Private VLANs Flashcards
What are private VLANs?
VLANs that have limited access to other VLANs on the network, or even limited access to other hosts on the same VLAN.
What are the three type of private VLANs?
Community VLANs, isolated VLANs, and Primary VLANs.
Describe a community VLAN.
Hosts on community VLANs can speak to each other but cannot talk to other VLANs on the network.
Describe an isolated VLAN.
Hosts on an isolated VLAN cannot talk to other VLANs on the network or even other hosts in the same isolated VLAN.
List two benefits of private VLANs.
Increased security, and the ability to use the same IP range across multiple VLANs without subnetting.
Describe a primary VLAN.
Primary VLANs contain the gateway used by community and isolated VLANs to get out of the network. Primary VLANs can only be reached via a promiscuous port.
Describe a promiscuous port.
A promiscuous port is the only type of port that community and isolated VLANs are allowed to use to access their gateway.
What feature must be disabled for private VLANs to work?
VTP. It must be set to transparent or off.
Briefly describe the steps in configuring private VLANs.
1.Configure a primary VLAN and associate it with your community and isolated VLANs. 2.Configure your community and isolated VLANs. 3.Configure your promiscuous interface and associate it with all private VLANs (primary, community and isolated). 4.Configure your community and isolated ports and associate them with their respective VLAN AND the primary VLAN.
Refer to the exhibit. The web servers WS_1 and WS_2 need to be accessed by external and internal users. For security reasons, the servers should not communicate with each other, although they are located on the same subnet. The servers do need, however, to communicate with a database server located in the inside network. What configuration will isolate the servers from each other?
PVLAN_promiscuous_ports.jpg
A. The switch ports 3/1 and 3/2 will be defined as secondary VLAN community ports. The ports connecting to the two firewalls will be defined as primary VLAN promiscuous ports.
B. The switch ports 3/1 and 3/2 and the ports connecting to the two firewalls will be defined as primary VLAN promiscuous ports.
C. The switch ports 3/1 and 3/2 and the ports connecting to the two firewalls will be defined as primary VLAN community ports.
D. The switch ports 3/1 and 3/2 will be defined as secondary VLAN isolated ports. The ports connecting to the two firewalls will be defined as primary VLAN promiscuous ports.
Answer: D
Explanation
WS_1 and WS_2 cannot communicate with each other so we can put them into isolated ports. Isolated ports can only communicate with promiscuous ports so Fa3/34 and Fa3/35 should be promiscuous ports so that they can send and receive data with the Data Server.
Note: Answer A is not clear because it does not state the switch ports 3/1 and 3/2 are put into the same or different VLAN community ports. If they are put into different VLAN communities then answer A is correct.
Refer to the exhibit. What can be concluded about VLANs 200 and 202?
show_vlan_private-vlan_type.jpg
A. VLAN 202 carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN. VLAN 200 carries traffic between community ports and to promiscuous ports.
B. VLAN 202 carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN. VLAN 200 carries traffic from isolated ports to a promiscuous port.
C. VLAN 200 carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN. VLAN 202 carries traffic between community ports and to promiscuous ports.
D. VLAN 200 carries traffic from promiscuous ports to isolated, community, and other promiscuous ports in the same VLAN. VLAN 202 carries traffic from isolated ports to a promiscuous port.
Answer: B
Explanation
In fact the exhibit above is wrong, that output should be from the command “show vlan private-vlan”. The “show vlan private-vlan type” should give output like this:
Vlan
————– Type
————-
202
200 Primary
isolated
With this output we can see VLAN 202 is configured as the primary VLAN while VLAN 200 is configured as secondary (isolated) VLAN -> B is correct.
Private VLANs can be configured as which three of these port types? (Choose three)
A. isolated
B. protected
C. private
D. associated
E. promiscuous
F. community
Answer: A E F
Explanation
There are three types of ports can be configured in a Private VLAN: isolated, promiscuous, community.
* Isolated: only communicate with promiscuous ports. Notice that it cannot even communicate with another isolated port. Also, there can be only 1 isolated VLAN per PVLAN.
* Promiscuous: can communicate with all other ports. The default gateway is usually connected to this port so that all devices in PVLAN can go outside.
* Community: can communicate with other members of that community and promiscuous ports but cannot communicate with other communities. There can be multiple community VLANs per PVLAN.
Refer to the exhibit. From the configuration shown, what can you determine about the private VLAN configuration?
Switch# configure terminal
Switch (config)# vlan 20
Switch (config-vlan)# private-vlan primary
Switch (config-vlan)# exit
Switch (config)# vlan 501
Switch (config-vlan)# private-vlan isolated
Switch (config-vlan )#exit
Switch (config)# vlan 502
Switch (config-vlan)#private-vlan community
Switch (config-vlan)# exit
Switch (config)# vlan 503
Switch (config-vlan )# private-vlan community
Switch (config-vlan)# exit
Switch (config)# vlan 20
Switch (config-vlan)#private-vlan association 501-503
Switch (config-vlan)# end
A. Only VLAN 503 will be the community PVLAN because multiple community PVLANs are not allowed.
B. Users of VLANs 501 and 503 will be able to communicate.
C. VLAN 502 is a secondary VLAN.
D. VLAN 502 will be a standalone VLAN because it is not associated with any other VLANs.
Answer: C
Explanation
There are two types of secondary VLAN: isolated and community. In this case VLAN 502 is a community VLAN -> C is correct.
In a PVLAN, multiple community VLANs are allowed. But notice a PVLAN can have only one primary VLAN and one isolated VLAN -> A is not correct.
Only community in the same VLAN can communicate with each other. Users in different communities are not able to communicate -> B is not correct.
The command “private-vlan association 501-503″ associates VLANs 501, 502 and 503 to the Primary VLAN 20 -> D is not correct.
When configuring private VLANs, which configuration task must you do first?
A. Configure the private VLAN port parameters.
B. Configure and map the secondary VLAN to the primary VLAN.
C. Disable IGMP snooping.
D. Set the VTP mode to transparent.
Answer: D
Explanation
Before configuring private VLANs, we must set VTP mode to transparent because VTP version 1 and 2 do not support private VLAN (VTP version 3 does support PVLAN). Notice that a switch in VTP transparent mode still forwards other VTP updates to its neighbors.
A switch has been configured with Private VLANs. With that type of PVLAN port should the default gateway be configured?
A. Trunk
B. Isolated
C. Primary
D. Community
E. Promiscuous
Answer: E
Explanation
A default gateway should be configured Promiscuous type so that all devices in PVLAN can go outside.
