Private VLAN

Private VLAN is the technique of dividing single VLAN into different sub VLANs. This is generally used in the ADSL networks. Also, we can use it to simplify the IP address assignment because all ports are in the same subnet, although they are logically separated in the data link layer.

Private VLAN contains two components

1. Primary VLAN, which is the real VLAN
2. Secondary VLANs, which are the sub VLANs

Secondary VLANs can be one of these:

• Isolated
  • Ports associated with this VLAN cannot communicate each other
  • Ports associated with this VLAN cannot communicate with any other private VLAN
  • Ports associated with this VLAN can communicate only with Primary VLAN
• Community
  • Ports associated with this VLAN can communicate each other
  • Ports associated with this VLAN cannot communicate with any other private VLAN
  • Ports associated with this VLAN can communicate only with Primary VLAN

Now lets, Create these VLANs as in the figure

Creating Community VLANs

Sw1(config)# vlan 100

Sw1(config-vlan)#private-vlan community

Sw1(config)# vlan 200

Sw1(config-vlan)#private-vlan community

Creating isolated VLAN

Sw1(config)# vlan 300

Sw1(config-vlan)#private-vlan isolated

Creating primary VLAN and joining it with primary VLAN

Sw1(config)# vlan 500

Sw1(config-vlan)#private-vlan primary

Sw1(config-vlan)#private-vlan association 100,200,300

To proceed to next step, we must understand about different types of ports

There are mainly two types of port in Private VLAN - Promiscuous port and Host port. Host port is further divides into two types - Isolated port and Community port.

• Promiscuous port : This port can communicate with anything connected to primary or secondary VLANs. Usually, router, firewall etc. are connect to this port
• Isolated port: This port connect to hosts within the isolated VLAN. It can only communicate with the promiscuous port
• Community port :  This port connect to hosts within the community VLAN. It can communicate with promiscuous port and other ports in the same community VLAN

Now, lets assign these different types of port to different VLANs we created. Remember, every ports except Promiscuous port are host port. So the VLAN which we assign these ports determines whether it is isolated port or community port.

SW1(config)#int range e0/1 - 2
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport mode private-vlan host
SW1(config-if-range)#switchport private-vlan host-association 500 300

SW1(config)#int range e1/0 - 1
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport private-vlan host-association 500 100

SW1(config)#int range e1/2 - 3
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport private-vlan host-association 500 200

SW1(config)#int e0/0
SW1(config-if)#switchport
SW1(config-if)#switchport mode private-vlan promiscuous
SW1(config-if)#switchport private-vlan mapping 500 100,200,300

Configuring ASA to allow ping

Just add ICMP to default inspection class:

ASA(config)#policy-map global_policy
ASA(config-pmap)#class inspection_default
ASA(config-pmap-c)#inspect icmp

ASA static/Default Routing configuration

Syntax of static route configuration is :
Route <interface-name> <ip address> <netmask> <gateway ip> [distance]
Objects:

• Configure static routing to inside interface

ASA1(config)#route inside 172.30.10.0 255.255.255.0 172.30.30.2 1
ASA1(config)#route inside 172.30.20.0 255.255.255.0 172.30.30.2 1

• Configure default route to internet

ASA1(config)#route outside 0.0.0.0 0.0.0.0 192.168.1.2

Note: we can use the command “route outside 0 0 192.168.1.2” for default route, both are same.

Java configuration for IPS (IDM)

Step 1 Close all instances of Internet Explorer or Netscape.

Step 2 Click Start > Settings > Control Panel.

Step 3 If you have Java Plug-in 1.4.2 installed:

a. Click Java Plug-in.

The Java Plug-in Control Panel appears.

b. Click the Advanced tab.

c. Type -Xmx256m in the Java RunTime Parameters field.

d. Click Apply and exit the Java Control Panel.

Step 4 If you have Java Plug-in 1.5 installed:

a. Click Java.

The Java Control Panel appears.

b. Click the Java tab.

c. Click View under Java Applet Runtime Settings.

The Java Runtime Settings Panel appears.

d. Type -Xmx256m in the Java Runtime Parameters field and then click OK.

e. Click OK and exit the Java Control Panel.