Private VLAN

Private VLAN is the technique of dividing single VLAN into different sub VLANs. This is generally used in the ADSL networks. Also, we can use it to simplify the IP address assignment because all ports are in the same subnet, although they are logically separated in the data link layer.

Private VLAN contains two components

1. Primary VLAN, which is the real VLAN
2. Secondary VLANs, which are the sub VLANs

Secondary VLANs can be one of these:

• Isolated
  • Ports associated with this VLAN cannot communicate each other
  • Ports associated with this VLAN cannot communicate with any other private VLAN
  • Ports associated with this VLAN can communicate only with Primary VLAN
• Community
  • Ports associated with this VLAN can communicate each other
  • Ports associated with this VLAN cannot communicate with any other private VLAN
  • Ports associated with this VLAN can communicate only with Primary VLAN

Now lets, Create these VLANs as in the figure

Creating Community VLANs

Sw1(config)# vlan 100

Sw1(config-vlan)#private-vlan community

Sw1(config)# vlan 200

Sw1(config-vlan)#private-vlan community

Creating isolated VLAN

Sw1(config)# vlan 300

Sw1(config-vlan)#private-vlan isolated

Creating primary VLAN and joining it with primary VLAN

Sw1(config)# vlan 500

Sw1(config-vlan)#private-vlan primary

Sw1(config-vlan)#private-vlan association 100,200,300

To proceed to next step, we must understand about different types of ports

There are mainly two types of port in Private VLAN - Promiscuous port and Host port. Host port is further divides into two types - Isolated port and Community port.

• Promiscuous port : This port can communicate with anything connected to primary or secondary VLANs. Usually, router, firewall etc. are connect to this port
• Isolated port: This port connect to hosts within the isolated VLAN. It can only communicate with the promiscuous port
• Community port :  This port connect to hosts within the community VLAN. It can communicate with promiscuous port and other ports in the same community VLAN

Now, lets assign these different types of port to different VLANs we created. Remember, every ports except Promiscuous port are host port. So the VLAN which we assign these ports determines whether it is isolated port or community port.

SW1(config)#int range e0/1 - 2
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport mode private-vlan host
SW1(config-if-range)#switchport private-vlan host-association 500 300

SW1(config)#int range e1/0 - 1
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport private-vlan host-association 500 100

SW1(config)#int range e1/2 - 3
SW1(config-if-range)#switchport
SW1(config-if-range)#switchport private-vlan host-association 500 200

SW1(config)#int e0/0
SW1(config-if)#switchport
SW1(config-if)#switchport mode private-vlan promiscuous
SW1(config-if)#switchport private-vlan mapping 500 100,200,300

Monitoring Internet Connection using IP SLA

Our company may have two connection to the internet through 2 ISPs. If we want to use one connection as primary and other as backup, we can use IP SLA to monitor the link. It detects the link failure even if the connection between modem and ISP fails. So it helps to switch over to the backup path automatically as soon as the primary path is down.

Step1 : Configuring SLA process

R1(config)#ip sla 1

R1(config-ip-sla)#icmp-echo 8.8.8.8

R1(config-ip-sla-echo)#frequency 5 (Means, every 5 second send icmp-echo packet to the ip 8.8.8.8. This can by any reliable IP on internet)

R1(config-ip-sla-echo)#exit

Step2: Scheduling SLA process

R1(config)#ip sla schedule 1 start-time now life forever (Means, start the sla process now and don’t end)

Note: we can check the process using the following command

R1#show ip sla statistics

Step3: Create a track object to track the change. It is used to inform the router about the current condition

R1(config)#track 10 rtr 1 reachability (this will inform the router if any reachability problem occurs. rtr is the old name of IP SLA)

R1(config-track)#exit

Step4: Create two static route two both ISPs with some tweaks

R1(config)#ip route 0.0.0.0 0.0.0.0 fastEthernet 0/0 track 10

R1(config)#ip route 0.0.0.0 0.0.0.0 fastEthernet 0/1 2

Now router will select ISP1 as primary path because of administrative distance is lower. If the link to ISP1 is down, then router automatically switch the connection to ISP2