Rules for assigning ports in PVLANs

An access port—which is directly connected to a host—can belong to one secondary VLAN in the PVLAN only.

Promiscuous ports can be members of the primary VLAN only.

Ports can be one type only: promiscuous, community, isolated, or interswitch link (PVLAN member port)