private vlan layer 3 issue

hi i have the following equipment:

1 x 3550 layer 3 switch  (ios c3550-i5q312-mz.121-22.ea2.bin)
1 x router

note:  before i go ahead and configure this i am aware this is not an ideal setup as normally i would use a layer 2 2950 instead!!

question 1.  i am not sure if i have the correct (ios) but according to my reading the servers can be on a separate vlan to my isolated users and still receive the ip addresses - is this correct if so i cannot complete my config below and would appreciate some help as i know ive got my reading back to front ?
 
server 1 - vlan 10
ip address 192.168.1.2 255.255.255.0

server 2 - vlan 20
ip address 192.168.2.2 255.255.255.0

client a - vlan 30
auto ip address from vlan 10
client b - vlan 40
auto ip address from vlan 20

config t

vlan 10
private-vlan community

vlan  20
private-vlan community

vlan 30
private-vlan isolated

vlan 40
private-vlan isolated

vlan 50
private-vlan primary
private-vlan association 10, 20, 30, 40


note:  the above commands were successful


ip routing

interface fa0/1
no switchport
ip address 172.16.1.1 255.255.255.0
duplex full
speed 100
no shut


router eigrp 1
network 172.16.1.0
network 192.168.1.0
network 192.168.2.0

int vlan 50
ip address 172.16.1.1 255.255.255.0
private-vlan  - command not accepted  ???

question 2.  once i have correctly configured my switch for (private vlans) i presume i would add the following as usual ?

int fa0/1
switchport trunk allowed vlan 10,20,30,40,50
switchport mode trunk
mikey250Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Soulja53 6F 75 6C 6A 61 Commented:
Okay, so my understanding of PVLANs is that you can only have on isolated secondary vlan per primary vlan. You can have multiple community vlans.

Also, the subnet that you assign the primary vlan is the subnet you will used with your secondary vlans.

As for your trunk configuration, that should be fine.

On the interface vlan 50, it is already associated with primary vlan 50 when you created it.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mikey250Author Commented:
morning soulja,

i understand some of what you say but need to know why my command want except so i can practically attempt task as not sure what step by step command syntax i should do.
0
kevinhsiehCommented:
Not sure what you are trying to accomplish. private-vlan is normally used for a high security network segment where devices on the same broadcast domain are prevented from talking to each other. A typical situation would be in a DMZ where you don't want the various servers in the DMZ to be able to talk to each other. This is probably NOT what you want. Are you trying to keep user workstations from being able to communicate, even when they are on the same VLAN?

See http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008013565f.shtml

A normal thing to do is put your users on one or more VLANs, and then your servers on one or more different VLANs. Route between your VLANs and apply ACLs if desired on the L3 VLAN interfaces.
0
Powerful Yet Easy-to-Use Network Monitoring

Identify excessive bandwidth utilization or unexpected application traffic with SolarWinds Bandwidth Analyzer Pack.

mikey250Author Commented:
when i completed the ccnp course they discussed (private-vlan), so i am trying to implement it, assuming it is relevant.

normally i have 1 x cisco 2950 with the server & users on same switch and same vlan..

i have setup the following in passed but i have never added multiple servers:

- router on stick
- intervlan svi

note:  i only have 4 x 2950 & 1 x 3550 & 2650, 3600 & 2500 routers - at this moment in time..legacy i know but using these for testing.

c2950-i6q412-mz.121-22.ea6.bin
c3550-i5q312-mz.121-22.ea2.bin

ive located the below link via (your originaly pvlan url) and it appears that my equipment above will not allow pvlan, but why except some commands, as per my main thread according to below url:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a0080094830.shtml

note:  if you look at my (main question) i attempted to configure for a private-vlan, but then got stuck at this part below:

int vlan 50
ip address 172.16.1.1 255.255.255.0
private-vlan  - command not accepted  ???

so wondering in what scenario this (private-vlan) is actually used, but you have advised it is specifically for (dmz) - oh ok i did not know this!!  ?

note: i have never configured server1-dns/dhcp on vlan 2, server2-file on vlan 3, server3-exchange on vlan 4, server5-backup on vlan 5 assuming this is the normal for example since you mention below (dmz), so i wish to set something up so i can properly understand what is going on and why!!

http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a008017acad.shtml

"are you trying to keep user workstations from being able to communicate, even when they are on the same vlan  ?"

- yes
 
"a normal thing to do is put your users on one or more vlans, and then your servers on one or more different vlans. route between your vlans and apply acls if desired on the layer 3 vlan interfaces."

- yes i wish to do this aswell but not sure what to do..

i am not even sure if private-vlans are supposed to be used for only (workgroup networks) and if a domain is configured then i am thinking (intervlan svis) is the correct decision, but i cannot get a proper answer for this...  ?
0
Soulja53 6F 75 6C 6A 61 Commented:
int vlan 50
ip address 172.16.1.1 255.255.255.0
private-vlan  - command not accepted  ???


This is not needed. As I stated earlier, the SVI is automatically associated with the primary vlan when created.
0
mikey250Author Commented:
if i configure my 3550 layer 3 switch for inter-vlan method then i would always do for example when using multiple vlans:

int vlan 50
ip address 172.16.1.1 255.255.255.0
private-vlan  - command not accepted  ???

int vlan 51
etc etc

int vlan 52
etc etc

new comments below:

i have now removed multiple communities) from my main question using 1 x community as below to simplify so i can understand where i loose my understanding:

i will go away and think about it as i do have the following config which does not show any inter-vlan:

config t

vlan 100
private-vlan primary
private-vlan association 100,120,130

vlan 120
private-vlan isolated

vlan 130
private-vlan community


int fa0/1
description connected to router towards isp
switchport mode private-vlan promiscous
switchport private-vlan mapping 100,120,130

int fa0/2
description connected to a standalone-host-pc1 (connnects direct to promiscous)
switchport private-vlan host
switchport private-vlan host-association 100,120

int fa0/3
description connected to server1
switchport private-vlan host
switchport private-vlan host-association 100,130

int fa0/8
description connected to pc1 (receives ip address from server1)
switchport private-vlan host
switchport private-vlan host-association 100,130
0
Soulja53 6F 75 6C 6A 61 Commented:
Okay so the above looks right. Now when you want the layer 3, you just add an

interface vlan 100
ip address x.x.x.x y.y.y.y
0
mikey250Author Commented:
ok so when i add the below and the fact that it is configured specifically for (private-vlans) and not the usual (inter-vlan routing), you are saying that the below knows to (just) connect to the (int fa0/1 promiscous port) and allow internet access...!

int vlan 100 - for example
ip address 172.16.1.x 255.255.255.252

when i think of router on stick or normal intervlan routing it is simular but confusing since im used to the others and not (private-vlans) methodology!!
0
Soulja53 6F 75 6C 6A 61 Commented:
When you configure the vlan interface, you will then configure the hosts on the private vlan to point to the vlan interface as their default gateway just like normal vlans.  The only difference with private vlans is that you are restricting WITHIN the vlan by using secondaries.
0
mikey250Author Commented:
ok although it just seems foreign to me as never used this method before!
0
Soulja53 6F 75 6C 6A 61 Commented:
From Cisco documentation:

"When the primary VLAN is associated with and ma
pped to the secondary VLAN, any configuration on
the primary VLAN is propag
ated to the secondary VLAN SVIs. For ex
ample, if you assign an IP subnet
to the primary VLAN SVI, this subnet is the IP
subnet address of the entire private VLAN. "
0
mikey250Author Commented:
the example i have actually uses the following for (community 130) but i only used server1:

server1
server2
server3

i assumed each server may have different subnet to server1 so how would i do this  ?
0
Soulja53 6F 75 6C 6A 61 Commented:
What do you mean they will have different subnet?  Anything under the primary vlan is still part of the primary vlan subnet.

For example, if the primary vlan's subnet is 192.168.100.0/24,

The secondary vlans are going to be part of this subnet.
0
mikey250Author Commented:
it was stupid of me to think of it that way, but as i did not think of a (dmz) for example as per (id  39607756) as previously i just assumed multiple ip subnets although (no it did not make sense to me)!!

so the following could be for example but on (same subnet)

serverb - exchange
serverc - file printserver
0
Soulja53 6F 75 6C 6A 61 Commented:
Yes, they can be on the same subnet. You can then decide whether you want them in a community secondary and able to talk to on another, or in an isolated secondary and not able to talk to each other.
0
mikey250Author Commented:
what command is used to make a 2nd or 3rd server a secondary or third community ?
0
Soulja53 6F 75 6C 6A 61 Commented:
You just associate the port they are connected to the to the secondary vlan you created that is community or isolated.

Based on your config above:
vlan 120
private-vlan isolated

vlan 130
private-vlan community


int fa0/2
description connected to a standalone-host-pc1 (connnects direct to promiscous)
switchport private-vlan host
switchport private-vlan host-association 100,120

int fa0/3
description connected to server1
switchport private-vlan host
switchport private-vlan host-association 100,130

int fa0/8
description connected to pc1 (receives ip address from server1)
switchport private-vlan host
switchport private-vlan host-association 100,130
0
mikey250Author Commented:
ok!  i suppose my only question is, are private-vlans popular or are they just for financial or government institutions  ?
0
Soulja53 6F 75 6C 6A 61 Commented:
I really can't say. I know we use them in our current backup environment in all of our data centers.
0
mikey250Author Commented:
ive done some work in a data center some years back but never had that knowledge or job description to get involved with that part, so i always thought it was just:

core - root bridge/routing protocol
core/dist1 - integrated together - root bridge/routing protocols/hsrp - active
core/dist2 - same as dist1 but hsrp - standby
access1 - vtp client
access2 - vtp client

for example, so from what you are saying (data centres) most probably use private-vlans


wondered if it was just: vtp server/root bridge/hsrp active & second distribution & client etc
0
Soulja53 6F 75 6C 6A 61 Commented:
You're putting words in my mouth now. I didn't say they were primarily used in data centers. I just stated that we use them in our data centers for our backup environment.

Regarding that other question. I think we already discussed this in your other thread.
0
mikey250Author Commented:
sorry :) i read what you said as was just looking for a must do this in this scenario but this is also done in my datacenter.

much appreciated!!
0
mikey250Author Commented:
much appreciated.  sound advice!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.