Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Private VLAN Solutions for Segregating Customer Traffic


Using private VLANs (PVLANs) can help you in many situations in which you need to segregate traffic from different customers or to segregate different types of traffic. For example, if your company provides web hosting services to its customers, you probably host collocated servers owned by your customers and connect those servers to the Internet through aggregation-layer switches. In this case, you need a mechanism to ensure that no customer has access to any traffic or assets assigned to another customer. Given that you might have a large number of customers and many virtual switches, it can be impractical to use standard VLANs to solve this problem. Your equipment might not support the number of VLANs required, and you might not have enough IP addresses to assign to all your customers. Either of these constraints can limit the number of customers that you can support and therefore limit the growth of your business.

Implementing PVLANs allows you to increase the number of VLANs that you can assign to customers without sacrificing any security or privacy. Because you can support more VLANs, you can also support more subnets (which you assign to VLANs), and this can allow you to use your IP addresses more efficiently—which saves your company money by getting more use out of a valuable asset.

When you configure PVLANs, you create primary VLANs and then create secondary VLANs inside the primary VLANs. The secondary VLANs are isolated from each other and can use their own subnets. Juniper Networks has extended the functionality of PVLANs by introducing the following features:

  • Secondary VLAN trunk ports

  • Promiscuous access ports

Secondary VLAN trunk ports are particularly useful when you want ports to carry multiple secondary VLANs—that is, you want trunk ports to carry secondary VLANs instead of standard VLANs. Configuring these ports can help you save money and reduce complexity because it reduces your need for physical ports and connections. Indeed, you might want to connect a secondary VLAN trunk port to multiple virtual switches that support many secondary VLANs.

Promiscuous access ports can save you money and reduce complexity by allowing you connect systems that do not support VLAN trunking but do need to participate in a primary private VLAN. For example, some network file systems are deployed in this way. Without the functionality of promiscuous access ports, you would be forced to find alternative methods of providing these services.