Configuration procedure

1. Enter system view.

system-view

N/A

2. Create a VLAN and enter VLAN view.

vlan vlan-id

N/A

3. Configure the VLAN as a primary VLAN.

private-vlan primary

By default, a VLAN is not a primary VLAN.

4. Return to system view.

quit

N/A

5. Create one or multiple secondary VLANs.

vlan { vlan-id1 [ to vlan-id2 ] | all }

N/A

6. Enable Layer 2 communication for ports in the same secondary VLAN.

• undo private-vlan isolated

• private-vlan community

Use either command.

By default, ports in the same secondary VLAN can communicate with each other at Layer 2.

This configuration takes effect when the following conditions exist:

• The ports in the secondary VLAN are configured as host ports.

• The secondary VLAN is associated with a primary VLAN.

7. Return to system view.

quit

N/A

8. Enter Layer 2 Ethernet interface view or Layer 2 aggregate interface view.

interface interface-type interface-number

N/A

9. Configure the uplink port as a promiscuous or trunk promiscuous port of the specified VLANs.

• Configure the uplink port as a promiscuous port of the specified VLAN:port private-vlan vlan-id promiscuous

• Configure the uplink port as a trunk promiscuous port of the specified VLANs:port private-vlan vlan-id-list trunk promiscuous

By default, a port is not a promiscuous or trunk promiscuous port of any VLAN.

10. Return to system view.

quit

N/A

11. Enter Layer 2 Ethernet interface view or Layer 2 aggregate interface view.

interface interface-type interface-number

N/A

12. Assign the downlink port to secondary VLANs.

1. Set the link type of the port:port link-type { access | hybrid | trunk }

2. Assign the access port to the specified VLAN:port access vlan vlan-id

3. Assign the trunk port to the specified VLANs:port trunk permit vlan { vlan-id-list | all }

4. Assign the hybrid port to the specified VLANs:port hybrid vlan vlan-id-list { tagged | untagged }

Select substep b, c, or d depending on the port link type.

13. Return to system view.

quit

N/A

14. Enter Layer 2 Ethernet interface view or Layer 2 aggregate interface view.

interface interface-type interface-number

N/A

15. Configure the downlink port as a host or trunk secondary port.

• Configure the downlink port as a host port:port private-vlan host

• Configure the downlink port as a trunk secondary port:port private-vlan vlan-id-list trunk secondary

By default, a port is not a host or trunk secondary port.

16. Enter primary VLAN view.

vlan vlan-id

N/A

17. Associate the primary VLAN with the specified secondary VLANs.

private-vlan secondary vlan-id-list

By default, a primary VLAN is not associated with any secondary VLAN.

18. Return to system view.

quit

N/A

19. (Optional.) Configure Layer 3 communication between the specified secondary VLANs.

1. Enter VLAN interface view of the primary VLAN interface:interface vlan-interface vlan-id

2. Enable Layer 3 communication between secondary VLANs that are associated with the primary VLAN:private-vlan secondary vlan-id-list

3. Assign an IPv4 address to the primary VLAN interface:ip address ip-address { mask-length | mask } [ sub ]

4. Assign an IPv6 address to the primary VLAN interface:ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }

5. Enable local proxy ARP:local-proxy-arp enable

6. Enable local proxy ND:local-proxy-nd enable

Use substeps a, b, c, and e for devices that run IPv4 protocols.

Use substeps a, b, d, and f for devices that run IPv6 protocols.

By default:

• Secondary VLANs cannot communicate with each other at Layer 3.

• No IP address is configured for a VLAN interface.

• Local proxy ARP and local proxy ND are disabled.