Private VLAN

Private VLAN is the technique of dividing single VLAN into different sub VLANs. This is generally used in the ADSL networks. Also, we can use it to simplify the IP address assignment because all ports are in the same subnet, although they are logically separated in the data link layer.

Private VLAN contains two components

1. Primary VLAN, which is the real VLAN
2. Secondary VLANs, which are the sub VLANs

Secondary VLANs can be one of these:

• Isolated
  • Ports associated with this VLAN cannot communicate each other
  • Ports associated with this VLAN cannot communicate with any other private VLAN
  • Ports associated with this VLAN can communicate only with Primary VLAN
• Community
  • Ports associated with this VLAN can communicate each other
  • Ports associated with this VLAN cannot communicate with any other private VLAN
  • Ports associated with this VLAN can communicate only with Primary VLAN

Now lets, Create these VLANs as in the figure

Creating Community VLANs

Sw1(config)# vlan 100

Sw1(config-vlan)#private-vlan community

Sw1(config)# vlan 200

Sw1(config-vlan)#private-vlan community

Creating isolated VLAN

Sw1(config)# vlan 300

Sw1(config-vlan)#private-vlan isolated

Creating primary VLAN and joining it with primary VLAN

Sw1(config)# vlan 500

Sw1(config-vlan)#private-vlan primary

Sw1(config-vlan)#private-vlan association 100,200,300

To proceed to next step, we must understand about different types of ports

There are mainly two types of port in Private VLAN - Promiscuous port and Host port. Host port is further divides into two types - Isolated port and Community port.

• Promiscuous port : This port can communicate with anything connected to primary or secondary VLANs. Usually, router, firewall etc. are connect to this port
• Isolated port: This port connect to hosts within the isolated VLAN. It can only communicate with the promiscuous port
• Community port :  This port connect to hosts within the community VLAN. It can communicate with promiscuous port and other ports in the same community VLAN

Now, lets assign these different types of port to different VLANs we created. Remember, every ports except Promiscuous port are host port. So the VLAN which we assign these ports determines whether it is isolated port or community port.

SW1(config)#int range e0/1 - 2
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport mode private-vlan host
SW1(config-if-range)#switchport private-vlan host-association 500 300

SW1(config)#int range e1/0 - 1
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport private-vlan host-association 500 100

SW1(config)#int range e1/2 - 3
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport private-vlan host-association 500 200

SW1(config)#int e0/0
SW1(config-if)#switchport
SW1(config-if)#switchport mode private-vlan promiscuous
SW1(config-if)#switchport private-vlan mapping 500 100,200,300

Creating Site-to-Site VPNs with Pre-Shared Keys

Documentation:
1. Document your IKE Phase 1 negotiation criteria (example below)

• Encryption algorithm: AES-128
• Hashing: SHA-1
• Authentication: pre-shared
• Key exchange: Diffie-Hellman Group 2

2. Document your IPSec (IKE Phase 2) negotiation criteria (example below)

• Encryption algorithm: esp-aes 128
• Authentication: esp-sha-hmac

Configuring IKE Phase 1:
1. Enable ISAKMP: Router(config)#crypto isakmp enable
2. Create ISAKMP Policy: Router(config)#crypto isakmp policy <1-10000>

• Router(config)#crypto isakmp policy 100
• Router(config-isakmp)#encryption aes 128
• Router(config-isakmp)#authentication pre-share
• Router(config-isakmp)#group 2
• Router(config-isakmp)#hash sha

3. Configure ISAKMP Identity: Router(config)#crypto isakmp identity <address/hostname>
4. Configure pre-shared keys: Router(config)#crypto isakmp key <key> address <remote_ip>
Configuring IKE Phase 2:
1. Create transform sets: Router(config)#crypto ipsec transform-set <name> <methods>

• Router(config)#crypto ipsec transform-set JEREMY esp-aes 128 esp-sha-hmac

2. (optional) Configure IPSec lifetime: : Router(config)#crypto ipsec <seconds/kilobytes> <value>
3. Create mirrored ACLs defining traffic to be encrypted and the traffic expected to be received encrypted
4. Set up IPSec crypto-map: Router(config)#crypto isakmp map <name> <seq> ipsec-isakmp

• Router(config)#crypto map MAP 100 ipsec-isakmp
• Router(config-crypto-map)#match address <acl>
• Router(config-crypto-map)#set peer <remote_ip>
• Router(config-crypto-map)#set pfs <group1/2/5>
• Router(config-crypto-map)#set transform-set <set>

Verify:

• show crypto isakmp policy
• show crypto ipsec transform-set
• show crypto ipsec sa
• show crypto map
• debug crypto isakmp
• debug crypto ipsec