In which configuration mode is private-vlan [isolated|community|primary] used?

The private-vlan [isolated|community|primary] command is entered in VLAN Config mode on Cisco IOS devices.

SecurityVLAN Config

private-vlan [isolated|community|primary]

Configures a VLAN as a private VLAN, designating it as isolated, community, or primary to provide Layer 2 isolation between ports within the same VLAN.

Definition: private-vlan [isolated|community|primary] is a Cisco IOS vlan config command. Configures a VLAN as a private VLAN, designating it as isolated, community, or primary to provide Layer 2 isolation between ports within the same VLAN.

Overview

The `private-vlan` command in VLAN configuration mode is a powerful tool for implementing Layer 2 isolation within a single VLAN. In traditional VLANs, all ports in the same VLAN can communicate freely at Layer 2, which can be a security concern in multi-tenant environments, data centers, or campus networks where you need to segregate traffic without creating multiple VLANs. Private VLANs (PVLANs) solve this by partitioning a VLAN into subdomains: a primary VLAN and multiple secondary VLANs (isolated and community).

The primary VLAN serves as the upstream trunk to routers or firewalls, while secondary VLANs provide isolation. An isolated VLAN allows only one-way communication to the primary VLAN (typically to a gateway), preventing any host-to-host communication within the same isolated VLAN. A community VLAN allows communication among its member ports and to the primary VLAN, but not to other community or isolated VLANs.

This command is essential when you need to restrict lateral traffic between servers in a data center, isolate customer ports in a service provider environment, or enforce security policies without consuming additional VLAN IDs. Compared to alternatives like access control lists (ACLs) or port security, private VLANs operate at Layer 2 and are more efficient for large-scale isolation because they don't require per-port ACLs and are handled in hardware. In the configuration workflow, you first create the primary VLAN and secondary VLANs (isolated/community) using the `private-vlan` command, then associate them with the `private-vlan association` command, and finally configure switch ports as promiscuous (for primary VLAN) or host (for secondary VLANs).

The command is available in IOS 12.2(25)EWA and later, and requires the LAN Base or IP Services feature set. It modifies the running configuration immediately and is saved to startup config with `copy running-config startup-config`. Understanding private VLANs is critical for CCNA and CCNP candidates as they appear in exam topics on VLAN security and Layer 2 design.

Syntax·VLAN Config

private-vlan [isolated|community|primary]

When to Use This Command

Isolating guest Wi-Fi traffic from corporate devices on the same switch
Creating a community VLAN for a group of servers that need to communicate with each other but not with other devices
Setting up a primary VLAN to aggregate multiple isolated and community VLANs for routing
Providing secure multi-tenant environments where tenants cannot communicate directly

Parameters

Parameter	Syntax	Required	Description
isolated	isolated	Optional	Designates the VLAN as an isolated private VLAN. Ports in an isolated VLAN can only communicate with promiscuous ports (typically in the primary VLAN). They cannot communicate with each other or with ports in other secondary VLANs. This is used for strict host isolation, such as in a DMZ or customer edge.
community	community	Optional	Designates the VLAN as a community private VLAN. Ports in a community VLAN can communicate with each other and with promiscuous ports, but not with ports in other community or isolated VLANs. This is used for groups of devices that need mutual access, like a server cluster.
primary	primary	Optional	Designates the VLAN as the primary private VLAN. The primary VLAN carries traffic from secondary VLANs to upstream devices (routers, firewalls). It must be associated with secondary VLANs using the `private-vlan association` command. Only one primary VLAN can exist per private VLAN domain.

Command Examples

Configuring an Isolated Private VLAN

Switch(config)# vlan 100
Switch(config-vlan)# private-vlan isolated

Switch(config-vlan)# private-vlan isolated
Switch(config-vlan)#

The command sets VLAN 100 as an isolated private VLAN. No output is displayed upon success; the prompt returns indicating the command was accepted.

Configuring a Community Private VLAN

Switch(config)# vlan 200
Switch(config-vlan)# private-vlan community

Switch(config-vlan)# private-vlan community
Switch(config-vlan)#

This sets VLAN 200 as a community private VLAN. Again, no output confirms success.

Configuring a Primary Private VLAN

Switch(config)# vlan 300
Switch(config-vlan)# private-vlan primary

Switch(config-vlan)# private-vlan primary
Switch(config-vlan)#

VLAN 300 is configured as the primary private VLAN. The primary VLAN is used to associate secondary VLANs (isolated/community) for Layer 3 routing.

Understanding the Output

The command 'private-vlan' does not produce any output on success; the switch simply returns to the VLAN configuration prompt. To verify the configuration, use 'show vlan private-vlan' or 'show interfaces private-vlan mapping'. In 'show vlan private-vlan', look for the VLAN ID and its type (primary, isolated, or community).

A primary VLAN will show associated secondary VLANs. An isolated VLAN will have no community associations. Ensure that the VLAN is not already configured as a different type, as that will cause an error.

Configuration Scenarios

Isolating Servers in a Data Center Using Private VLANs

A data center has multiple servers in the same subnet that should not communicate with each other for security reasons. Each server needs access to a shared gateway. Using private VLANs, we can isolate each server while keeping them in the same IP subnet.

Topology

Switch1(Gi1/0/1)---Server1 (isolated)
Switch1(Gi1/0/2)---Server2 (isolated)
Switch1(Gi1/0/3)---Router (promiscuous)

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Create VLAN 100 as the primary VLAN: vlan 100
3.Step 3: Configure VLAN 100 as primary private VLAN: private-vlan primary
4.Step 4: Exit VLAN config: exit
5.Step 5: Create VLAN 101 as an isolated VLAN: vlan 101
6.Step 6: Configure VLAN 101 as isolated private VLAN: private-vlan isolated
7.Step 7: Exit VLAN config: exit
8.Step 8: Associate the isolated VLAN with the primary VLAN: vlan 100
9.Step 9: private-vlan association 101
10.Step 10: Exit VLAN config: exit
11.Step 11: Configure the router-facing port as promiscuous: interface GigabitEthernet1/0/3
12.Step 12: switchport mode private-vlan promiscuous
13.Step 13: switchport private-vlan mapping 100 101
14.Step 14: Exit interface config: exit
15.Step 15: Configure server-facing ports as host: interface range GigabitEthernet1/0/1-2
16.Step 16: switchport mode private-vlan host
17.Step 17: switchport private-vlan host-association 100 101
18.Step 18: End: end

Configuration

!
vlan 100
 private-vlan primary
!
vlan 101
 private-vlan isolated
!
vlan 100
 private-vlan association 101
!
interface GigabitEthernet1/0/3
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 100 101
!
interface range GigabitEthernet1/0/1-2
 switchport mode private-vlan host
 switchport private-vlan host-association 100 101
!

Verify: Use `show vlan private-vlan` to verify PVLAN configuration. Expected output shows VLAN 100 as primary, VLAN 101 as isolated, and association between them. Use `show interfaces private-vlan mapping` to verify promiscuous port mapping.

Watch out: Ensure that the primary VLAN is created before associating secondary VLANs. Also, the promiscuous port must be in the same primary VLAN as the host ports; otherwise, traffic will not pass.

Creating a Community VLAN for a Workgroup with Internet Access

A company has a workgroup of three servers that need to communicate with each other and access the internet via a router. Other servers in the same subnet should remain isolated. A community VLAN allows the workgroup servers to talk to each other and the gateway, while isolated VLANs keep other servers separate.

Topology

Switch1(Gi1/0/1)---ServerA (community)
Switch1(Gi1/0/2)---ServerB (community)
Switch1(Gi1/0/3)---ServerC (community)
Switch1(Gi1/0/4)---Router (promiscuous)

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Create VLAN 200 as primary: vlan 200
3.Step 3: private-vlan primary
4.Step 4: Exit: exit
5.Step 5: Create VLAN 201 as community: vlan 201
6.Step 6: private-vlan community
7.Step 7: Exit: exit
8.Step 8: Associate community VLAN with primary: vlan 200
9.Step 9: private-vlan association 201
10.Step 10: Exit: exit
11.Step 11: Configure router port as promiscuous: interface GigabitEthernet1/0/4
12.Step 12: switchport mode private-vlan promiscuous
13.Step 13: switchport private-vlan mapping 200 201
14.Step 14: Exit: exit
15.Step 15: Configure server ports as host: interface range GigabitEthernet1/0/1-3
16.Step 16: switchport mode private-vlan host
17.Step 17: switchport private-vlan host-association 200 201
18.Step 18: End: end

Configuration

!
vlan 200
 private-vlan primary
!
vlan 201
 private-vlan community
!
vlan 200
 private-vlan association 201
!
interface GigabitEthernet1/0/4
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 200 201
!
interface range GigabitEthernet1/0/1-3
 switchport mode private-vlan host
 switchport private-vlan host-association 200 201
!

Verify: Use `show vlan private-vlan` to see VLAN types and associations. Use `show interfaces private-vlan host-association` on host ports to confirm association. Test connectivity: ServerA should ping ServerB and the router, but not an isolated server in another VLAN.

Watch out: Community VLAN ports can communicate with each other, but they cannot communicate with ports in other community or isolated VLANs. Ensure that the router's promiscuous port is correctly mapped to both primary and secondary VLANs, or traffic will not reach the gateway.

Troubleshooting with This Command

When troubleshooting private VLAN issues, start by verifying the PVLAN configuration with `show vlan private-vlan`. This command displays all VLANs, their type (primary, isolated, community), and associations. A healthy output shows each secondary VLAN associated with a primary VLAN.

If a secondary VLAN appears without an association, traffic will not flow. Next, check interface status with `show interfaces private-vlan mapping` for promiscuous ports and `show interfaces private-vlan host-association` for host ports. For promiscuous ports, the mapping must include the primary VLAN and the secondary VLANs that need to communicate.

A common symptom is that hosts cannot ping the gateway; this often indicates that the promiscuous port mapping is missing the secondary VLAN. Use `show interfaces switchport` to verify the operational mode: promiscuous ports should show 'private-vlan promiscuous', and host ports should show 'private-vlan host'. If a port shows 'static access' or 'trunk', the PVLAN configuration is not applied.

Another symptom is that hosts in the same community VLAN cannot communicate; check that all host ports are in the same secondary VLAN and that the secondary VLAN is correctly associated with the primary. Use `show vlan id <vlan>` to see which ports are in the VLAN. If a host port is not listed, the host-association may be missing.

Also, verify that the primary VLAN is not also used as a regular VLAN on other ports; mixing PVLAN and non-PVLAN ports in the same primary VLAN can cause unexpected behavior. For inter-VLAN routing, ensure that the router's interface is configured with `switchport mode private-vlan promiscuous` and the correct mapping. If the router is a Layer 3 switch with an SVI, the SVI must be in the primary VLAN, and IP routing must be enabled.

Use `show ip route` to verify the gateway reachability. Debug commands like `debug private-vlan` can provide real-time insight but should be used sparingly due to CPU impact. Correlate PVLAN output with `show mac address-table` to see if MAC addresses are learned on the correct VLANs.

If a host MAC appears on the wrong VLAN, check the port configuration. Finally, remember that private VLANs are not supported on all platforms; verify with `show version` and `show feature` (on NX-OS).

CCNA Exam Tips

Remember that private VLANs require a primary VLAN and at least one secondary VLAN (isolated or community).

On CCNA, you may be asked to identify which VLAN type allows communication within the same group (community) vs. no communication (isolated).

Private VLANs are configured in VLAN configuration mode, not interface mode.

The 'private-vlan' command is only available on switches that support PVLANs (e.g., Catalyst 3560, 3750).

Common Mistakes

Forgetting to associate secondary VLANs to the primary VLAN using 'private-vlan association' command.

Applying the 'private-vlan' command to an existing VLAN that already has ports assigned, causing configuration rejection.

Confusing 'private-vlan isolated' with 'switchport mode private-vlan host' – the former sets the VLAN type, the latter sets the interface mode.

private-vlan [isolated|community|primary] vs enable password [password]

Although both commands fall under the security category in Cisco IOS, they operate at entirely different layers. The `private-vlan` command controls Layer 2 isolation within a VLAN, while `enable password` controls administrative access to the device. They are often grouped in security documentation but are rarely confused in practice.

Aspect	private-vlan [isolated\|community\|primary]	enable password [password]
Scope	VLAN configuration (Layer 2)	Device-wide access control
Configuration mode	VLAN Configuration (config-vlan)	Global Configuration (config)
Persistence	Saved in running-config and startup-config	Saved in running-config and startup-config
Precedence	Overridden by other VLAN parameters	Overridden if 'enable secret' is configured
Typical use	Segregating traffic in multi-tenant environments	Protecting privileged EXEC mode access

Use private-vlan [isolated|community|primary] when you need to enforce Layer 2 isolation between ports within the same VLAN, typically in a service provider or data center environment.

Use enable password [password] when you need a simple, plaintext password for enable access and are not concerned about the lack of encryption, or when backward compatibility with older devices is required.

Platform Notes

On IOS-XE (e.g., Catalyst 3650/3850/9300), the `private-vlan` command syntax is identical to classic IOS. However, on IOS-XE, private VLANs are supported only in the LAN Base or IP Services feature set. The output of `show vlan private-vlan` may include additional fields like 'Type' and 'Association'.

On NX-OS (e.g., Nexus 9000), the equivalent command is `private-vlan` under VLAN configuration mode, but the syntax for associating VLANs differs: use `private-vlan association <secondary-vlan-list>` under the primary VLAN. Also, on NX-OS, you must configure the VLAN as 'private-vlan' before setting the type. The interface commands are similar: `switchport mode private-vlan host` and `switchport private-vlan host-association <primary-vlan> <secondary-vlan>`.

On ASA firewalls, private VLANs are not directly supported; instead, use transparent firewall mode with access-lists for similar isolation. On IOS-XR, private VLANs are not supported; use VLAN subinterfaces and ACLs instead. In older IOS versions (12.x), the `private-vlan` command was introduced in 12.2(25)EWA; earlier versions do not support it.

In IOS 15.x and 16.x, the command remains consistent. Always ensure that the switch is in VTP transparent mode or VTP version 3 with private VLAN support, as VTP version 1/2 can propagate PVLAN information incorrectly. On some platforms, you must disable VTP pruning for private VLANs to work correctly.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions