Private VLAN Concepts

Private VLANs: Concept Notes

This post is part of a series of revision notes I put together and used for studying CCNP Switch concepts. I am now writing them up on this website so that they might be useful to others.

They formed a part of my notes intended to explain concepts in simple terms. I hope they come in use, but as a reminder, please do not use these notes as any indication of what is sufficient for CCNP level understanding.

Let’s get started.

Existing Problem

  • By the nature of their purpose, Service Providers have many different Clients. Sometimes hundreds, sometimes thousands and quite often even more
  • For Service Providers, isolating their Customers into separate VLANs each is just not feasible, nor is it scalable
  • The Switch’s maximum configurable VLAN limit would be hit (4094) and would effectively limit the number of customers an ISP could have
  • Each VLAN would also require a separate IP

As we can see, these are all limitations that would interfere with the functioning of networks.

Let’s take a look at the solution.

Solution: Private VLANs

  • Essentially a VLAN within a VLAN
  • Splits VLANs into Primary and Secondary VLANs
  • We are now able to isolate ports from other ports within the same VLAN

How it Works

Primary & Secondary VLANs

We mentioned that a VLAN is split into 2, the Primary and Secondary VLAN.

There is only 1 type of Primary VLAN and it is known as the…Primary VLAN.

As for the Secondary VLAN, we have 2 types:

  • Community
  • Isolated

So what’s the difference?

For that we have to take a look at what kind of ports go into these secondary VLANs. Let’s do this now.

Ports within Primary VLANs

There is only one type of port inside the Primary VLAN, it is called the Promiscuous Port.

  • This port can communicate will all other ports in any of the secondary VLANs
  • It is essentially the main ‘way out’ for all other ports

Ports within Secondary VLANs

For Secondary VLANs, there are 2 types of ports involved.

  • Community Port
  • Isolated Port

Community Port

  • Hosts on community VLANs can communicate among themselves
  • They can also communicate with the associated promiscuous port
  • They cannot communicate with other Community Ports in other Community VLANs

Isolated Port

  • A host on an isolated VLAN can only communicate with the associated promiscuous port in its primary VLAN
  • It cannot even communicate with other Isolated Ports in the same Isolated VLAN


If using VTP, make note of the following:

  • VTP Version 3 supports Private VLANs
  • However VTP must be turned off (in transparent mode) in order to configure Private VLANs

We can turn VTP to Transparent Mode by inputting the following command:

VLAN Configuration:

Configure the Primary VLAN:

Next, we make the Secondary VLAN(s), remember these can be either Community or Isolated VLANs:

Now associated our Secondary VLAN(s) to the Primary VLAN we made at the beginning:

Port Configuration:

To configure the port which acts as the Promiscuous Port:

Next we configure the ports we want as Community Hosts:

Finally we configure the ports we want as Isolated Hosts:


To see the Private VLANs configured on a Switch, use the following show command:

Revision Flashcard

Last but not least, I have put together a digital flashcard based on my notes.

Please be aware that neither this post nor this flashcard is to be taken as all the information you need to know for Private VLANs, it just contains the basics and is intended to be used as a supplement to your own notes and studies.

I hope it helps.

Private VLAN Flashcard

Leave a Comment