Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Example: Configuring an IRB Interface in a Private VLAN on a Single MX Series Router

For security reasons, it is often useful to restrict the flow of broadcast and unknown unicast traffic and to even limit the communication between known hosts. The private VLAN (PVLAN) feature on MX Series routers allows an administrator to split a broadcast domain into multiple isolated broadcast subdomains, essentially putting a VLAN inside a VLAN.

This example describes how to create an integrated routing and bridging (IRB) interface in a PVLAN bridge domain associated with a virtual switch instance on a single MX Series router:


Configuring a voice over IP (VoIP) VLAN on PVLAN interfaces is not supported.


This example uses the following hardware and software components:

  • One MX Series router in enhanced LAN mode.

  • Junos OS Release 15.1 or later for MX Series routers

Before you begin configuring a PVLAN, make sure you have:

Overview and Topology

In a large office with multiple buildings and VLANs, you might need to isolate some workgroups or other endpoints for security reasons or to partition the broadcast domain. This configuration example shows a simple topology to illustrate how to create a PVLAN with one primary VLAN and four community VLANs, as well as two isolated ports.

Assume a sample deployment in which a primary VLAN named VP contains ports, p1, p2, t1, t2, i1, i2, cx1, and cx2. The port types of these configured ports are as follows:

  • Promiscuous ports = p1, p2

  • ISL ports = t1, t2

  • Isolated ports = i1, i2

  • Community VLAN = Cx

  • Community ports = cx1, cx2

An IRB interface, irb.0, is configured and mapped to the bridge domain in the virtual switch instance.

Bridge domains are provisioned for each of the VLANs, namely, Vp, Vi, and Vcx. Assume the bridge domains to be configured as follows:

Vp—BD_primary_Vp (ports contained are p1, t1, i1, i2, cx1, cx2)

Vi—BD_isolate_Vi (ports contained are p1, t1, *i1, *i2)

Vcx—BD_community_Vcx (ports contained are p1, t1, cx1, cx2)

The bridge domains for community, primary, and isolated VLANs are automatically created by the system internally when you configure a bridge domain with a trunk interface, access interface, or interswitch link. The bridge domains contain the same VLAN ID corresponding to the VLANs. To use bridge domains for PVLANs, you must configure the following additional attributes:


To configure an IRB interface in a PVLAN, perform these tasks:

CLI Quick Configuration

To quickly create and configure a PVLAN and include an IRB interface in a PVLAN bridge domain associated with a virtual switch instance, copy the following commands and paste them into the router terminal window:

Configuring an IRB Interface

Configuring Promiscuous, ISL, Isolated, and Community Ports

Configuring a Virtual Switch Instance With Bridge Domain Interfaces

Specify the IRB Interface and Primary, Isolated, and Community VLAN IDs in the Bridge Domain


Step-by-Step Procedure

To configure the interswitch link (ISL) for a PVLAN, the PVLAN port types, and secondary VLANs for the PVLAN:

  1. Create an IRB interface.

  2. Create a promiscuous port for the PVLAN.

  3. Create the interswitch link (ISL) trunk port for the PVLAN.

  4. Create the isolated ports for the PVLAN.

  5. Create the community ports for the PVLAN.

  6. Create a virtual switch instance with a bridge domain and associate the logical interfaces.

  7. Specify the IRB interface, primary, isolated, and community VLAN IDs, and associate the VLANs with the bridge domain.


Check the results of the configuration:


To confirm that the configuration is working properly, perform these tasks:

Verifying That the Private VLAN and Secondary VLANs Were Created


Verify that the primary VLAN and secondary VLANs were properly created on the switch.


Use the show bridge domain command:


The output shows that the primary VLAN was created and identifies the interfaces and secondary VLANs associated with it.