Primary VLAN

1. Primary VLAN

在采用以太网接入的场景中，基于用户安全和管理计费等方面的考虑，一般会要求接入用户互相隔离。VLAN是天然的隔离手段，于是很自然的想法是每个用户一个VLAN。但是，根据IEEE 802.1Q规定，最多可以提供4094个VLAN。如果每个用户一个VLAN，4094个VLAN远远不能满足需求。

Private VLAN采用二层VLAN结构，它在同一台设备上配置Primary VLAN和Secondary VLAN两类VLAN，即能够保证接入用户之间相互隔离，又能将接入的VLAN ID屏蔽掉，从而节省了VLAN资源。

  • Primary VLAN：用于连接上行设备，一个Primary VLAN可以和多个Secondary VLAN相对应。上行连接的设备只需知道Primary VLAN，而不必关心Secondary VLAN，Primary VLAN下面的Secondary VLAN对上行设备不可见。

  • Secondary VLAN：用于连接用户，Secondary VLAN之间二层报文互相隔离。如果希望实现同一Primary VLAN下Secondary VLAN用户之间报文的互通，可以通过配置上行设备（如图中的L3 Device A）的本地代理ARP/ND功能来实现三层报文的互通。

image-20230710143921000

L2 Device B上启动了Private VLAN功能。其中VLAN 10是Primary VLAN，VLAN 2、VLAN 5、VLAN 8是Secondary VLAN，VLAN 2、VLAN 5、VLAN 8都映射到VLAN 10，VLAN 2、VLAN 5、VLAN 8对L3 Device A不可见。

如果配置Private VLAN功能的设备为三层设备，Secondary VLAN间及Secondary VLAN与外部需要进行三层互通，则可以通过在本地设备上创建Secondary对应的VLAN接口（即Secondary VLAN interface），并在该Secondary VLAN interface上配置IP地址来实现；或者通过在本地设备上配置Primary VLAN下指定Secondary VLAN间三层互通，同时创建Primary VLAN interface（但不能创建Secondary VLAN interface），并在Primary VLAN interface上配置IP地址和本地代理ARP/ND功能来实现。

Private VLAN不支持组播功能。

Private VLAN不支持和VXLAN IP网关功能组合使用。

Primary VLAN和Secondary VLAN同时创建VLAN接口时，需要保持Primary VLAN和Secondary VLAN的VLAN接口MAC地址相同。

2. 配置Private VLAN

Private VLAN配置主要包括下面几个步骤：

(1) 配置Primary VLAN。

(2) 配置Secondary VLAN。

(3) 配置Primary VLAN和Secondary VLAN间的映射关系。

(4) 配置上行/下行端口。

  • 当上行端口只对应一个Primary VLAN时，配置该端口工作在promiscuous模式，可以实现上行端口加入Primary VLAN及同步加入对应的Secondary VLAN的功能；当上行端口对应多个Primary VLAN时，配置该端口工作在trunk promiscuous模式，可以实现上行端口加入多个Primary VLAN及同步加入各自对应的Secondary VLAN的功能。

  • 当下行端口只对应一个Secondary VLAN时，配置该端口工作在host模式，可以实现下行端口同步加入Secondary VLAN对应的Primary VLAN的功能；当下行端口对应多个Secondary VLAN时，配置该端口工作在trunk secondary模式，可以实现下行端口加入多个Secondary VLAN及同步加入各自对应的Primary VLAN的功能。

(5) 配置Primary VLAN下指定Secondary VLAN间三层互通。

配置Private VLAN时，需要注意：

  • 在完成配置后，建议作如下确认：对于工作模式为promiscuous的端口，确保该端口的缺省VLAN为Primary VLAN，该端口以Untagged方式加入Primary VLAN和Secondary VLAN；对于工作模式为trunk promiscuous/trunk secondary的端口，确保该端口以Tagged方式加入Primary VLAN和Secondary VLAN；对于工作模式为host的端口，确保该端口的缺省VLAN为Secondary VLAN，该端口以Untagged方式加入Primary VLAN和Secondary VLAN。

  • 配置Primary VLAN后，系统会自动将Secondary VLAN的动态MAC地址表项同步到Primary VLAN。

  • 配置Primary VLAN后，Secondary VLAN的静态MAC地址表项不生效。Secondary VLAN和Primary VLAN解除映射关系后，Primary VLAN的静态MAC地址表项对该Secondary VLAN的流量不生效。

  • 系统缺省VLAN（VLAN 1）不支持Private VLAN相关配置。

vlan vlan-id

private-vlan primary // 配置VLAN的类型为Primary VLAN

缺省情况下，VLAN的类型不是Primary VLAN

quit

vlan { vlan-id-list | all } // 创建一个或多个Secondary VLAN

quit

vlan vlan-id // 进入Primary VLAN视图

private-vlan secondary vlan-id-list // 建立Primary VLAN和Secondary VLAN的映射关系

缺省情况下，未建立Primary VLAN和Secondary VLAN的映射关系

quit

interface interface-type interface-number // 进入上行端口视图

port private-vlan vlan-id promiscuous // 配置上行端口在指定VLAN中工作在promiscuous模式

port private-vlan vlan-id-list trunk promiscuous // 配置上行端口在指定VLAN中工作在trunk promiscuous模式

二者选其一，缺省情况下，端口在指定VLAN中不工作在promiscuous/trunk promiscuous模式

quit

interface interface-type interface-number // 进入下行端口视图

配置下行端口加入Secondary VLAN

port link-type { access | hybrid | trunk } // 配置端口的链路类型

将当前端口加入指定VLAN

port access vlan vlan-id // Access端口

port trunk permit vlan { vlan-id-list | all } // Trunk端口

port hybrid vlan vlan-id-list { tagged | untagged } // Hybrid端口

三者选其一

port private-vlan vlan-id-list trunk secondary // 配置下行端口在指定VLAN中工作在trunk secondary模式

port private-vlan host // 配置下行端口工作在host模式

quit

vlan vlan-id // 进入Secondary VLAN视图

（可选）配置同一Secondary VLAN内各端口二层互通

undo private-vlan isolated

private-vlan community

二者选其一，缺省情况下，同一Secondary VLAN内的端口能够二层互通

quit

（可选）配置Primary VLAN下指定的Secondary VLAN间三层互通：

interface vlan-interface interface-number // 进入Primary VLAN interface视图

private-vlan secondary vlan-id-list // 配置当前Primary VLAN下指定的Secondary VLAN间三层互通

缺省情况下，Secondary VLAN之间三层不互通

配置Primary VLAN接口的IP地址

ip address ip-address { mask-length | mask } [ sub ]

ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }

local-proxy-arp enable // 开启本地代理ARP功能（IPv4环境）

local-proxy-nd enable // 开启本地代理ND功能（IPv6环境）

二者选其一，缺省情况下，本地代理ARP/ND功能处于关闭状态

display private-vlan [ primary-vlan-id ] // 显示Primary VLAN和其包含的Secondary VLAN的信息

3. Private VLAN典型配置举例（promiscuous模式）

组网需求

  • Device B上的Primary VLAN 5包含上行端口GigabitEthernet1/0/5，并关联两个Secondary VLAN（VLAN 2和VLAN 3），其中，VLAN 2包含端口GigabitEthernet1/0/2，VLAN 3包含端口GigabitEthernet1/0/3。

  • Device C上的Primary VLAN 6包含上行端口GigabitEthernet1/0/5，并关联两个Secondary VLAN（VLAN 3和VLAN 4），其中，VLAN 3包含端口GigabitEthernet1/0/3，VLAN 4包含端口GigabitEthernet1/0/4。

  • 从Device A看，下接的Device B只有一个VLAN（VLAN 5），下接的Device C只有一个VLAN（VLAN 6）。

image-20230710150935115

Device B

# 配置VLAN 5为Primary VLAN。

<DeviceB> system-view

[DeviceB] vlan 5

[DeviceB-vlan5] private-vlan primary

[DeviceB-vlan5] quit

# 创建Secondary VLAN 2、3。

[DeviceB] vlan 2 to 3

# 配置Primary VLAN 5和Secondary VLAN 2、3的映射关系。

[DeviceB] vlan 5

[DeviceB-vlan5] private-vlan secondary 2 to 3

[DeviceB-vlan5] quit

# 配置上行端口GigabitEthernet1/0/5在VLAN 5中工作在promiscuous模式。

[DeviceB] interface gigabitethernet 1/0/5

[DeviceB-GigabitEthernet1/0/5] port private-vlan 5 promiscuous

[DeviceB-GigabitEthernet1/0/5] quit

# 将下行端口GigabitEthernet1/0/2、GigabitEthernet1/0/3分别添加到VLAN 2、VLAN 3，并配置它们工作在host模式。

[DeviceB] interface gigabitethernet 1/0/2

[DeviceB-GigabitEthernet1/0/2] port access vlan 2

[DeviceB-GigabitEthernet1/0/2] port private-vlan host

[DeviceB-GigabitEthernet1/0/2] quit

[DeviceB] interface gigabitethernet 1/0/3

[DeviceB-GigabitEthernet1/0/3] port access vlan 3

[DeviceB-GigabitEthernet1/0/3] port private-vlan host

[DeviceB-GigabitEthernet1/0/3] quit

Device C

# 配置VLAN 6为Primary VLAN。

<DeviceC> system-view

[DeviceC] vlan 6

[DeviceC–vlan6] private-vlan primary

[DeviceC–vlan6] quit

# 创建Secondary VLAN 3、4。

[DeviceC] vlan 3 to 4

# 配置Primary VLAN 6和Secondary VLAN 3、4的映射关系。

[DeviceC] vlan 6

[DeviceC-vlan6] private-vlan secondary 3 to 4

[DeviceC-vlan6] quit

# 配置上行端口GigabitEthernet1/0/5在VLAN 6中工作在promiscuous模式。

[DeviceC] interface gigabitethernet 1/0/5

[DeviceC-GigabitEthernet1/0/5] port private-vlan 6 promiscuous

[DeviceC-GigabitEthernet1/0/5] quit

# 将下行端口GigabitEthernet1/0/3、GigabitEthernet1/0/4分别添加到VLAN 3、VLAN 4，并配置它们工作在host模式。

[DeviceC] interface gigabitethernet 1/0/3

[DeviceC-GigabitEthernet1/0/3] port access vlan 3

[DeviceC-GigabitEthernet1/0/3] port private-vlan host

[DeviceC-GigabitEthernet1/0/3] quit

[DeviceC] interface gigabitethernet 1/0/4

[DeviceC-GigabitEthernet1/0/4] port access vlan 4

[DeviceC-GigabitEthernet1/0/4] port private-vlan host

[DeviceC-GigabitEthernet1/0/4] quit

显示与验证

# 显示Device B上的Private VLAN配置情况（Device C的显示结果类似，这里不再列出）。

[DeviceB] display private-vlan

 Primary VLAN ID: 5

 Secondary VLAN ID: 2-3

 

 VLAN ID: 5

 VLAN type: Static

 Private VLAN type: Primary

 Route interface: Not configured

 Description: VLAN 0005

 Name: VLAN 0005

 Tagged ports:   None

 Untagged ports:

    GigabitEthernet1/0/2

    GigabitEthernet1/0/3

    GigabitEthernet1/0/5

 

 VLAN ID: 2

 VLAN type: Static

 Private VLAN type: Secondary

 Route interface: Not configured

 Description: VLAN 0002

 Name: VLAN 0002

 Tagged ports:   None

 Untagged ports:

    GigabitEthernet1/0/2

    GigabitEthernet1/0/5

 

 VLAN ID: 3

 VLAN type: Static

 Private VLAN type: Secondary

 Route interface: Not configured

 Description: VLAN 0003

 Name: VLAN 0003

 Tagged Ports:   None

 Untagged Ports:

    GigabitEthernet1/0/3

    GigabitEthernet1/0/5

可以看到，工作在promiscuous模式的端口GigabitEthernet1/0/5和工作在host模式的端口GigabitEthernet1/0/2和GigabitEthernet1/0/3均以Untagged方式允许VLAN报文通过。

4. Private VLAN典型配置举例（trunk promiscuous & trunk secondary模式）

组网需求

  • Device A上的VLAN 10和VLAN 20为Primary VLAN，上行端口GigabitEthernet1/0/5需要允许VLAN 10和VLAN 20的报文携带VLAN Tag通过。
  • Device A上的VLAN 11、12、21、22为Secondary VLAN，下行端口GigabitEthernet1/0/2允许Secondary VLAN 11、21的报文携带VLAN Tag通过，下行端口GigabitEthernet1/0/1允许Secondary VLAN 22通过，下行端口GigabitEthernet1/0/3允许Secondary VLAN 12通过。
  • Secondary VLAN 11、12映射到Primary VLAN 10；Secondary VLAN 21、22映射到Primary VLAN 20。

组网图

image-20230710151456217

Device A

# 配置VLAN 10和VLAN 20为Primary VLAN。

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] private-vlan primary

[DeviceA-vlan10] quit

[DeviceA] vlan 20

[DeviceA-vlan20] private-vlan primary

[DeviceA-vlan20] quit

# 创建Secondary VLAN 11、12、21、22。

[DeviceA] vlan 11 to 12

[DeviceA] vlan 21 to 22

# 配置Primary VLAN 10和Secondary VLAN 11、12的映射关系。

[DeviceA] vlan 10

[DeviceA-vlan10] private-vlan secondary 11 12

[DeviceA-vlan10] quit

# 配置Primary VLAN 20和Secondary VLAN 21、22的映射关系。

[DeviceA] vlan 20

[DeviceA-vlan20] private-vlan secondary 21 22

[DeviceA-vlan20] quit

# 配置上行端口GigabitEthernet1/0/5在VLAN 10和VLAN 20中工作在trunk promiscuous模式。

[DeviceA] interface gigabitethernet 1/0/5

[DeviceA-GigabitEthernet1/0/5] port private-vlan 10 20 trunk promiscuous

[DeviceA-GigabitEthernet1/0/5] quit

# 将下行端口GigabitEthernet1/0/1加入VLAN 22，并配置其工作在host模式。

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port access vlan 22

[DeviceA-GigabitEthernet1/0/1] port private-vlan host

[DeviceA-GigabitEthernet1/0/1] quit

# 将下行端口GigabitEthernet1/0/3加入VLAN 12，并配置其工作在host模式。

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port access vlan 12

[DeviceA-GigabitEthernet1/0/3] port private-vlan host

[DeviceA-GigabitEthernet1/0/3] quit

# 配置下行端口GigabitEthernet1/0/2在VLAN 11和VLAN 21中工作在trunk secondary模式。

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port private-vlan 11 21 trunk secondary

[DeviceA-GigabitEthernet1/0/2] quit

Device B

# 创建VLAN 11和VLAN 21。

<DeviceB> system-view

[DeviceB] vlan 11

[DeviceB-vlan11] quit

[DeviceB] vlan 21

[DeviceB-vlan21] quit

# 配置端口GigabitEthernet1/0/2为Hybrid端口，并允许VLAN 11和VLAN 21携带Tag通过。

[DeviceB] interface gigabitethernet 1/0/2

[DeviceB-GigabitEthernet1/0/2] port link-type hybrid

[DeviceB-GigabitEthernet1/0/2] port hybrid vlan 11 21 tagged

[DeviceB-GigabitEthernet1/0/2] quit

# 将端口GigabitEthernet1/0/3加入VLAN 11。

[DeviceB] interface gigabitethernet 1/0/3

[DeviceB-GigabitEthernet1/0/3] port access vlan 11

[DeviceB-GigabitEthernet1/0/3] quit

# 将端口GigabitEthernet1/0/4加入VLAN 21。

[DeviceB] interface gigabitethernet 1/0/4

[DeviceB-GigabitEthernet1/0/4] port access vlan 21

[DeviceB-GigabitEthernet1/0/4] quit

Device C

# 创建VLAN 10和VLAN 20。

<DeviceC> system-view

[DeviceC] vlan 10

[DeviceC-vlan10] quit

[DeviceC] vlan 20

[DeviceC-vlan20] quit

# 配置端口GigabitEthernet1/0/5为Hybrid端口，并允许VLAN 10和VLAN 20携带Tag通过。

[DeviceC] interface gigabitethernet 1/0/5

[DeviceC-GigabitEthernet1/0/5] port link-type hybrid

[DeviceC-GigabitEthernet1/0/5] port hybrid vlan 10 20 tagged

[DeviceC-GigabitEthernet1/0/5] quit

显示与验证

# 显示Device A上Primary VLAN 10的配置情况（Primary VLAN 20的显示结果类似，这里不再列出）。

[DeviceA] display private-vlan 10

 Primary VLAN ID: 10

 Secondary VLAN ID: 11-12

 

 VLAN ID: 10

 VLAN type: Static

 Private-vlan type: Primary

 Route interface: Not configured

 Description: VLAN 0010

 Name: VLAN 0010

 Tagged ports:

    GigabitEthernet1/0/2

    GigabitEthernet1/0/5

 Untagged ports:

    GigabitEthernet1/0/3

 

 VLAN ID: 11

 VLAN type: Static

 Private-vlan type: Secondary

 Route interface: Not configured

 Description: VLAN 0011

 Name: VLAN 0011

 Tagged ports:

    GigabitEthernet1/0/2

    GigabitEthernet1/0/5

 Untagged ports: None

 

 VLAN ID: 12

 VLAN type: Static

 Private-vlan type: Secondary

 Route interface: Not configured

 Description: VLAN 0012

 Name: VLAN 0012

 Tagged ports:

    GigabitEthernet1/0/5

 Untagged ports:

    GigabitEthernet1/0/3

可以看到，工作在trunk promiscuous模式的端口GigabitEthernet1/0/5和工作在trunk secondary模式的端口GigabitEthernet1/0/2以Tagged方式允许VLAN报文通过，工作在host模式的端口GigabitEthernet1/0/3以Untagged方式允许VLAN报文通过。

5. Secondary VLAN间三层互通配置举例

组网需求

  • Device A上的VLAN 10为Primary VLAN，包含上行端口GigabitEthernet1/0/1并关联两个Secondary VLAN（VLAN 2和VLAN 3），VLAN 2包含端口GigabitEthernet1/0/2，VLAN 3包含端口GigabitEthernet1/0/3。VLAN接口10的IP地址为192.168.1.1/24。

  • 实现各Secondary VLAN间二层隔离和三层互通。

组网图

image-20230710151832471

DeviceA

# 配置VLAN 10为Primary VLAN。

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] private-vlan primary

[DeviceA-vlan10] quit

# 创建Secondary VLAN 2、3。

[DeviceA] vlan 2 to 3

# 配置Primary VLAN 10和Secondary VLAN 2、3的映射关系。

[DeviceA] vlan 10

[DeviceA-vlan10] private-vlan secondary 2 3

[DeviceA-vlan10] quit

# 配置上行端口GigabitEthernet1/0/1在VLAN 10中工作在promiscuous模式。

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port private-vlan 10 promiscuous

[DeviceA-GigabitEthernet1/0/1] quit

# 将下行端口GigabitEthernet1/0/2加入VLAN 2，并配置其工作在host模式。

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port access vlan 2

[DeviceA-GigabitEthernet1/0/2] port private-vlan host

[DeviceA-GigabitEthernet1/0/2] quit

# 将下行端口GigabitEthernet1/0/3加入VLAN 3，并配置其工作在host模式。

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port access vlan 3

[DeviceA-GigabitEthernet1/0/3] port private-vlan host

[DeviceA-GigabitEthernet1/0/3] quit

# 配置Primary VLAN 10下Secondary VLAN 2、3之间三层互通。

[DeviceA] interface vlan-interface 10

[DeviceA-Vlan-interface10] private-vlan secondary 2 3

# 配置VLAN接口10的IP地址为192.168.1.1/24。

[DeviceA-Vlan-interface10] ip address 192.168.1.1 255.255.255.0

# 开启本地代理ARP功能。

[DeviceA-Vlan-interface10] local-proxy-arp enable

[DeviceA-Vlan-interface10] quit

显示和验证

# 查看Private VLAN 10的相关信息，验证以上配置是否生效。

[DeviceA] display private-vlan 10

 Primary VLAN ID: 10

 Secondary VLAN ID: 2-3

 

 VLAN ID: 10

 VLAN type: Static

 Private VLAN type: Primary

 Route interface: Configured

 IPv4 address: 192.168.1.1

 IPv4 subnet mask: 255.255.255.0

 Description: VLAN 0010

 Name: VLAN 0010

 Tagged ports:   None

 Untagged ports:

    GigabitEthernet1/0/1

    GigabitEthernet1/0/2

    GigabitEthernet1/0/3

 

 VLAN ID: 2

 VLAN type: Static

 Private VLAN type: Secondary

 Route interface: Configured

 IPv4 address: 192.168.1.1

 IPv4 subnet mask: 255.255.255.0

 Description: VLAN 0002

 Name: VLAN 0002

 Tagged ports:   None

 Untagged ports:

    GigabitEthernet1/0/1

    GigabitEthernet1/0/2

 

 VLAN ID: 3

 VLAN type: Static

 Private VLAN type: Secondary

 Route interface: Configured

 IPv4 address: 192.168.1.1

 IPv4 subnet mask: 255.255.255.0

 Description: VLAN 0003

 Name: VLAN 0003

 Tagged ports:   None

 Untagged ports:

    GigabitEthernet1/0/1

    GigabitEthernet1/0/3

可以看到，Secondary VLAN 2和Secondary VLAN 3的Route interface字段都显示为Configured，说明Secondary VLAN 2与Secondary VLAN 3间已配置三层互通。

posted @ 2023-07-10 21:01  LandonXing  阅读(443)  评论(0)    收藏  举报