private vlan

参考典型二 典型案例三，

Private VLAN典型配置举例二

1. 组网需求

·     Device B上的VLAN 5和VLAN 10为Primary VLAN，其上行端口Ten-GigabitEthernet1/0/1需要允许VLAN 5和VLAN 10的报文携带VLAN Tag通过。

·     Device B的下行端口Ten-GigabitEthernet1/0/2允许Secondary VLAN 2通过，Ten-GigabitEthernet1/0/3允许Secondary VLAN 3通过，VLAN 2和VLAN 3映射到Primary VLAN 5。

·     Device B的下行端口Ten-GigabitEthernet1/0/6允许Secondary VLAN 6通过，Ten-GigabitEthernet1/0/8允许Secondary VLAN 8通过，VLAN 6和VLAN 8映射到Primary VLAN 10。

·     从Device A看，下接的Device B只有VLAN 5和VLAN 10。

2. 组网图

图2-3 组网图

3. 配置步骤

(1)     配置Device B

# 配置VLAN 5和VLAN 10为Primary VLAN。

<DeviceB> system-view

[DeviceB] vlan 5

[DeviceB-vlan5] private-vlan primary

[DeviceB-vlan5] quit

[DeviceB] vlan 10

[DeviceB-vlan10] private-vlan primary

[DeviceB-vlan10] quit

# 创建Secondary VLAN 2、3、6、8。

[DeviceB] vlan 2 to 3

[DeviceB] vlan 6

[DeviceB-vlan6] quit

[DeviceB] vlan 8

[DeviceB-vlan8] quit

# 配置上行端口Ten-GigabitEthernet1/0/1在VLAN 5和VLAN 10中工作在trunk promiscuous模式。

[DeviceB] interface ten-gigabitethernet 1/0/1

[DeviceB-Ten-GigabitEthernet1/0/1] port private-vlan 5 10 trunk promiscuous

[DeviceB-Ten-GigabitEthernet1/0/1] quit

# 将下行端口Ten-GigabitEthernet1/0/2加入VLAN 2，Ten-GigabitEthernet1/0/3加入VLAN 3，并配置他们工作在host模式。

[DeviceB] interface ten-gigabitethernet 1/0/2

[DeviceB-Ten-GigabitEthernet1/0/2] port access vlan 2

[DeviceB-Ten-GigabitEthernet1/0/2] port private-vlan host

[DeviceB-Ten-GigabitEthernet1/0/2] quit

[DeviceB] interface ten-gigabitethernet 1/0/3

[DeviceB-Ten-GigabitEthernet1/0/3] port access vlan 3

[DeviceB-Ten-GigabitEthernet1/0/3] port private-vlan host

[DeviceB-Ten-GigabitEthernet1/0/3] quit

# 配置Primary VLAN 5和Secondary VLAN 2、3间的映射关系。

[DeviceB] vlan 5

[DeviceB-vlan5] private-vlan secondary 2 to 3

[DeviceB-vlan5] quit

# 将下行端口Ten-GigabitEthernet1/0/6加入VLAN 6，Ten-GigabitEthernet1/0/8加入VLAN 8，并配置它们工作在host模式。

[DeviceB] interface ten-gigabitethernet 1/0/6

[DeviceB-Ten-GigabitEthernet1/0/6] port access vlan 6

[DeviceB-Ten-GigabitEthernet1/0/6] port private-vlan host

[DeviceB-Ten-GigabitEthernet1/0/6] quit

[DeviceB] interface ten-gigabitethernet 1/0/8

[DeviceB-Ten-GigabitEthernet1/0/8] port access vlan 8

[DeviceB-Ten-GigabitEthernet1/0/8] port private-vlan host

[DeviceB-Ten-GigabitEthernet1/0/8] quit

# 配置Primary VLAN 10和Secondary VLAN 6、8间的映射关系。

[DeviceB] vlan 10

[DeviceB-vlan10] private-vlan secondary 6 8

[DeviceB-vlan10] quit

(2)     配置Device A

# 创建VLAN 5和VLAN 10。

[DeviceA] vlan 5

[DeviceA-vlan5] quit

[DeviceA] vlan 10

[DeviceA-vlan10] quit

# 配置端口Ten-GigabitEthernet1/0/1为Hybrid端口，并允许VLAN 5和VLAN 10携带Tag通过。

[DeviceA] interface ten-gigabitethernet 1/0/1

[DeviceA-Ten-GigabitEthernet1/0/1] port link-type hybrid

[DeviceA-Ten-GigabitEthernet1/0/1] port hybrid vlan 5 10 tagged

[DeviceA-Ten-GigabitEthernet1/0/1] quit

4. 显示与验证

# 显示Device B上的Primary VLAN 5配置情况（Primary VLAN 10的显示结果类似，这里不再列出）。

[DeviceB] display private-vlan 5

 Primary VLAN ID: 5

 Secondary VLAN ID: 2-3

 VLAN ID: 5

 VLAN type: Static

 Private VLAN type: Primary

 Route interface: Not configured

 Description: VLAN 0005

 Name: VLAN 0005

 Tagged   ports:

    Ten-GigabitEthernet1/0/1

 Untagged ports:

    Ten-GigabitEthernet1/0/2          Ten-GigabitEthernet1/0/3

 VLAN ID: 2

 VLAN type: Static

 Private VLAN type: Secondary

 Route interface: Not configured

 Description: VLAN 0002

 Name: VLAN 0002

 Tagged   ports:

    Ten-GigabitEthernet1/0/1

 Untagged ports:

    Ten-GigabitEthernet1/0/2

 VLAN ID: 3

 VLAN type: Static

 Private VLAN type: Secondary

 Route interface: Not configured

 Description: VLAN 0003

 Name: VLAN 0003

 Tagged   ports:

    Ten-GigabitEthernet1/0/1

 Untagged ports:

    Ten-GigabitEthernet1/0/3

1.5  Private VLAN典型配置举例三

1. 组网需求

·     Device A上的VLAN 10和VLAN 20为Primary VLAN，上行端口Ten-GigabitEthernet1/0/5需要允许VLAN 10和VLAN 20的报文携带VLAN Tag通过。

·     Device A上的VLAN 11、12、21、22为Secondary VLAN，下行端口Ten-GigabitEthernet1/0/2允许VLAN 11和VLAN 21的报文携带VLAN Tag通过，下行端口Ten-GigabitEthernet1/0/1允许VLAN 22通过，下行端口Ten-GigabitEthernet1/0/3允许VLAN 12通过。

·     Secondary VLAN 11和Secondary VLAN 12映射到Primary VLAN 10；Secondary VLAN 21和Secondary VLAN 22映射到Primary VLAN 20。

2. 组网图

图2-4 组网图

3. 配置步骤

(1)     配置Device A

# 配置VLAN 10和VLAN 20为Primary VLAN。

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] private-vlan primary

[DeviceA-vlan10] quit

[DeviceA] vlan 20

[DeviceA-vlan20] private-vlan primary

[DeviceA-vlan20] quit

# 创建VLAN 11、12、21、22。

[DeviceA] vlan 11 to 12

[DeviceA] vlan 21 to 22

# 配置Primary VLAN 10和Secondary VLAN 11、12间的映射关系。

[DeviceA] vlan 10

[DeviceA-vlan10] private-vlan secondary 11 12

[DeviceA-vlan10] quit

# 配置Primary VLAN 20和Secondary VLAN 21、22间的映射关系。

[DeviceA] vlan 20

[DeviceA-vlan20] private-vlan secondary 21 22

[DeviceA-vlan20] quit

# 配置上行端口Ten-GigabitEthernet1/0/5在VLAN 10和VLAN 20中工作在trunk promiscuous模式。

[DeviceA] interface ten-gigabitethernet 1/0/5

[DeviceA-Ten-GigabitEthernet1/0/5] port private-vlan 10 20 trunk promiscuous

[DeviceA-Ten-GigabitEthernet1/0/5] quit

# 将下行端口Ten-GigabitEthernet1/0/1加入VLAN 22，并配置工作在host模式。

[DeviceA] interface ten-gigabitethernet 1/0/1

[DeviceA-Ten-GigabitEthernet1/0/1] port access vlan 22

[DeviceA-Ten-GigabitEthernet1/0/1] port private-vlan host

[DeviceA-Ten-GigabitEthernet1/0/1] quit

# 将下行端口Ten-GigabitEthernet1/0/3加入VLAN 12，并配置工作在host模式。

[DeviceA] interface ten-gigabitethernet 1/0/3

[DeviceA-Ten-GigabitEthernet1/0/3] port access vlan 12

[DeviceA-Ten-GigabitEthernet1/0/3] port private-vlan host

[DeviceA-Ten-GigabitEthernet1/0/3] quit

# 配置下行端口Ten-GigabitEthernet1/0/2在VLAN 11和VLAN 21中工作在trunk secondary模式。

[DeviceA] interface ten-gigabitethernet 1/0/2

[DeviceA-Ten-GigabitEthernet1/0/2] port private-vlan 11 21 trunk secondary

[DeviceA-Ten-GigabitEthernet1/0/2] quit

(2)     配置Device B

# 创建VLAN 11和VLAN 21。

<DeviceB> system-view

[DeviceB] vlan 11

[DeviceB-vlan11] quit

[DeviceB] vlan 21

[DeviceB-vlan21] quit

# 配置端口Ten-GigabitEthernet1/0/2为Hybrid端口，并允许VLAN 11和VLAN 21携带Tag通过。

[DeviceB] interface ten-gigabitethernet 1/0/2

[DeviceB-Ten-GigabitEthernet1/0/2] port link-type hybrid

[DeviceB-Ten-GigabitEthernet1/0/2] port hybrid vlan 11 21 tagged

[DeviceB-Ten-GigabitEthernet1/0/2] quit

# 将端口Ten-GigabitEthernet1/0/4加入VLAN 11。

[DeviceB] interface ten-gigabitethernet 1/0/4

[DeviceB-Ten-GigabitEthernet1/0/4] port access vlan 11

[DeviceB-Ten-GigabitEthernet1/0/4] quit

# 将端口Ten-GigabitEthernet1/0/3加入VLAN 21。

[DeviceB] interface ten-gigabitethernet 1/0/3

[DeviceB-Ten-GigabitEthernet1/0/3] port access vlan 21

[DeviceB-Ten-GigabitEthernet1/0/3] quit

(3)     配置Device C

# 创建VLAN 10和VLAN 20。

<DeviceC> system-view

[DeviceC] vlan 10

[DeviceC-vlan10] quit

[DeviceC] vlan 20

[DeviceC-vlan20] quit

# 配置端口Ten-GigabitEthernet1/0/5为Hybrid端口，并允许VLAN 10和VLAN 20携带Tag通过。

[DeviceC] interface ten-gigabitethernet 1/0/5

[DeviceC-Ten-GigabitEthernet1/0/5] port link-type hybrid

[DeviceC-Ten-GigabitEthernet1/0/5] port hybrid vlan 10 20 tagged

[DeviceC-Ten-GigabitEthernet1/0/5] quit

4. 显示与验证

# 显示Device A上Primary VLAN 10的配置情况。

[DeviceA] display private-vlan 10

 Primary VLAN ID: 10

 Secondary VLAN ID: 11-12

 VLAN ID: 10

 VLAN type: Static

 Private-vlan type: Primary

 Route interface: Not configured

 Description: VLAN 0010

 Name: VLAN 0010

 Tagged   ports:

    Ten-GigabitEthernet1/0/2          Ten-GigabitEthernet1/0/5

 Untagged ports:

    Ten-GigabitEthernet1/0/3

 VLAN ID: 11

 VLAN type: Static

 Private-vlan type: Secondary

 Route interface: Not configured

 Description: VLAN 0011

 Name: VLAN 0011

 Tagged   ports:

    Ten-GigabitEthernet1/0/2          Ten-GigabitEthernet1/0/5

 Untagged ports: None

VLAN ID: 12

 VLAN type: Static

 Private-vlan type: Secondary

 Route interface: Not configured

 Description: VLAN 0012

 Name: VLAN 0012

 Tagged   ports:

    Ten-GigabitEthernet1/0/5

 Untagged ports:

    Ten-GigabitEthernet1/0/3

# 显示Device A上Primary VLAN 20的配置情况。

[DeviceA] display private-vlan 20

 Primary VLAN ID: 20

 Secondary VLAN ID: 21-22

 VLAN ID: 20

 VLAN type: Static

 Private-vlan type: Primary

 Route interface: Not configured

 Description: VLAN 0020

 Name: VLAN 0020

 Tagged   ports:

    Ten-GigabitEthernet1/0/2          Ten-GigabitEthernet1/0/5

 Untagged ports:

    Ten-GigabitEthernet1/0/1

 VLAN ID: 21

 VLAN type: Static

 Private-vlan type: Secondary

 Route interface: Not configured

 Description: VLAN 0021

 Name: VLAN 0021

 Tagged   ports:

    Ten-GigabitEthernet1/0/2          Ten-GigabitEthernet1/0/5

 Untagged ports: None

 VLAN ID: 22

 VLAN type: Static

 Private-vlan type: Secondary

 Route interface: Not configured

 Description: VLAN 0022

 Name: VLAN 0022

 Tagged   ports:

    Ten-GigabitEthernet1/0/5

 Untagged ports:

    Ten-GigabitEthernet1/0/1

您发的早就看过，貌似trunk 也能用为啥还要用private

我咨询一下配置三案例  我在Device c上开启DHCP  下面的PC为啥获取不到IP地址