Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I mocked up a diagram in Visio as it can explain the network topology better than I can:

VLAN 1 is a standard VLAN

Basically the top switches contain hosts on VLAN 1 and a trunk to the router on a stick. The bottom switches contain hosts in VLAN 1 and VLAN 10 (the private VLAN, which VLAN 11 is the isolated VLAN).

Since the trunks for all switches must pass VLAN 1 and 10 (or 11?) traffic I did not make them members of a private VLAN. Also since the router on a stick is trunked for both vlan 1 and 10 (or is it supposed to bee 11) I did not assign it as a promiscious member of any private vlan.

The desired result is:

1) Hosts in VLAN 1 can communicate with the router on a stick (which also has the default route to the internet not shown)

2) Hosts in the isolated VLAN are able to communicate with the router on a stick in order to communicate with the server on VLAN 1 as well as the internet

share|improve this question
Why have you used a private VLAN, in stead of just, a 2nd "regular" VLAN? – jwbensley Oct 24 '12 at 16:14
I want true layer2 segmentation between the hosts (no direct communication) – user974896 Oct 24 '12 at 16:20
Thats what VLANs are for, you don't need to use private VLANs. In that picture all hosts with a purple line have the same connectivity so this could just be a 2nd regular VLAN, not a private VLAN, these aren't the same thing – jwbensley Oct 24 '12 at 16:25
A host can still use ARP spoofing or rogue DHCP to take over a segment. PVLANs prevent direct communication between the hosts in a VLAN thus preventing ARP spoofing and rogue DHCP. – user974896 Oct 24 '12 at 16:29
Ah sorry, you want segregation between hosts on the SAME VLAN, you didn't specify that, that is why I was trying to steer you away from a private VLAN :) – jwbensley Oct 24 '12 at 16:37

I'm not sure which model of Cisco switch you have but there are features to support PVLAN on trunks, and I'd recommend you run such a feature. When your isolated hosts transmit a packet it will end up on VLAN 11 (the aux VLAN). The purpose of the promiscuous port, in part, is to map the packets in the aux VLAN to the primary VLAN. When the router responds, it simply sends into VLAN 10. The various isolated hosts are set with VLAN 10 as their primary. As such, the router can send to anything in VLAN10 but the isolated hosts can only send traffic to the router (...and not to each other).

If you don't have some facility for mapping 11 -> 10 then the router won't see traffic coming from the hosts. If you do have said facility then the result should work as you describe.

share|improve this answer
Thanks. So according to my example which ports should be set as promisc, which as a trunk, and which as a private trunk (if any)? – user974896 Oct 24 '12 at 18:42
Would setting a current trunk port as a promiscuous port (essentially putting it in a PVLAN) mess with it's ability to trunk standard VLANs – user974896 Oct 24 '12 at 18:48
Again - make sure your particular switch model and SW rev support PVLAN trunk. If it -does- then you establish one or mappings between the main and aux vlan's (i.e. 11->10 in your case). If you don't have a mapping for a given VLAN then it's treated normally. As such you can have both PVLAN and normal VLAN simultaneously on the same trunk. – rnxrx Oct 25 '12 at 0:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.