LAN Security – Private VLANs

Private VLANs (PVLANs) prevent inter-host communication by providing port-specific security between adjacent ports within a VLAN across one or more switches. Access ports within PVLANs are allowed to communicate only with the certain designated router ports, which are typically those connected to the default gateway for the VLAN. Both normal VLANs and PVLANs can co-exist on the same switch; however, unlike normal VLANs, PVLANs allow for the segregation of traffic at Layer 2. This effectively transforms a traditional Broadcast segment into a non-Broadcast multi-access segment.

Private VLAN Port Types

The PVLAN feature uses three different types of ports, as follows:

1. Community
2. Isolated
3. Promiscuous

Community PVLAN ports are logically combined groups of ports in a common community that can pass traffic amongst themselves and with promiscuous ports. Ports are separated at Layer 2 from all other interfaces in other communities or isolated ports within their PVLAN.

Isolated PVLAN ports cannot communicate with any other ports within the PVLAN. However, isolated ports can communicate with promiscuous ports. Traffic from an isolated port can be forwarded only to a promiscuous port and no other port.

Promiscuous PVLAN ports can communicate with any other ports, including community and isolated PVLAN ports. The function of the promiscuous port is to allow traffic between ports in a community of isolated VLANs. Promiscuous ports can be configured with switch ACLs to define what traffic can pass between these VLANs. It is important to know that only one (1) promiscuous port is allowed per PVLAN, and that port serves the community and isolated VLANs within that PVLAN. Because promiscuous ports can communicate with all other ports, this is the recommended location to place switch ACLs to control traffic between the different types of ports and VLANs.

Isolated and community port traffic can enter or leave switches via trunk links because trunks support VLANs carrying traffic among isolated community and promiscuous ports. Hence, PVLANs are associated with a separate set of VLANs that are used to enable PVLAN functionality in Cisco Catalyst switches. The three types of VLANs used in PVLANs are as follows:

1. Primary VLAN
2. Isolated VLAN
3. Community VLAN

Primary VLANs carry traffic from a promiscuous port to isolated, community, and other promiscuous ports within the same primary VLAN. Isolated VLANs carry traffic from isolated ports to a promiscuous port. Ports in isolated VLANs cannot communicate with any other port in the private VLAN without going through the promiscuous port.

Community VLANs carry traffic between community ports within the same PVLAN, as well as to promiscuous ports. Ports within the same community VLAN can communicate with each other at Layer 2; however, they cannot communicate with ports in other community or isolated VLANs without going through a promiscuous port. Isolated and community VLANs are typically referred to as secondary VLANs. A private VLAN, therefore, actually contains three elements, as follows:

1. The PVLAN itself
2. The secondary VLANs (community and isolated)
3. The promiscuous port

PVLAN operation is illustrated below in Figure 6-13:

Fig. 6-13.  PVLAN Operation

Referencing Figure 6-13, the Community VLAN defines a set of ports that can communicate with each other at Layer 2, as long as they belong to the same community VLAN, but cannot communicate with ports in other community VLANs or isolated VLANs without first going through the promiscuous port.

The isolated VLAN defines a set of ports that cannot communicate with any other port within the PVLAN, either another community VLAN port or even a port in the same isolated VLAN, at Layer 2. In order to communicate with ports in either of these VLANs, isolated ports must go through the promiscuous port. Only a single isolated VLAN per PVLAN is allowed.

The promiscuous port forwards traffic between ports in community and/or isolated VLANs. Only one promiscuous port can exist within a single PVLAN; however, this port can serve all the community and isolated VLANs in the PVLAN. ACLs may be applied to the promiscuous port to define the traffic that is allowed to pass between these different VLANs.

Configuring Private VLANs

Before configuring PVLANs, it is important to remember that VTP does not support carrying PVLAN information in its updates within its VTP domain. Therefore, switches should be configured in Transparent and should never be changed to either VTP Server or VTP Client mode once PVLANs have been configured and are used in the VTP domain. In addition to this, it is also important to know that certain VLANs cannot be added to a PVLAN. These VLANs include VLAN 1 and VLANs 1002 through 1005. The following configuration steps are required to configure Private VLANs:

1. Configure the primary VLAN by issuing the private-vlan primary VLAN configuration mode command for the desired VLAN;
2. Associate the secondary VLAN(s) to the primary VLAN via the private-vlan association VLAN configuration command under the primary VLAN created in step 1;
3. Configure the secondary VLAN(s) by issuing the private-vlan [community|isolated] VLAN configuration mode command for the desired VLAN(s);
4. Map secondary VLANs to the Switch Virtual Interface (Layer 3 VLAN interface) of the primary VLAN via theprivate-vlan mapping interface configuration command;
5. Configure Layer 2 interfaces as isolated or community ports, and associate the Layer 2 interface with the primary VLAN and selected secondary VLAN pair via the switchport mode private-vlan host and theswitchport private-vlan host association [primary vlan] [secondary vlan] interface configuration commands; and
6. Configure a Layer 2 interface as a promiscuous port and map the PVLAN promiscuous port to the PVLAN and to the selected VLAN pair via the switchport mode private-vlan promiscuous and the  switchport private-vlan mapping [primary vlan] [secondary vlans] interface configuration commands.

These configuration steps are illustrated in the following output:

Verifying PVLAN Configuration

The show vlan private-vlan command can be used to verify the PVLAN configuration. This command prints information on the primary VLAN, secondary VLANs, and the ports assigned to those respective VLANs. This output is illustrated as follows:

The show interface [name] switchport command can be used to verify a host port configured in a PVLAN. This is illustrated in the following output:

The output for a promiscuous port would differ slightly as illustrated in the following output: