A question about private VLANs

Greetings,

Just to make sure I understand you correctly, you want a segment set up in which the hosts cannot talk to each other, but be able to talk outside that segment, and in which you _MAY_ want some limited interhost traffic within that segment?

There are a number of ways of doing this, it really comes down to how much resource do you need to throw at it. At the bottom level, you can keep it simple by forcing ALL traffic to leave the Layer 2 device (say a 2950 with Port Protected for each connection to the hosts), and that traffic then heads to a single port that is NOT Port Protected as the "exit" point for that "segment", into a Layer 3 device that can then route traffic (this may be a gotcha if the L3 device is a Firewall that does not allow same interface bidirectional traffic). That same Layer 3 device can then use an ACL to allow or deny traffic between devices on that "protected" segment.

I guess the prime catch here is that a DMZ is usually behind some sort of Firewall, and if the Firewall is also the Layer 3 device above, then the Firewall needs to be able to route back out that same interface, but even if so, there are ways around this...

Using Port Protected, all hosts can be in the one Subnet, and the ONLY path between those hosts being via the Layer 2 exit point, which can then control traffic between the Protected hosts using an ACL. At the bottom end you do not need a trunk at all, and the only VLAN can be the "default" one if you wish.

Basically, what Port Protected does is prevent ARP's from a Protected Port being seen by any other Protected Port on that segment EXCEPT from the un-Protected Port (containing the Layer 3 device), so Layer 3 device then proxy ARP's for the target MAC.

Not at all, what you appear to be looking for (if I understand the question correctly) is something quite "normal". The main issue in doing this is ensuring that capacity exists to handle traffic volume for all this traffic flow, remembering that ALL traffic goes both in and out just one Port.

Good luck.............pk.

Ok, That is pretty much what I expected.

Second situation.

Floor switches : 2950s

Core switch: 6509 (8.2) with MSFC

Can I set up private VLANs on a 6509, and then assign ports on the

Greetings,

A PVLAN transits a Trunk port just like a normal VLAN, so yes, you can spread PVLAN's between switches if you wish.

Cheers............pk.

Excellent.

Thanks a lot :-)