User's Manual
Table Of Contents
- Cisco Nexus 3000 NX-OS Layer 2 Switching Configuration Guide, Release 5.0(3)U3(1)
- Contents
- Preface
- New and Changed Information for this Release
- Overview
- Configuring Ethernet Interfaces
- Information About Ethernet Interfaces
- Configuring Ethernet Interfaces
- Configuring the UDLD Mode
- Changing an Interface Port Mode
- Configuring Interface Speed
- Disabling Link Negotiation
- Configuring the CDP Characteristics
- Enabling or Disabling CDP
- Enabling the Error-Disabled Detection
- Enabling the Error-Disabled Recovery
- Configuring the Error-Disabled Recovery Interval
- Configuring the Debounce Timer
- Configuring the Description Parameter
- Disabling and Restarting Ethernet Interfaces
- Displaying Interface Information
- Displaying Input Packet Discard Information
- Default Physical Ethernet Settings
- Configuring VLANs
- Configuring Private VLANs
- Information About Private VLANs
- Guidelines and Limitations for Private VLANs
- Configuring a Private VLAN
- Enabling Private VLANs
- Configuring a VLAN as a Private VLAN
- Associating Secondary VLANs with a Primary Private VLAN
- Configuring an Interface as a Private VLAN Host Port
- Configuring an Interface as a Private VLAN Promiscuous Port
- Configuring a Promiscuous Trunk Port
- Configuring an Isolated Trunk Port
- Configuring the Allowed VLANs for PVLAN Trunking Ports
- Configuring Native 802.1Q VLANs on Private VLANs
- Verifying the Private VLAN Configuration
- Configuring Access and Trunk Interfaces
- Configuring Switching Modes
- Configuring Rapid PVST+
- Information About Rapid PVST+
- Understanding STP
- Understanding Rapid PVST+
- Rapid PVST+ and IEEE 802.1Q Trunks
- Rapid PVST+ Interoperation with Legacy 802.1D STP
- Rapid PVST+ Interoperation with 802.1s MST
- Configuring Rapid PVST+
- Enabling Rapid PVST+
- Enabling Rapid PVST+ per VLAN
- Configuring the Root Bridge ID
- Configuring a Secondary Root Bridge
- Configuring the Rapid PVST+ Port Priority
- Configuring the Rapid PVST+ Pathcost Method and Port Cost
- Configuring the Rapid PVST+ Bridge Priority of a VLAN
- Configuring the Rapid PVST+ Hello Time for a VLAN
- Configuring the Rapid PVST+ Forward Delay Time for a VLAN
- Configuring the Rapid PVST+ Maximum Age Time for a VLAN
- Specifying the Link Type
- Restarting the Protocol
- Verifying Rapid PVST+ Configurations
- Information About Rapid PVST+
- Configuring Multiple Spanning Tree
- Information About MST
- Configuring MST
- MST Configuration Guidelines
- Enabling MST
- Entering MST Configuration Mode
- Specifying the MST Name
- Specifying the MST Configuration Revision Number
- Specifying the Configuration on an MST Region
- Mapping and Unmapping VLANs to MST Instances
- Mapping Secondary VLANs to Same MSTI as Primary VLANs for Private VLANs
- Configuring the Root Bridge
- Configuring a Secondary Root Bridge
- Configuring the Port Priority
- Configuring the Port Cost
- Configuring the Switch Priority
- Configuring the Hello Time
- Configuring the Forwarding-Delay Time
- Configuring the Maximum-Aging Time
- Configuring the Maximum-Hop Count
- Configuring PVST Simulation Globally
- Configuring PVST Simulation Per Port
- Specifying the Link Type
- Restarting the Protocol
- Verifying MST Configurations
- Configuring STP Extensions
- About STP Extensions
- Information About STP Extensions
- Configuring STP Extensions
- STP Extensions Configuration Guidelines
- Configuring Spanning Tree Port Types Globally
- Configuring Spanning Tree Edge Ports on Specified Interfaces
- Configuring Spanning Tree Network Ports on Specified Interfaces
- Enabling BPDU Guard Globally
- Enabling BPDU Guard on Specified Interfaces
- Enabling BPDU Filtering Globally
- Enabling BPDU Filtering on Specified Interfaces
- Enabling Loop Guard Globally
- Enabling Loop Guard or Root Guard on Specified Interfaces
- Verifying STP Extension Configuration
- About STP Extensions
- Configuring LLDP
- Configuring the MAC Address Table
- Configuring IGMP Snooping
- Configuring Traffic Storm Control
- INDEX
For an association to be operational, the following conditions must be met:
•
The primary VLAN must exist and be configured as a primary VLAN.
•
The secondary VLAN must exist and be configured as either an isolated or community VLAN.
Use the show vlan private-vlan command to verify that the association is operational. The switch does
not display an error message when the association is nonoperational.
Note
If you delete either the primary or secondary VLAN, the ports that are associated with the VLAN become
inactive. Use the no private-vlan command to return the VLAN to the normal mode. All primary and secondary
associations on that VLAN are suspended, but the interfaces remain in PVLAN mode. When you convert the
VLAN back to PVLAN mode, the original associations are reinstated.
If you enter the no vlan command for the primary VLAN, all PVLAN associations with that VLAN are
deleted. However, if you enter the no vlan command for a secondary VLAN, the PVLAN associations with
that VLAN are suspended and are restored when you recreate the specified VLAN and configure it as the
previous secondary VLAN.
In order to change the association between a secondary and primary VLAN, you must first remove the current
association and then add the desired association.
Private VLAN Promiscuous Trunks
The Cisco Nexus 3000 Series device does not support Private VLAN trunk ports.
Private VLAN Isolated Trunks
The Cisco Nexus 3000 Series device does not support Private VLAN trunk ports.
Broadcast Traffic in Private VLANs
Broadcast traffic from ports in a private VLAN flows in the following ways:
•
The broadcast traffic flows from a promiscuous port to all ports in the primary VLAN (which includes
all the ports in the community and isolated VLANs). This broadcast traffic is distributed to all ports
within the primary VLAN, including those ports that are not configured with private VLAN parameters.
•
The broadcast traffic from an isolated port is distributed only to those promiscuous ports in the primary
VLAN that are associated to that isolated port.
• The broadcast traffic from community ports is distributed to all ports within the port’s community and
to all promiscuous ports that are associated to the community port. The broadcast packets are not
distributed to any other communities within the primary VLAN or to any isolated ports.
Private VLAN Port Isolation
You can use PVLANs to control access to end stations as follows:
Cisco Nexus 3000 NX-OS Layer 2 Switching Configuration Guide, Release 5.0(3)U3(1)
OL-26590-01 41
Configuring Private VLANs
Private VLAN Promiscuous Trunks