Lab 9.3: Private VLAN (PVLAN) Port Isolation

Lab Overview & Requirement

This lab focuses on Private VLAN (PVLAN) design and configuration for Layer 2 network segmentation and port isolation. Students will implement PVLAN port types, communication rules, router gateway access, and verification testing using primary, community, and isolated VLANs.

Requirement: Ready-to-use CCNP Lab 9.3 document for Private VLAN configuration, router IP setup, verification, and troubleshooting.

Skills Covered
VTP transparent mode
Primary VLAN
Community VLAN
Isolated VLAN
Promiscuous and host ports

Estimated Time
60–75 minutes

Difficulty
Intermediate to Advanced

Important Note
PVLANs require VTP transparent mode before creation.

Network Topology

Use the provided topology image for this lab.

Interface Roles for This Lab:
R1 G0/1 ↔ DS uplink
DS G1/1 ↔ SW1 = Community VLAN 100
DS G1/2 ↔ SW2 = Community VLAN 200
DS G2/1 ↔ SW3 = Isolated VLAN 300
DS G2/2 ↔ SW4 = Isolated VLAN 300

Lab Objectives

Configure VTP transparent mode as a PVLAN prerequisite
Create a primary PVLAN and associated secondary VLANs
Configure community and isolated VLAN types
Assign promiscuous and host port roles
Configure router gateway IP addressing on the uplink interface
Verify PVLAN associations, port mappings, and host access
Test communication rules between community, isolated, and promiscuous ports
Troubleshoot common PVLAN deployment issues

Step-by-Step Configuration

Part 1: Configure VTP Transparent Mode

conf t
vtp mode transparent
vtp domain pvlan-domain
end

show vtp status

Part 2: Create the Primary and Secondary VLANs

conf t
vlan 999
 name Primary-VLAN
 private-vlan primary
exit

vlan 100
 name Community-VLAN-100
 private-vlan community
exit

vlan 200
 name Community-VLAN-200
 private-vlan community
exit

vlan 300
 name Isolated-VLAN-300
 private-vlan isolated
exit

vlan 999
 private-vlan association 100,200,300
end

Note: In this lab topology, the distribution switch connects to multiple access switches. Make sure the PVLAN secondary VLAN associations match the interface roles shown in the topology image.

Part 3: Configure Promiscuous Port on DS toward R1

conf t
interface gigabitEthernet0/1
 description Uplink to R1
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 999 100,200,300
 no shutdown
end

Part 4: Configure Host Ports on DS to Access Switches

conf t
interface gigabitEthernet1/1
 description To SW1 - Community 100
 switchport mode private-vlan host
 switchport private-vlan host-association 999 100
 no shutdown
exit

interface gigabitEthernet1/2
 description To SW2 - Community 200
 switchport mode private-vlan host
 switchport private-vlan host-association 999 200
 no shutdown
exit

interface gigabitEthernet2/1
 description To SW3 - Isolated 300
 switchport mode private-vlan host
 switchport private-vlan host-association 999 300
 no shutdown
exit

interface gigabitEthernet2/2
 description To SW4 - Isolated 300
 switchport mode private-vlan host
 switchport private-vlan host-association 999 300
 no shutdown
end

Part 5: Configure Router IP Address

conf t
interface gigabitEthernet0/1
 description Link to DS
 ip address 192.168.10.1 255.255.255.0
 no shutdown
end

show ip interface brief

Suggested Host Addressing Plan:
R1 / Gateway: 192.168.10.1/24
SW1 Community VLAN 100 Host: 192.168.10.11/24
SW2 Community VLAN 200 Host: 192.168.10.12/24
SW3 Isolated VLAN 300 Host: 192.168.10.13/24
SW4 Isolated VLAN 300 Host: 192.168.10.14/24
Default Gateway for all hosts: 192.168.10.1

Part 6: Configure Host IP Addresses

PC1 (Community VLAN 100): 192.168.10.11 /24
PC2 (Community VLAN 200): 192.168.10.12 /24
PC3 (Isolated VLAN 300): 192.168.10.13 /24
PC4 (Isolated VLAN 300): 192.168.10.14 /24
Default Gateway: 192.168.10.1

Part 7: Testing and Verification Mode

! Verify router interface
show ip interface brief

! Verify PVLAN settings
show vlan private-vlan
show vlan private-vlan type
show vlan private-vlan association
show interface switchport private-vlan
show vlan id 999 private-vlan

! Test connectivity
ping 192.168.10.1
ping 192.168.10.11
ping 192.168.10.12
ping 192.168.10.13
ping 192.168.10.14

Expected Testing Results:
Hosts can ping the router/gateway through the promiscuous port.
Hosts in the same community VLAN can communicate with each other.
Hosts in different communities should be blocked.
Isolated host communication to other hosts should be blocked.
Router should be able to reach all hosts if PVLAN mapping is correct.

Verification Checklist

Check	Command	Expected Result
VTP mode	`show vtp status`	Operating mode is Transparent
VLAN types	`show vlan private-vlan type`	Primary, community, and isolated VLANs displayed correctly
PVLAN associations	`show vlan private-vlan association`	Secondary VLANs associated with primary 999
Port roles	`show interface switchport private-vlan`	Promiscuous and host port roles verified
Primary VLAN details	`show vlan id 999 private-vlan`	Primary VLAN 999 shows associated secondary VLANs
Router interface	`show ip interface brief`	G0/1 is up/up with 192.168.10.1 assigned
MAC learning	`show mac address-table vlan 999`	Addresses learned on correct ports

Troubleshooting Guide

Problem: PVLAN command is rejected
Cause: VTP is not in transparent mode
Fix: Set vtp mode transparent before creating PVLANs

Problem: Hosts in same community cannot communicate
Cause: Wrong host association or VLAN mapping
Fix: Verify the secondary VLAN and host-association command

Problem: Isolated hosts can communicate
Cause: Port may be in community VLAN instead of isolated VLAN
Fix: Recheck VLAN type and host-association settings

Problem: Router cannot reach hosts
Cause: Promiscuous port mapping is incomplete or router IP is missing
Fix: Ensure the primary and all secondary VLANs are mapped on G0/1 and verify ip address 192.168.10.1 255.255.255.0

Problem: Access switch communication does not match the diagram
Cause: PVLAN roles assigned incorrectly on DS interfaces
Fix: Reconfirm R1↔DS and DS↔SW1/SW2/SW3/SW4 port roles and secondary VLAN assignments

Best Practice: Use PVLANs when you need host isolation within the same subnet, such as guest networks, shared services, and multi-tenant designs.

Short Student Summary

This lab teaches how to build Private VLANs using a primary VLAN, community VLANs, and isolated VLANs. Students also learn how to configure the router gateway IP address, verify PVLAN behavior, and test host isolation while still allowing gateway access.

🔐 Access Denied