Cisco Nexus 1000VE for VMware vSphere Troubleshooting Guide, Release 5.2(1)SV5(1.1)
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- Updated:
- July 23, 2018
Chapter: Private VLANs (PVLANs)
Private VLANs (PVLANs)
This chapter describes how to identify and resolve problems related to private VLANs and includes the following sections:
Information About Private VLANs
Private VLANs (PVLANs) are used to segregate Layer 2 Internet service provider (ISP) traffic and convey it to a single router interface. PVLANs achieve device isolation by applying Layer 2 forwarding constraints that allow end devices to share the same IP subnet while being Layer 2 isolated. The use of larger subnets reduces address management overhead. Three separate port designations are used. Each has its own unique set of rules that regulate each connected endpoint's ability to communicate with other connected endpoints within the same private VLAN domain.
Private VLAN Domains
A private VLAN domain consists of one or more pairs of VLANs. The primary VLAN makes up the domain, and each VLAN pair makes up a subdomain. The VLANs in a pair are called the primary VLAN and the secondary VLAN. All VLAN pairs within a private VLAN have the same primary VLAN. The secondary VLAN ID is what differentiates one subdomain from another.
Spanning Multiple Switches
Private VLANs can span multiple switches, just like regular VLANs. Inter-switch link ports do not need to be aware of the special VLAN type and can carry frames tagged with these VLANs as like they do with any other frames. Private VLANs ensure that traffic from an isolated port in one switch does not reach another isolated or community port in a different switch even after traversing an inter-switch link. By embedding the isolation information at the VLAN level and by transporting it along with the packet, you can maintain consistent behavior throughout the network. The mechanism that restricts Layer 2 communication between two isolated ports in the same switch also restricts Layer 2 communication between two isolated ports in two different switches.
Private VLAN Ports
Within a private VLAN domain, there are three separate port designations. Each port designation has its own unique set of rules that regulate the ability of one endpoint to communicate with other connected endpoints within the same private VLAN domain. The following are the three port designations:
For additional information about private VLANs, see the Cisco Nexus 1000VE Layer 2 Switching Configuration Guide.
Troubleshooting Guidelines
Follow these guidelines when troubleshooting private VLAN issues:
Private VLAN Troubleshooting Commands
Use the commands listed in this section to troubleshoot problems related to private VLANs.
|
|
|
|---|---|
Displays that a physical Ethernet interface in a private VLAN trunk promiscuous mode is up. |
|
Displays that a virtual Ethernet interface in private VLAN host mode is up. |
|
Example 12-1 show vlan private-vlan Command
Example 12-2 show interface name Command
Example 12-3 show interface veth Command
Example 12-4 module vse module-number execute vemcmd show port Command
If additional information is required for Cisco Technical Support to troubleshoot a private VLAN issue, use the following commands:
Feedback