Wednesday, December 3, 2014

Private-vlan with VTPv3 and spaning tree.

There are documentation where you can find a full configuration guide for setting up private-vlan. The first step of official guide is "seting VTP to transparent mode" because private-vlan doesn't supported by VTP versions 1 and 2.
Here you can see an example of configuring private-vlan with VTPv3. Also i decided to check an existence of the single spanning tree instance for primary and secondary rpivate VLANs.


Let's see topology: here we have four real Catalyst3750 swthces with MSTP in SWITCH_2 and PVST+ on SWITCH_3, SWITCH_4 and SWITCH_1.
SWITCH_2 is a root for entire topology. VLAN 10 manually "pruned" from trunk between SWITCH_1 and SWITCH_2 and has different from VLAN8 layer 2 topology.
We have two GNS3 routers R1 and R2 for testing connectivity in private-vlan. Router R2 connected to "Community" port, router R1 connected to "promiscous" port.

Configure router interfaces

R1#sh ip inter bri | e ass
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            10.1.1.1        YES manual up                    up

R2#sh ip inter bri | e ass
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            10.1.1.2        YES manual up                    up



Check our spanning-tree topology for VLANs 8 and 10:

SWITCH_1#sh span root | i VLAN0010|VLAN0008
VLAN0008             0 0012.d994.fd80         4   10   20  15  Gi1/0/25
VLAN0010             0 0012.d994.fd80         8   10   20  15  Gi1/0/27

SWITCH_2#sh span vl 10 | i Desg
Gi1/0/3             Desg FWD 20000     128.3    P2p Bound(PVST)
Gi1/0/11            Desg FWD 20000     128.11   P2p Bound(PVST)

SWITCH_2#sh span vl 8 | i Desg
Gi1/0/3             Desg FWD 20000     128.3    P2p Bound(PVST)
Gi1/0/11            Desg FWD 20000     128.11   P2p Bound(PVST)
Gi1/0/12            Desg FWD 20000     128.12   P2p Bound(PVST)

SWITCH_2#sh span root

                                        Root    Hello Max Fwd
MST Instance           Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
MST0                 0 0012.d994.fd80         0   10   20  15

SWITCH_4#sh span root | i VLAN0010|VLAN0008
VLAN0008             0 0012.d994.fd80         4   10   20  15  Gi1/0/11
VLAN0010             0 0012.d994.fd80         4   10   20  15  Gi1/0/11

SWITCH_3#sh span root | i VLAN0010|VLAN0008
VLAN0008             0 0012.d994.fd80         4   10   20  15  Gi1/0/27
VLAN0010             0 0012.d994.fd80         4   10   20  15  Gi1/0/27


We have configured  VTPv3 and primary server mode on a SWITCH_3 and vlan 8 and 10 config on a server:


SWITCH_3#sh run vl 8
Building configuration...

Current configuration:
!
vlan 8
 name test_private_primary
  private-vlan primary
  private-vlan association 9-10
end

SWITCH_3#sh run vl 10
Building configuration...

Current configuration:
!
vlan 10
 name community_1
  private-vlan community
end

Verifying VTP version 3:

SWITCH_3#sh vtp status
VTP Version capable             : 1 to 3
VTP version running             : 3
VTP Domain Name                 : MY_VTP
VTP Pruning Mode                : Enabled
VTP Traps Generation            : Disabled
Device ID                       : b8be.bfb1.f200

Feature VLAN:
--------------
VTP Operating Mode                : Primary Server
Number of existing VLANs          : 16
Number of existing extended VLANs : 0
Configuration Revision            : 25
Primary ID                        : b8be.bfb1.f200
Primary Description               : SWITCH_3
MD5 digest                        : 0xB8 0xF3 0xB2 0x8E 0x70 0x24 0xF4 0x65
                                    0x86 0x89 0x18 0x4C 0x95 0x99 0xD1 0x1C

VTPv3 support Private-vlan, let's check Private-VLAN configuration on our switches:
Private-vlan operation requiered at least one promiscous port on a switch. We have a promiscous interface vlan 8 on a switch_3:

interface Vlan8
 ip address 10.1.1.88 255.255.255.0
 private-vlan mapping 9-10
end

Verify configured promiscous SVI:

SWITCH_3#sh inter priva mapping
Interface Secondary VLAN Type
--------- -------------- -----------------
vlan8     9              isolated
vlan8     10             community

Interfaces Gi1/0/13 configured to Routers:

SWITCH_3#sh int gi 1/0/13 switchport | i private
Administrative Mode: private-vlan host
Operational Mode: private-vlan host
Administrative private-vlan host-association: 8 (test_private_primary) 10 (community_1)
-----output omitted------
Operational private-vlan:
  8 (test_private_primary) 10 (community_1)
SWITCH_3#

SWITCH_1#sh int gi 1/0/13 switchport | i private
Administrative Mode: private-vlan promiscuous
Operational Mode: private-vlan promiscuous
Administrative private-vlan host-association: 8 (test_private_primary) 9 (private_ISOLATED)
Administrative private-vlan mapping: 8 (test_private_primary) 9 (private_ISOLATED) 10 (community_1) 11 (community_2)
-----output omitted------
Operational private-vlan:
  8 (test_private_primary) 9 (private_ISOLATED) 10 (community_1)

Verify VLANs 8 and 10 are configured as a private VLANS:

SWITCH_3#sh vl private-vlan
Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
8       9         isolated
8       10        community         Gi1/0/13

SWITCH_1#sh vlan private-vlan
Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
8       9         isolated          Gi1/0/13
8       10        community         Gi1/0/13

SWITCH_2#sh vl private-vlan
Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
8       9         isolated
8       10        community

SWITCH_4#sh vlan private-vlan
Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
8       9         isolated
8       10        community


Verify connectivity absence in private VLAN:

R1#ping 10.1.1.2 r 10
Type escape sequence to abort.
Sending 10, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
..........
Success rate is 0 percent (0/10)

Add manually VLAN 10 to trunk interface gi 1/0/12 on a SWITCH_2:

SWITCH_2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SWITCH_2(config)#int gi 1/0/12
SWITCH_2(config-if)#swi tru all vl add 10

Remove manually VLAN 10 to trunk interface gi 1/0/12
SWITCH_2(config-if)#swi tru all vl rem 10


As you can see connectivity between two routers after we added VLAN 10:
R1#ping 10.1.1.2 r 1000

Type escape sequence to abort.
Sending 1000, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
...............Added vlan to trunk --->!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!.....................  <-----removed VLAN from trunk


Let's make shure we have conncetivity in VLAN_8 and VLAN_10 without configured private-vlan.
Changing switchport mode to access on interfaces to routers:
Remooving config from VLAN 8 and 10

SWITCH_3(config-vlan)#vl 8
SWITCH_3(config-vlan)#no   private-vlan primary
SWITCH_3(config-vlan)#no   private-vlan association 9-10

SWITCH_3(config-vlan)#vl 10
SWITCH_3(config-vlan)#no   private-vlan community

Seting interfaces to R1 and R2 to access mode: first access VLAN_8 
SWITCH_1(config)#int gi 1/0/13
SWITCH_1(config-if)#swi mo acc
SWITCH_1(config-if)#swi acc vl 8


SWITCH_3(config)#int gi 1/0/13
SWITCH_3(config-if)#swi mo acc
SWITCH_3(config-if)#swi acc vl 8

waiting a couple minute....

... and then set up access VLAN_10
SWITCH_1(config-if)#swi ac vl 10
SWITCH_1(config-if)#exit
SWITCH_1(config)#int gi 1/0/13

SWITCH_3(config-vlan)#int gi 1/0/13
SWITCH_3(config-if)#swi mo acc
SWITCH_3(config-if)#swi acc vl 10
SWITCH_3(config-if)#exit

After all manipulation we return all configuration as we have it in the beginning - Vlan_8 private primary, VLAN_10 private secondary.

Below you can see a connectivity test that was carried out, while we have configured VLANs

R1#ping 10.1.1.2 r 1000000
Type escape sequence to abort.
Sending 1000, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
...............!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!..........................................................
....no pings while changing VLAN to access_8...............!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
---output omitted---
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!

R1#ping 10.1.1.2 r 1000000
Type escape sequence to abort.
Sending 1000000, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!no pings while changing VLAN to access_10.
.................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
---output omitted---
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!no pings when changed to switchport mode private.
......................................................................

No comments:

Post a Comment