real beginner here with a problem on how to setup 3 SG300-52 (in L2 mode) as per this diagram:
Port 1 on all switches should be able to talk to each other and access the blob at the right.
The ports 25 on the other hand should only be able to talk among themselves in their own
private vlan. They are to carry sensitive traffic.
So I created 3 vlans, vlan 78 for ports gi1, gi51 and vlan 10 for port25,49,50 and a dummy vlan: 666
with the intent of segratating vlan 10 from vlan 78.
My attempts so far have failed.
ports gi49-50 are configured as trunk ports and gi1,gi51 as access ports as the following
cli output (excerpts of the startup config):
vlan database
vlan 10,78,666
exit
interface vlan 1
ip address 172.16.10.11 255.255.255.0
no ip address dhcp
interface gigabitethernet1
switchport mode access
switchport access vlan 78
interface gigabitethernet25
switchport mode access
switchport access vlan 10
interface gigabitethernet49
switchport trunk allowed vlan add 10,78
switchport trunk native vlan 666
switchport default-vlan tagged
interface gigabitethernet50
switchport trunk allowed vlan add 10,78
switchport trunk native vlan 666
switchport default-vlan tagged
interface gigabitethernet51
switchport mode access
switchport access vlan 78
Ports gi1 can talk to each other and access the blob but ports 25 refuse to talk to each other. But as soon as I remove
the access links to the blob they can! Obviously, at that point port gi1 lose access.
Is such a topology feasable or even advisable?
Thanks,
jf

Answer 1

Hi Jean,
Here's a pretty picture
Now I will explain.
The layer 3 switch is going to service as your core switch.
Vlan 78 looks like your BLOB connection.
Vlan 10 and 666 look like they don't belong on the BLOB.
So how to configure this-
You will want to configure the switch that connects directly to the BLOB as the layer 3 switch depicted in my diagram.
Layer 3 switch, follow this document
https://supportforums.cisco.com/docs/DOC-27038
Bear with me, I am making up random numbers since I don't know what you want or will use.
So VLAN 78 looks like the BLOB and 10 and 666 are staying out of the BLOB.
config t
vlan database
vlan 10, 78, 666
int vlan 1
ip address 192.168.1.254 /24
int vlan 10
ip address 192.168.2.254 /24
int vlan 78
ip address 192.168.3.254 /24
int vlan 666
ip address 192.168.4.254 /24
Configure the port you want to go to the BLOB, I am assuming vlan 78.
config t
int gi01
switchport mode access
switchport access vlan 78 (that 3750, what is the native vlan of the port it is connecting to??)
Next, configure the downlink port to connect the layer 2 switch
config t
int gi0/2
switchport mode trunk
switchport trunk allowed vlan add 10, 78, 666  (this will make the port native vlan 1 untagged, rest ports tagged)
On the downstream switch you need to configure an uplink and downlink with the respective vlans. It will remain layer 2 mode.
config t
vlan database
vlan 10, 78, 666
int gi0/1
switchport mode trunk
switchport trunk allowed vlan add 10, 78, 666
int gi0/2
switchport mode trunk
switchport trunk allowed vlan add 10, 78, 666
Same thing for the last switch, it will remain layer 2 mode
config t
vlan database
vlan 10, 78, 666
int gi0/1
switchport mode trunk
switchport trunk allowed vlan add 10, 78, 666
int gi0/2
switchport mode trunk
switchport trunk allowed vlan add 10, 78, 666
Let me know if this works out or if it is not logical for you.
-Tom
Please mark answered for helpful posts