Switch - Configure Private VLAN [Overview] – Zyxel Support Campus USA

[Standalone] Private VLAN: To provide a secure environment for each user in the same VLAN, we block traffic between users in the same VLAN.

Background

Using 802.1Q tagged-based VLAN, we cannot block clients in the same VLAN communicate with each other

Take a look at this scenario. It blocks traffic from port 3/4/5 to achieve the security network environment for small business unit.

Workaround

Port isolation (L2 isolation)

Port 3-5 cannot communicate with each other
Port 3-5 can communicate with uplink port 24

We can enable port isolation on port 3/4/5. isolated ports (3-5) cannot communicate with each other. But they can communicate with uplink port 24 to access the Internet.

Problem with Port Isolation: If port 3-4 of a new VLAN 200 would like to communicate with each other, port isolation cannot make this.

Solution Privat VLAN:

Benefits of a Private VLAN are to provide a new method to block traffic between ports in the same VLAN. Users do not need to enable port isolation to achieve the goal, which is to secure the network at the site.

Users can specify which ports in the same VLAN are not to be isolated by adding them to the promiscuous port list.

The switch automatically adds other ports in this VLAN to be isolated ports and blocks traffics between the isolated ports.

The promiscuous ports can communicate with any ports in the same VLAN.

However, isolated ports can communicate with the promiscuous ports only.

So there two Port Rules for it: