思科private vlan

《思科private vlan》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、思科privatevlan配置privateVLAN里有3种port  isolated，community，promiscuous。privateVLAN有3种：primaryVLAN，isolatedVLAN，communityVLAN。配置命令分别是：vlan901private-vlanisolatedvlan902private-vlancommunityvlan900private-vlanprimaryprimaryVLAN和他所关联的isolatedVLANcommunityVLAN都可以通信.iso

2、latedVLAN和communityVLAN都属于secondaryVLAN，他们之间的区别是：同属于一个isolatedVLAN的主机不可以互相通信，同属于一个communityVLAN的主机可以互相通信。但他们都可以和和所关联的primaryVLAN通信.配置primaryVLAN和secondaryVLAN关联的命令是：vlan900private-vlanprimaryprivate-vlanassociation901,902注意一个primaryVLAN只可以关联一个isolatedVLAN+多个com

3、munityVLAN把端口放进isolatedVLAN或者communityVLAN的命令是interfaceGigabitEthernet4/11switchportswitchportprivate-vlanhost-association900901switchportmodeprivate-vlanhost//因为901是isolatedVLAN,g4/11现在是一个isolatedportinterfaceGigabitEthernet4/12switchportswitchportprivate-vlan

4、host-association900902switchportmodeprivate-vlanhost//因为902是communityVLAN,g4/12现在是一个communityport注意在privatevlan里switchportaccessvlanxxx这一句已经不起作用了。起作用的是switchportprivate-vlanhost-association900902这一句，这一句把端口放入primaryvlan900和secondaryvlan902。把端口放进primaryVLAN的命令是：i

5、nterfaceGigabitEthernet4/14switchportswitchportprivate-vlanmapping900901,902switchportmodeprivate-vlanpromiscuous//g4/14现在是一个promiscuousport同样，switchportaccessvlanxxx已经不起作用了，起作用的是switchportprivate-vlanmapping900901,902，这一句把端口放入primaryvlan900和secondaryvlan901，90

6、2。注意这里promiscuousport可以属于多个secondaryVLAN，但只可以属于一个primaryVLAN，就好像普通的accessport只能属于一个vlan是一样的。在配置vlan的3层地址的时候，只可以配置在primaryVLAN上，从这里也可以看出，primaryVLAN在某些地方是和普通vlan一样工作的，secondaryVLAN则更特殊一些。下面看两种方法来实现让4/11和4/12可以和4/14通信，但4/11和4/12互相不可以通信方法一，用isolatedVLAN：vlan901pri

7、vate-vlanisolatedvlan900private-vlanprimaryprivate-vlanassociation901interfaceGigabitEthernet4/11switchportswitchportprivate-vlanhost-association900901switchportmodeprivate-vlanhostinterfaceGigabitEthernet4/12switchportswitchportprivate-vlanhost-association9009

8、01switchportmodeprivate-vlanhostinterfaceGigabitEthernet4/14switchportswitchportprivate-vlanmapping900901switchportmodeprivate-vlanpromiscuous方法二，用communityVLANvlan901privat