Example: Configuring PVLANs with Secondary VLAN Trunk Ports and Promiscuous Access Ports

This example shows how to configure secondary VLAN trunk ports and promiscuous access ports as part of a private VLAN configuration. Secondary VLAN trunk ports carry secondary VLAN traffic.

For a given private VLAN, a secondary VLAN trunk port can carry traffic for only one secondary VLAN. However, a secondary VLAN trunk port can carry traffic for multiple secondary VLANs as long as each secondary VLAN is a member of a different private (primary) VLAN. For example, a secondary VLAN trunk port can carry traffic for a community VLAN that is part of primary VLAN pvlan100 and also carry traffic for an isolated VLAN that is part of primary VLAN pvlan400.

To configure a trunk port to carry secondary VLAN traffic, use the isolated and interface statements, as shown in steps 12 and 13 of the example configuration for Switch 1.

Note: When traffic egresses from a secondary VLAN trunk port, it normally carries the tag of the primary VLAN that the secondary port is a member of. If you want traffic that egresses from a secondary VLAN trunk port to retain its secondary VLAN tag, use the extend-secondary-vlan-id statement.

A promiscuous access port carries untagged traffic and can be a member of only one primary VLAN. Traffic that ingresses on a promiscuous access port is forwarded to the ports of the secondary VLANs that are members of the primary VLAN that the promiscuous access port is a member of. This traffic carries the appropriate secondary VLAN tags when it egresses from the secondary VLAN ports if the secondary VLAN port is a trunk port.

To configure an access port to be promiscuous, use the promiscuous statement, as shown in step 12 of the example configuration for Switch 2.

If traffic ingresses on a secondary VLAN port and egresses on a promiscuous access port, the traffic is untagged on egress. If tagged traffic ingresses on a promiscuous access port, the traffic is discarded.

Requirements

This example uses the following hardware and software components:

• Two QFX devices
• Junos OS Release 12.2 or later for the QFX Series

Overview and Topology

Figure 1 shows the topology used in this example. Switch 1 includes several primary and secondary private VLANs and also includes two secondary VLAN trunk ports configured to carry secondary VLANs that are members of primary VLANs pvlan100 and pvlan400.

Switch 2 includes the same private VLANs. The figure shows xe-0/0/0 on Switch 2 as configured with promiscuous access ports or promiscuous trunk ports. The example configuration included here configures this port as a promiscuous access port.

The figure also shows how traffic would flow after ingressing on the secondary VLAN trunk ports on Switch 1.

Figure 1: PVLAN Topology with Secondary VLAN Trunk Ports and Promiscuous Access Port

Table 1 and Table 2 list the settings for the example topology on both switches.

Configuring the PVLANs on Switch 1

CLI Quick Configuration

To quickly create and configure the PVLANs on Switch 1, copy the following commands and paste them into a switch terminal window:

Step-by-Step Procedure

1. Configure the interfaces and port modes:
   [edit interfaces]
user@switch# set xe-0/0/0 unit 0 family ethernet-switching port-mode trunk

   user@switch# set xe-0/0/1 unit 0 family ethernet-switching port-mode trunk

   user@switch# set xe-0/0/1 unit 0 family ethernet-switching vlan members pvlan100

   user@switch# set xe-0/0/1 unit 0 family ethernet-switching vlan members pvlan400

   user@switch# set xe-0/0/2 unit 0 family ethernet-switching port-mode access

   user@switch# set xe-0/0/3 unit 0 family ethernet-switching port-mode access

   user@switch# set xe-0/0/5 unit 0 family ethernet-switching port-mode access

   user@switch# set xe-0/0/6 unit 0 family ethernet-switching port-mode access
2. Create the primary VLANs:
   [edit vlans]
user@switch# set pvlan100 vlan-id 100
user@switch# set pvlan400 vlan-id 400

   Note: Primary VLANs must always be tagged VLANs, even if they exist on only one device.

3. Configure the primary VLANs to be private:
   [edit vlans]
user@switch# set pvlan100 pvlan
user@switch# set pvlan400 pvlan
4. Configure the PVLAN trunk port to carry the private VLAN traffic between the switches:
   [edit vlans]
user@switch# set pvlan100 interface xe-0/0/1.0 pvlan-trunk
user@switch# set pvlan400 interface xe-0/0/1.0 pvlan-trunk
5. Create secondary VLAN comm300 with VLAN ID 300:
   [edit vlans]
user@switch# set comm300 vlan-id 300
6. Configure the primary VLAN for comm300:
   [edit vlans]
user@switch# set comm300 primary-vlan pvlan100
7. Configure the interface for comm300:
   [edit vlans]
user@switch# set comm300 interface xe-0/0/3.0
8. Create secondary VLAN comm600 with VLAN ID 600:
   [edit vlans]
user@switch# set comm600 vlan-id 600
9. Configure the primary VLAN for comm600:
   [edit vlans]
user@switch# set comm600 primary-vlan pvlan400
10. Configure the interface for comm600:
    [edit vlans]
user@switch# set comm600 interface xe-0/0/6.0
11. Configure the interswitch isolated VLANs:
    [edit vlans]
user@switch# set pvlan100 pvlan isolation-vlan-id 200
user@switch# set pvlan400 pvlan isolation-vlan-id 500

    Note: When you configure a secondary VLAN trunk port to carry an isolated VLAN, you must also configure an isolation-vlan-id. This is true even if the isolated VLAN exists only on one switch.

12. Enable trunk port xe-0/0/0 to carry secondary VLANs for the primary VLANs:
    [edit vlans]
user@switch# set pvlan100 interface xe-0/0/0.0 isolated
user@switch# set pvlan400 interface xe-0/0/0.0 isolated
13. Configure trunk port xe-0/0/0 to carry comm600 (member of pvlan400):
    [edit vlans]
user@switch# set comm600 interface xe-0/0/0.0

    Note: You do not need to explicitly configure xe-0/0/0 to carry the isolated VLAN traffic (tags 200 and 500) because all the isolated ports in pvlan100 and pvlan400–including xe-0/0/0.0–are automatically included in the isolated VLANs created when you configured isolation-vlan-id 200 and isolation-vlan-id 500.

14. Configure xe-0/0/2 and xe-0/0/6 to be isolated:
    [edit vlans]
user@switch# set pvlan100 interface xe-0/0/2.0 isolated
user@switch# set pvlan400 interface xe-0/0/5.0 isolated

Results

Check the results of the configuration on Switch 1:

Configuring the PVLANs on Switch 2

The configuration for Switch 2 is almost identical to the configuration for Switch 1. The most significant difference is that xe-0/0/0 on Switch 2 is configured as a promiscuous trunk port or a promiscuous access port, as Figure 1 shows. In the following configuration, xe-0/0/0 is configured as a promiscuous access port for primary VLAN pvlan100.

If traffic ingresses on VLAN-enabled port and egresses on a promiscuous access port, the VLAN tags are dropped on egress and the traffic is untagged at that point. For example, traffic for comm600 ingresses on the secondary VLAN trunk port configured on xe-0/0/0.0 on Switch 1 and carries tag 600 as it is forwarded through the secondary VLAN. When it egresses from xe-0/0/0.0 on Switch 2, it will be untagged if you configure xe-0/0/0.0 as a promiscuous access port as shown in this example. If you instead configure xe-0/0/0.0 as a promiscuous trunk port (port-mode trunk), the traffic for comm600 carries its primary VLAN tag (400) when it egresses.

CLI Quick Configuration

To quickly create and configure the PVLANs on Switch 2, copy the following commands and paste them into a switch terminal window:

Step-by-Step Procedure

1. Configure the interfaces and port modes:
   [edit interfaces]
user@switch# set xe-0/0/0 unit 0 family ethernet-switching port-mode access

   user@switch# set xe-0/0/1 unit 0 family ethernet-switching port-mode trunk

   user@switch# set xe-0/0/1 unit 0 family ethernet-switching vlan members pvlan100

   user@switch# set xe-0/0/1 unit 0 family ethernet-switching vlan members pvlan400


   user@switch# set xe-0/0/2 unit 0 family ethernet-switching port-mode trunk

   user@switch# set xe-0/0/3 unit 0 family ethernet-switching port-mode access

   user@switch# set xe-0/0/5 unit 0 family ethernet-switching port-mode access

   user@switch# set xe-0/0/6 unit 0 family ethernet-switching port-mode access
2. Create the primary VLANs:
   [edit vlans]
user@switch# set pvlan100 vlan-id 100
user@switch# set pvlan400 vlan-id 400
3. Configure the primary VLANs to be private:
   [edit vlans]
user@switch# set pvlan100 pvlan
user@switch# set pvlan400 pvlan
4. Configure the PVLAN trunk port to carry the private VLAN traffic between the switches:
   [edit vlans]
user@switch# set pvlan100 interface xe-0/0/1.0 pvlan-trunk
user@switch# set pvlan400 interface xe-0/0/1.0 pvlan-trunk
5. Create secondary VLAN comm300 with VLAN ID 300:
   [edit vlans]
user@switch# set comm300 vlan-id 300
6. Configure the primary VLAN for comm300:
   [edit vlans]
user@switch# set comm300 primary-vlan pvlan100
7. Configure the interface for comm300:
   [edit vlans]
user@switch# set comm300 interface xe-0/0/3.0
8. Create secondary VLAN comm600 with VLAN ID 600:
   [edit vlans]
user@switch# set comm600 vlan-id 600
9. Configure the primary VLAN for comm600:
   [edit vlans]
user@switch# set comm600 primary-vlan pvlan400
10. Configure the interface for comm600:
    [edit vlans]
user@switch# set comm600 interface xe-0/0/6.0

11. Configure the interswitch isolated VLANs:

    [edit vlans]
user@switch# set pvlan100 pvlan isolation-vlan-id 200
user@switch# set pvlan400 pvlan isolation-vlan-id 500
12. Configure access port xe-0/0/0 to be promiscuous for pvlan100:
    [edit vlans]
user@switch# set pvlan100 interface xe-0/0/0.0 promiscuous

    Note: A promiscuous access port can be a member of only one primary VLAN.

13. Configure xe-0/0/2 and xe-0/0/6 to be isolated:
    [edit vlans]
user@switch# set pvlan100 interface xe-0/0/2.0 isolated
user@switch# set pvlan400 interface xe-0/0/5.0 isolated

Results

Check the results of the configuration on Switch 2:

Verification

To confirm that the configuration is working properly, perform these tasks:

• Verifying That the Private VLAN and Secondary VLANs Were Created
• Verifying The Ethernet Switching Table Entries

Verifying That the Private VLAN and Secondary VLANs Were Created

Purpose

Verify that the primary VLAN and secondary VLANs were properly created on Switch 1.

Action

Use the show vlans command:

Name               Role        Tag      Interfaces
pvlan100           Primary     100  	   xe-0/0/0.0, xe-0/0/1.0, xe-0/0/2.0, xe-0/0/3.0
__iso_pvlan100__   Isolated    200      xe-0/0/2.0
comm300            Community   300      xe-0/0/3.0

pvlan400           Primary     400      xe-0/0/0.0, xe-0/0/1.0, xe-0/0/5.0, xe-0/0/6.0
__iso_pvlan400__   Isolated    500      xe-0/0/5.0
comm600            Community   600     xe-0/0/6.0

Meaning

The output shows that the private VLANs were created and identifies the interfaces and secondary VLANs associated with them.

Verifying The Ethernet Switching Table Entries

Purpose

Verify that the Ethernet switching table entries were created for primary VLAN pvlan100.

Action

Show the Ethernet switching table entries for pvlan100.

Ethernet-switching table: 0 unicast entries
  pvlan100             *                 Flood          - All-members
  pvlan100             00:10:94:00:00:02 Learn            xe-0/0/2.0
  __iso_pvlan100__     *                 Flood          - All-members
  __iso_pvlan100__     00:10:94:00:00:02 Replicated      - xe-0/0/2.0