pvlans, lab in progress...

configuration ongoing... i will add to this as i can... take note of the syntax...
sw3750_02#config t

Enter configuration commands, one per line. End with CNTL/Z.
sw3750_02(config)#vlan 1000
sw3750_02(config-vlan)# private-vlan primary
sw3750_02(config-vlan)# private-vlan association 1012,1034,1055
sw3750_02(config-vlan)#!
sw3750_02(config-vlan)#vlan 1012
sw3750_02(config-vlan)# private-vlan community
sw3750_02(config-vlan)#!
sw3750_02(config-vlan)#vlan 1034
sw3750_02(config-vlan)# private-vlan community
sw3750_02(config-vlan)#!
sw3750_02(config-vlan)#vlan 1055
sw3750_02(config-vlan)# private-vlan isolated
sw3750_02(config-vlan)#interface GigabitEthernet1/0/1

description ---r1
switchport access vlan 10
switchport private-vlan host-association 1000 1012
switchport mode private-vlan host
spanning-tree portfast

interface GigabitEthernet1/0/3

description ---r3
switchport access vlan 10
switchport private-vlan host-association 1000 1034
switchport mode private-vlan host
spanning-tree portfast

interface GigabitEthernet1/0/5

description == R5
switchport access vlan 10
switchport private-vlan host-association 1000 1055
switchport mode private-vlan host
spanning-tree portfast

do the same for switch 1

then

sw3750_01#sh vlan id 1000


VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1000 VLAN1000 active Po1, Po2

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1000 enet 101000 1500 - - - - - 0 0
Remote SPAN VLAN
----------------
Disabled

Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
1000 1012 community Gi1/0/1
1000 1034 community Gi1/0/3
1000 1055 isolated Gi1/0/5
 
and switch 2
 
sw3750_02#sh vlan id 1000


VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1000 VLAN1000 active Po1, Po2

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1000 enet 101000 1500 - - - - - 0 0

Remote SPAN VLAN
----------------
Disabled

Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
1000 1012 community Gi1/0/1
1000 1034 community Gi1/0/3
1000 1055 isolated Gi1/0/5

private eyes...

a vlan is a network is a subnet is a broadcast domain... so what is a private vlan... a private vlan is a vlan within a vlan... why? to segregate traffic within vlans yet further... this comes in handy for isp's who have customers in the same subnet, but need further segmentation for security... the vlans are in the same subnet, they simply communicate in different vlans within the subnet...


types- promiscuous, (tramp) a port will send and receive to and from any other port on the vlan

          isolated, only allowed to communicate with tramps, and are stubs

          community, can communicate between themselves and tramps

for a great discussion see  petr laphukov below

http://blog.ine.com/2008/01/31/understanding-private-vlans/

and more here from the horse's mouth...

http://www.cisco.com/en/US/tech/tk389/tk814/tk840/tsd_technology_support_sub-protocol_home.html