Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Configure Private VLAN (EX and QFX Series Switches)

Use these instructions to create a private VLAN on your switches via Mist.

Note: Private VLANs are applicable only to EX and QFX Series switches. Campus fabric deployments do not support private VLANs.

Private VLANs isolate client traffic within the same VLAN without requiring additional Layer 3 subnets or IP address space allocation. Devices remain on the same network and can access shared services such as the gateway, DHCP server, and firewall, while communication between devices is blocked.

To create a private VLAN:

  1. Click Organization > Wired > Switch Templates. Use this step to create an organization-level private VLAN network.
    To create a switch-level private VLAN network, click Switches.
  2. Open the switch template or the individual switch.
  3. Locate the NETWORKS tile.
  4. Open an existing network in which you want to create a private VLAN.
    If you want to create a private VLAN within a new network, click Add Network on the NETWORKS tile.
  5. In the network configuration, select the Enable Isolation check box, and then specify an VLAN ID in the Isolated Network VLAN ID field.
    Configuration interface for network setup with fields: Name set to test-pvlan100, VLAN ID set to 100, Isolation enabled, Isolated Network VLAN ID set to 10, empty IPv4 and IPv6 subnet fields.
  6. After completing the configuration, select the tick mark on the top right corner of the NETWORKS tile.
  7. Click Save on the top right of the page.
  8. Confirm changes and save the configuration.

When configuring a port profile on a switch, you can use the Allow communication to isolated network option to allow clients on that port to communicate with isolated networks (private VLANs). For profiles configured in Trunk mode, you can also use the Inter Switch Isolation Link option to extend the isolation to upstream switch or interconnected switch. This option must be configured on both ends of the switch-to-switch link.

Port Profile configuration interface with fields for name, description, port mode, VLAN, VoIP network, isolated network communication, trunk networks, and inter-switch isolation settings.