# Private VLAN

## Navigation

Port > Configure > Private VLAN

The following information appears:

- Port Mode (cpvlanPortMode)

If you set the port mode to Host(2) and cpvlanPrivatePortSecondaryVlan is instantiated, then the following object appears:

- Secondary VLAN ID (cpvlanPrivatePortSecondaryVlan)

If you set the port mode to promiscuous(3), then the following three objects appear:

- Multi Primary Vlan (cpvlanPromPortMultiPrimaryVlan)

- Secondary VLAN Remap Details (0-1023) (cpvlanPromPortSecondaryRemap2k)

- Two Way Remap (cpvlanPromPortTwoWayRemapCapable)

If you set the port mode to either secondaryTrunk(4) or promiscuousTrunk(5), then the following seven objects appear:

- Dynamic State (cpvlanTrunkPortDynamicState)

- Encapsulation Type (cpvlanTrunkPortEncapType)

- Native Vlan (cpvlanTrunkPortNativeVlan)

- Secondary Vlans (cpvlanTrunkPortSecondaryVlans(1-4)k)

- Normal Vlans (cpvlanTrunkPortNormalVlans(1-4)k)

- Dynamic Status (cpvlanTrunkPortDynamicStatus)

- Encapsulation Operational Type (cpvlanTrunkPortEncapOperType)

### Port Mode (cpvlanPortMode)

Indicates which mode is currently configured for this port. There are 5 possible values:

- nonPrivateVlan(1)

- host(2)

- promiscuous(3)

- secondaryTrunk(4)

- promiscuousTrunk(5)

After selecting a mode from the list, click Set to apply that mode to this port.

### Secondary VLAN ID (cpvlanPrivatePortSecondaryVlan)

VLAN ID of the secondary VLAN.

A private port:

- accepts incoming traffic from its secondary VLAN, outgoing traffic from its associated primary VLAN, and outgoing traffic from a community or two-way community VLAN (depending on the the secondary VLAN type).

- blocks the outgoing traffic from an isolated VLAN.

Note that a port can join a secondary VLAN only after this secondary VLAN has been associated with a primary VLAN (in other words, when cpvlanVlanAssociatedPrimaryVlan has a nonzero value).

### Multi Primary Vlan (cpvlanPromPortMultiPrimaryVlan)

Indicates whether all the bits set as secondary VLANs in the corresponding remapping objects (for example, cpvlanPromPortSecondaryRemap) can belong to multiple primary VLANs. If this object is set to false(2), the value of cpvlanVlanAssociatedPrimaryVlan for the secondary VLANs with their bits set to "1" in those remapping objects must be the same.

Note: A promiscuous port can remap a secondary VLAN to its associated primary VLAN for outgoing traffic on the fly, as defined for the Private VLAN feature.

### Secondary VLAN Remap Details (0-1023) (cpvlanPromPortSecondaryRemap2k)

A string of octets containing one bit per VLAN for VLANs with VlanIndexOrZero values of 1024 through 2047 in the management domain on this port. The first octet corresponds to VLANs with VlanIndexOrZero values of 1024 through 1031; the second octet to VLANs with VlanIndexOrZero values of 1032 through 1039; and so on. The most significant bit of each octet is indicated by the lowest value of VlanIndexOrZero in that octet.

A bit can only be set to "1" when it corresponds to a Private VLAN isolated, community, or two-way community VLAN which has already been associated with a primary VLAN. Setting this bit to "1" results in one of the following:

- A secondary VLAN is remapped to its associated primary VLAN for outgoing traffic on the fly.

- A primary VLAN is remapped to its associated secondary VLAN if the secondary VLAN is the two-way community type and the value of cpvlanPromPortTwoWayRemapCapable for this port is set to true(1).

If the length of this string is less than 128 octets, any missing octets are assumed to contain the value zero. An NMS may omit these octets from the end of this string in order to reduce the size of Set PDUs. An NMS may also omit trailing octets containing the value zero to reduce the size of GetResponse PDUs.

Note: This object is only instantiated on devices which support values ranging from the value of VlanIndexOrZero to 4095.

### Two Way Remap (cpvlanPromPortTwoWayRemapCapable)

Indicates whether a port is capable of remapping primary VLANs to the two-way community VLANs associated with them for the Private VLAN feature. When this object is set to false(2), a promiscuous port can perform only one-way remappings of secondary VLANs to their associated primary VLANs. When this object is set to true(1), a promiscuous port can also perform remappings of primary VLANs to the two-way community VLANs associated with them.

### Dynamic State (cpvlanTrunkPortDynamicState)

For private VLAN trunk ports, this object indicates the trunking behavior configured for a port. There are two possible values:

- on(1): The port will always be a trunk. If negotiation is supported on this port, then negotiation will take place with the far end of the link in an attempt to bring the far end into the trunking state. If negotiation is not supported, then this value cannot be set.

- onNoNegotiate(2): This state is similar to on(1), except that no negotiation takes place with the far end of the link. If the value of cpvlanTrunkPortEncapType for this port is negotiate(3), then this value cannot be set.

### Encapsulation Type (cpvlanTrunkPortEncapType)

VLAN encapsulation type used by this private VLAN trunk port. There are three possible values:

- dot1Q(1): The port accepts and transmits packets via IEEE 802.1q VLAN encapsulation.

- isl(2): The port accepts and transmits packets via Inter Switch Link (ISL) VLAN encapsulation.

- negotiate(3): VLAN encapsulation is negotiated with the far end of the link. The negotiated VLAN encapsulation type can either be dot1Q or ISL. This value cannot be set if the port does not support the negotiation of VLAN encapsulation type or if its cpvlanTrunkPortDynamicState value is set to onNoNegotiate(2).

### Native Vlan (cpvlanTrunkPortNativeVlan)

VlanIndex value of the VLAN which is represented by native frames on this private VLAN trunk port. For ports that need to drop untagged frames or do not support the sending and receiving of native frames, the value of this object should be set to zero.

### Secondary Vlans (cpvlanTrunkPortSecondaryVlans(1-4)k)

An octet string containing one bit per VLAN for VLANs with values ranging from 0 to1023 in the management domain on this port. Note the following:

- If the bit associated with a VLAN is set to 1 and the corresponding VLAN is a secondary VLAN that has already been associated with a primary VLAN, then this private VLAN trunk port is enabled to remap the secondary VLAN to its primary VLAN for ingress traffic and remap its associated primary VLAN to the secondary VLAN for egress traffic.

- If the bit associated with a VLAN is set to 1 and the corresponding VLAN is a secondary VLAN, then the local system is enabled to transmit and receive frames with proper VLAN remapping via this private VLAN trunk port.

- If the bit associated with a VLAN is set to 0 and the corresponding VLAN is not configured as a normal VLAN, then the system is disabled from sending and receiving frames on that VLAN via this private VLAN trunk port.

### Normal Vlans (cpvlanTrunkPortNormalVlans(1-4)k)

An octet string containing one bit per VLAN for VLANs with values ranging from 0 to1023 in the management domain on this port. Note the following:

- If the bit associated with a VLAN is set to 1 and the corresponding VLAN is a normal VLAN, then the local system:

  - allows packets belonging to the VLAN to pass through this private VLAN trunk port

  - is enabled to transmit and receive frames as a normal VLAN

- If the bit associated with a VLAN is set to 0 and the corresponding VLAN is not configured as a secondary VLAN, then the local system is disabled from sending and receiving frames on that VLAN via this private VLAN trunk port.

### Dynamic Status (cpvlanTrunkPortDynamicStatus)

Current dynamic trunking status of the specified private VLAN port. There are two possible values:

- trunking(1): The port is currently operating as a private VLAN trunk port.

- notTrunking(2): The port is currently not trunking - instead, it is operating as an access port.

### Encapsulation Operational Type (cpvlanTrunkPortEncapOperType)

The VLAN encapsulation type in use by this private VLAN trunk port. There are three possible values:

- dot1Q(1): The port accepts and transmits packets via IEEE 802.1q VLAN encapsulation.

- isl(2): The port accepts and transmits packets via Inter Switch Link (ISL) VLAN encapsulation.

- notApplicable(3): Indicates that either the value of cpvlanTrunkPortDynamicStatus is set to notTrunking(2) or that encapsulation type negotiation has not been completed.