User's Manual

the associated promiscuous port in its primary VLAN. Hosts on community VLANs can communicate among
themselves and with their associated promiscuous port but not with ports in other community VLANs.
Figure 3: Private VLAN Domain
You must first create the VLAN before you can convert it to a PVLAN, either primary or secondary.Note
Primary and Secondary VLANs in Private VLANs
A private VLAN domain has only one primary VLAN. Each port in a private VLAN domain is a member of
the primary VLAN; the primary VLAN is the entire private VLAN domain.
Secondary VLANs provide isolation between ports within the same private VLAN domain. The following
two types are secondary VLANs within a primary VLAN:
• Isolated VLANs—Ports within an isolated VLAN cannot communicate directly with each other at the
Layer 2 level.
• Community VLANs—Ports within a community VLAN can communicate with each other but cannot
communicate with ports in other community VLANs or in any isolated VLANs at the Layer 2 level.
Private VLAN Ports
The three types of PVLAN ports are as follows:
Cisco Nexus 3000 NX-OS Layer 2 Switching Configuration Guide, Release 5.0(3)U3(1)
38 OL-26590-01
Configuring Private VLANs
Primary and Secondary VLANs in Private VLANs