Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand the concept of PVLANs. All the guides I have been reading assume a simple topology with many hosts on a switch and a single router (default gateway). The router's port is designated as promisc and the hosts are configured as isolated.

I have not seen any guides using an l3 switch. Assume the config is such that the default gateway is the switch itself (the VLAN L3 interface). Does the Vlan interface itself have to be configured as promisc in this case?

For example:

VLAN 10 = Primary VLAN

VLAN 11 = Isolated VLAN

Would the default gateway's IP be put on VLAN 10 or VLAN 11? Would the VLAN 10 or 11 interface be set as promisc?

share|improve this question


If you need to configure an SVI on a switch to communicate with private VLAN members, you should add an interface corresponding to Primary VLAN only. Obviously that’s because all secondary VLANs are “subordinates” of primary. After an SVI has been created, you have to map the required secondary VLANs to the SVI (just like with a promiscuous port) in order to make communications possible. You may exclude some mappings from SVI interface, and limit it to communicating only with certain secondary VLANs.

(Code sample adapted to your question - assuming gateway of

! SW1 SVI of Primary VLAN is mapped to all secondary VLANs
interface Vlan 10
 ip address
 private-vlan mapping 11
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.