Private VLANs

PVLANs offer further subdivision within an existing VLAN, allowing individual ports to be separated from others while still sharing the same IP subnet. This allows separation between devices to occur without requiring a separate IP subnet for each device (and the associated IP addresses that would waste). In it simplest form, PVLANs support isolated ports and promiscuous ports. Isolated ports can talk only to promiscuous ports, while promiscuous ports can talk to any port. In this deployment, the members of a subnet are isolated ports, and the gateway device is connected to a promiscuous port. This enables the hosts on a subnet to offer services to other subnets and to initiate requests of other subnets but not to service the requests of members of the same subnet.

A further PVLAN option available on some switches is community ports. In this model several isolated p< can be considered part of a community, enabling them to communicate with each other and the promiscuous port but not with other communities or isolated ports. Figure 6-10 summarizes these optio

Figure 6-10. PVLANs

Primary VLAN Cflrernunity VLAN Ctiainriuflily VLAN Isolated VLAN

PromscUQUS Port

Promiscuous Port

PromscUQUS Port

Promiscuous Port

	w	Mv			s	V	V	V	1

CortVmimily Commun ¡ly A B'

isolated Parts

CortVmimily Commun ¡ly A B'

isolated Parts

The most common security-related deployment of PVLANs is in a public services segment or demilitarize zone (DMZ) connected to a firewall. In this deployment, PVLANs prevent the compromise of one system from leading to the compromise of other systems connected to the same subnet. Without PVLANs, an attacker could go after other vulnerable systems on any port or protocol because the attacker is already past the firewall. For example, a server segment off of your main corporate firewall might have FTP, SM and WWW servers. There probably isn't much need for these devices to communicate with one another, PVLANs can be used.

Configuring PVLANs varies from platform to platform. The simplest configuration method (available on entry-level Cisco IOS switches) uses the command port protected entered at the interface configuratio level as a way to denote isolated ports. Ports without the port protected command are promiscuous.

On higher-end switches, the configuration is more complex. The following Cisco CatOS example sets poi 3/248 as isolated ports and port 3/1 as the promiscuous port. Note the need to create two VLANs and n them together, creating the single functional PVLAN.

CatOS (enable) set vlan 31 pvlan primary

VTP advertisements transmitting temporarily stopped, and will resume after the command finishes. Vlan 31 configuration successful CatOS (enable) show pvlan

Primary Secondary Secondary-Type Ports

CatOS (enable) set vlan 32 pvlan isolated

VTP advertisements transmitting temporarily stopped, and will resume after the command finishes. Vlan 32 configuration successful CatOS (enable) set pvlan 31 32 3/2-48

Successfully set the following ports to Private Vlan 31,32:3/2-48 CatOS (enable) set pvlan mapping 31 32 3/1

Successfully set mapping between 31 and 32 on 3/1

There are many more options for PVLAN configuration. For more details see the following URL: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/sw 7 1/conf gd/vlans.htm#xtocid8545

PVLANs have different functionalities depending on the switch. On some switches, PVLANs are referred to as PVLAN edge. Check the documentation for your switch to understand the specific PVLAN capabilities.

Continue reading here: General Best Practices and Route Summarization

Was this article helpful?

0 0