In this test, we used an ASA5505 as gateway, a Cisco 3750 for the switching and ESXi.
We used 4 Vlans. Vlan110 as primary and 111 to 113 as secondary.
We created a distributed switch on the vCenter and created the private vlans.
DVSwitch PVLAN Settings
On this plateform, SRV1, SRV2 and SRV4 can communicate together and with her gateway and the SVI, but can’t with SRV3, SRV5, SRV6 and SRV7.
SRV6 and SRV7 can communicate together and with her gateway and the SVI, but can’t with this other SRV.
Finally SRV3 and SRV5 are totally isolated and can only communicate with the gateway and the SVI.
Limitation: With a 3750, you can’t trunk the promiscuous port to a router or firewall tag with 802.1q
With a Nexus some commands have been added.
# switchport private-vlan ?
association Private vlan trunk association
host-association Set the private VLAN host association
mapping Set the private VLAN access/trunk promiscuous mapping
trunk Set the private vlan trunking configuration
Now you can trunk your promiscuous port :
# switchport private-vlan mapping trunk ?
<1-3967,4048-4093> Primary private VLAN
Now we will try to use PVLAN in promicuous and add a Nexus 3548 with the following version : 6.0(2)A7(1). Before this version, I can’t enable the feature private-vlan.
The main difference is the capacity to trunk on the promiscuous port.
switchport mode private-vlan trunk promiscuous
spanning-tree port type edge trunk
switchport private-vlan mapping trunk 300 301
switchport private-vlan mapping trunk 200 201-202
switchport private-vlan mapping trunk 110 111-113
Here we have three primary vlans (110, 200 and 300) trunked to the firewall.
ASA5510# sh run interface
ip address 188.8.131.52 255.255.255.0
no ip address
ip address 192.168.1.1 255.255.255.0
ip address 192.168.200.1 255.255.255.0
ip address 192.168.30.1 255.255.255.0
Now in the following design, we transport the Private-vlan through a 3750 and we transform the private-vlan isolated 113 to a normal vlan 10. But you can also just terminated with private-vlan.
The SRV7 can ping every other servers and the gateway (SRV1 to SRV6), but SRV1 to 6 can’t ping themself except the SRV7.