{"id":220,"date":"2016-02-05T14:07:36","date_gmt":"2016-02-05T13:07:36","guid":{"rendered":"https:\/\/zed-network.fr\/?p=220"},"modified":"2016-02-09T16:12:13","modified_gmt":"2016-02-09T15:12:13","slug":"pvlan","status":"publish","type":"post","link":"https:\/\/zed-network.fr\/?p=220","title":{"rendered":"PVLAN"},"content":{"rendered":"

Network architecture<\/h1>\n

In this test, we used an ASA5505 as gateway, a Cisco 3750 for the switching and ESXi.<\/p>\n

\"PVLAN_ARCHI\"<\/p>\n

We used 4 Vlans. Vlan110 as primary and 111 to 113 as secondary.<\/p>\n

We created a distributed switch on the vCenter and created the private vlans.<\/p>\n

\"PVLAN_ESX\"<\/p>\n

DVSwitch PVLAN Settings<\/strong><\/p>\n

\"PVLAN_esx2\"<\/p>\n

PortGroup List<\/strong><\/p>\n

\"PVLAN_esx3\"<\/p>\n

PortGroup Settings<\/strong><\/p>\n

On this plateform, SRV1, SRV2 and SRV4 can communicate together and with her gateway and the SVI, but can’t with SRV3, SRV5, SRV6 and SRV7.<\/p>\n

SRV6 and SRV7 can communicate together and with her gateway and the SVI, but can’t with this other SRV.<\/p>\n

Finally SRV3 and SRV5 are totally isolated and can only communicate with the gateway and the SVI.<\/p>\n

Limitation:<\/strong><\/span> With a 3750, you can’t trunk the promiscuous port to\u00a0a router or firewall tag with 802.1q<\/p>\n

With a Nexus some commands have been added.<\/p>\n

# switchport private-vlan ?\r\n association Private vlan trunk association\r\n host-association Set the private VLAN host association\r\n mapping<\/strong> Set the private VLAN access\/trunk promiscuous<\/strong> mapping\r\n trunk Set the private vlan trunking configuration<\/strong><\/pre>\n
Now you can trunk\u00a0your promiscuous port :<\/p>\n
# switchport private-vlan mapping trunk ?\r\n <1-3967,4048-4093> Primary private VLAN<\/pre>\n
Now we will try to use PVLAN in promicuous and add a Nexus 3548 with the following version :\u00a06.0(2)A7(1). Before this version, I can’t enable the feature private-vlan.<\/p>\n
\"PVLAN_ARCHI2\"<\/p>\n
The main difference is the capacity to trunk on the promiscuous port.<\/p>\n
interface Ethernet1\/1\r\n speed 1000\r\n switchport mode private-vlan trunk promiscuous\r\n spanning-tree port type edge trunk\r\n duplex full\r\n switchport private-vlan mapping trunk 300 301\r\n switchport private-vlan mapping trunk 200 201-202\r\n switchport private-vlan mapping trunk 110 111-113\r\n no shutdown<\/pre>\n
Here we have three primary vlans (110, 200 and 300) trunked to the firewall.<\/p>\n
ASA5510# sh run interface\r\n!\r\ninterface Ethernet0\/0\r\n nameif OUTSIDE\r\n security-level 0\r\n ip address 213.218.130.78 255.255.255.0\r\n!\r\ninterface Ethernet0\/1\r\n no nameif\r\n security-level 100\r\n no ip address\r\n!\r\ninterface Ethernet0\/1.110\r\n vlan 110\r\n nameif INSIDE\r\n security-level 100\r\n ip address 192.168.1.1 255.255.255.0\r\n!\r\ninterface Ethernet0\/1.200\r\n vlan 200\r\n nameif INSIDE200\r\n security-level 100\r\n ip address 192.168.200.1 255.255.255.0\r\n!\r\ninterface Ethernet0\/1.300\r\n vlan 300\r\n nameif INSIDE300\r\n security-level 100\r\n ip address 192.168.30.1 255.255.255.0<\/pre>\n
Now in the following design, we transport the Private-vlan through a 3750 and we transform the private-vlan isolated 113 to a normal vlan 10. But you can also just terminated with private-vlan.<\/p>\n
\"PVLAN_ARCHI3\"<\/p>\n
The SRV7 can ping every other servers and the gateway (SRV1 to SRV6), but SRV1 to 6 can’t ping themself except\u00a0the SRV7.<\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
Network architecture In this test, we used an ASA5505 as gateway, a Cisco 3750 for the switching and ESXi. We used 4 Vlans. Vlan110 as primary and 111 to 113 as secondary. We created a distributed switch on the vCenter and created the private vlans. DVSwitch PVLAN Settings PortGroup List PortGroup Settings On this plateform, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-220","post","type-post","status-publish","format-standard","hentry","category-cisco"],"_links":{"self":[{"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/posts\/220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zed-network.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=220"}],"version-history":[{"count":6,"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/posts\/220\/revisions"}],"predecessor-version":[{"id":234,"href":"https:\/\/zed-network.fr\/index.php?rest_route=\/wp\/v2\/posts\/220\/revisions\/234"}],"wp:attachment":[{"href":"https:\/\/zed-network.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zed-network.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zed-network.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}