Primary and secondary VLANs
A private VLAN domain pairs a primary VLAN with associated secondary VLANs. Hosts can use the same IP subnet while the switch enforces different Layer 2 reachability for each port role. The primary VLAN commonly connects to a shared gateway through a promiscuous port.
An isolated host port can exchange frames with its mapped promiscuous port but cannot communicate directly with other host ports in the private VLAN. A community host port can exchange frames within its own community and with mapped promiscuous ports. Separate communities cannot reach each other directly. The promiscuous port can exchange frames with hosts in its mapped secondary VLANs.
What the isolation covers
The switch enforces these rules on Layer 2 forwarding. Traffic routed through a gateway is subject to that gateway’s policy. If hosts must stay isolated even through a router or other shared service, verify the policy on that path separately.
Try it in a lab
- On a switch that supports private VLANs, put two hosts on isolated ports and connect a third test host to a promiscuous port mapped to their secondary VLAN. Give all three addresses in the same subnet.
- Confirm that both isolated hosts can ping the promiscuous test host. Then try a direct ping between the isolated hosts. It should fail without a routed path around the switch’s Layer 2 rule.
- Move the first two hosts into the same community. Repeat the direct ping to verify that hosts in that community can now communicate with each other.