16-7
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02
Chapter 16 Configuring Private VLANs
Configuring Private VLANs
Step 5 If inter-VLAN routing will be used, configure the primary SVI, and map secondary VLANs to the
primary. See the “Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface” section on
page 16-14.
Step 6 Verify private-VLAN configuration.
Default Private-VLAN Configuration
No private VLANs are configured.
Private-VLAN Configuration Guidelines
Guidelines for configuring private VLANs fall into these categories:
• Secondary and Primary VLAN Configuration, page 16-7
• Private-VLAN Port Configuration, page 16-8
• Limitations with Other Features, page 16-9
Secondary and Primary VLAN Configuration
Follow these guidelines when configuring private VLANs:
• Set VTP to transparent mode. After you configure a private VLAN, you should not change the VTP
mode to client or server. For information about VTP, see Chapter 14, “Configuring VTP.”
• You must use VLAN configuration (config-vlan) mode to configure private VLANs. You cannot
configure private VLANs in VLAN database configuration mode. For more information about
VLAN configuration, see “VLAN Configuration Mode Options” section on page 13-7.
• After you have configured private VLANs, use the copy running-config startup config privileged
EXEC command to save the VTP transparent mode configuration and private-VLAN configuration
in the switch startup configuration file. Otherwise, if the switch resets, it defaults to VTP server
mode, which does not support private VLANs.
• VTP does not propagate private-VLAN configuration. You must configure private VLANs on each
device where you want private-VLAN ports.
• You cannot configure VLAN 1 or VLANs 1002 to 1005 as primary or secondary VLANs. Extended
VLANs (VLAN IDs 1006 to 4094) can belong to private VLANs
• A primary VLAN can have one isolated VLAN and multiple community VLANs associated with it.
An isolated or community VLAN can have only one primary VLAN associated with it.
• Although a private VLAN contains more than one VLAN, only one Spanning Tree Protocol (STP)
instance runs for the entire private VLAN. When a secondary VLAN is associated with the primary
VLAN, the STP parameters of the primary VLAN are propagated to the secondary VLAN.
• You can enable DHCP snooping on private VLANs. When you enable DHCP snooping on the
primary VLAN, it is propagated to the secondary VLANs. If you configure DHCP on a secondary
VLAN, the configuration does not take effect if the primary VLAN is already configured.
• When you enable IP source guard on private-VLAN ports, you must enable DHCP snooping on the
primary VLAN.
