In this video, I'm excited to chat with you
about a special type of port or interface
inside a private VLANs that's willing to talk to just
anybody, no restrictions.
It's called a promiscuous port.
So to understand the importance of a promiscuous port,
let's just review our topology real quick.
So logically, we're going to create VLAN 100.
It's going to be a primary VLAN as part of private VLANs.
The address space we're going to use everywhere,
on the primary VLANs and all the secondaries,
is one logical layer 3 network address space of 10.100.0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is one logical layer 3 network address space of 10.100.0.
And then, we've created three secondary VLANs,
two that are type community, and one that is type isolated.
And what we need is we need to allow these devices.
Let's say this is a PC that's a server, that's
the internet of things device here.
We need to all those devices to have a default gateway if we
ever want them to communicate outside of the 10.100 address
space.
And so what we can do is we can have a layer 3 interface.
You can also do this with layer 2.
But in the case of a multilayer switch,
we could have a switched virtual interface for this VLAN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we could have a switched virtual interface for this VLAN
100, the primary VLAN, and we could
specify that is promiscuous.
The promiscuous port, from the private VLAN perspective,
is a port associated with the primary VLAN--
so if this was a switch virtual interface,
it would be like interface VLAN 100.
It would have an IP address.
And we would specify that it is a promiscuous port.
And a promiscuous port is allowed
to communicate with everybody.
So I'm going to draw lines here.
So that port, that port, everybody in VLAN 200 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that port, that port, everybody in VLAN 200
could communicate with the promiscuous port.
And VLAN 300, everybody in that secondary VLAN
can communicate with a promiscuous port.
And even these guys over here, the isolated ports
and the isolated VLAN, they can also
talk with the promiscuous port, and that's
because they do need a default gateway if they ever
hope to forward traffic off of their local subnet.
So let's do a little "what if."
Let's imagine this promiscuous port,
a switch virtual interface on this multilayer switch was
at 10.100.0.1.
We'll call it .1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll call it .1.
And let's go to use .50, and .60, and .70 over here.
What we would do is configure all these devices
that are connected to our private VLAN regardless
of the secondary VLAN that they're in.
We would configure them to use the default gateway
of 10.100.0.1.
And because it's a promiscuous port,
this guy right here, in VLAN 200,
would be allowed to communicate, and frames could
be forwarded to that port.
Also, frames would be sent between that device
and any other device in that same community VLAN. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and any other device in that same community VLAN.
The same is true for VLAN 300, which is also
a community VLAN for VLAN 300.
So these devices can all communicate here.
And they can also communicate with the default gateway
if that default gateway is configured
as a promiscuous port.
And again, the promiscuous port is
going to be associated with the primary VLAN.
You're not going to want to put-- in fact, if you try,
it won't work.
You won't want to put a promiscuous port associated
with a secondary VLAN of any type,
because it just won't work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because it just won't work.
So the promiscuous port has to be associated
with the primary VLAN.
So if this is VLAN 100, this could be interface VLAN 100
given an IP address associated VLAN 100,
and you'd also specify the secondary VLANs it's
willing to communicate with.
And then for the isolated VLAN, the devices there
could all communicate with the promiscuous port,
but they would not be able to communicate
with any other ports in the private VLAN.
So they couldn't communicate with other people in 400.
And they certainly couldn't communicate with anybody WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And they certainly couldn't communicate with anybody
in 300 or 200, because the type of secondary VLAN that they're
in is isolated.
Now, the other thing I'd like to point out
is that if you have a trunk-- so let's imagine as a switch 1.
And we've got a trunk port, let's call it 0/0,
and that goes over to switch 2.
If you've got a trunk that's supporting VLANs 200, 300, 400,
if these guys do a broadcast, if we
have a trunk here between switch 1
and switch 2 that supporting our carrying VLANs 200, 300, 400,
if a device here-- let's call it .50-- does a broadcast, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if a device here-- let's call it .50-- does a broadcast,
that broadcast will not only be seen by the promiscuous port,
because the switch allows it, but it will also
be allowed to go over the trunk.
So the switch basically is in charge
of enforcing the port control based on what ports
conduct other ports on itself.
So you might ask, well, Keith, what
if you have switch 2 over here, and we don't want this VLAN 200
traffic to go over that trunk?
Great, just tell the trunk not to carry VLAN 200,
and that traffic won't be sent over.
Or what we can also do is we could replicate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or what we can also do is we could replicate
our private VLAN configuration over here on switch 2,
and then it can receive those frames from VLAN 200
and know exactly how they're allowed to be forwarded.
And if it was a broadcast from VLAN 200,
it would be forwarded to all the other ports associated
with the VLAN 200 over here on switch 2.
So the ability to extend our private VLANs
exists, but we'd also have to replicate that private VLAN
configuration over on switch 2 if we
want the policy to be enforced.
In this video, we've taken a look at the promiscuous port.
And there's two key takeaways that I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And there's two key takeaways that I
would love you to remember about this video
and the promiscuous port.
Number one, the promiscuous port is associated
with the primary VLAN number.
So in our case, our primary VLAN is VLAN 100,
so a switch virtual interface in our case that we're
going to be using is going to be interface VLAN 100.
So the promiscuous port is going to associated
with the primary VLAN number.
And the second thing I'd love you to take away
from this video is realizing what
traffic flows are allowed inside of a private VLAN architecture.
So you have the primary VLAN, the secondary VLANs, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So you have the primary VLAN, the secondary VLANs, which
ports traffic are allowed to be sent back
and forth between that port, and any of the secondary VLANs,
and the promiscuous port?
And the answer is all of them, everybody.
Any secondary VLAN port, all that traffic
is allowed between that port and the promiscuous port.
Also, in those secondary VLANs the broadcasts
are also to be forwarded to a trunk
if that trunk is supporting their respective secondary
VLAN.
In our case, it was VLANs 200, 300, 400.
If those VLANs are support of trunk,
the trunk would also see those broadcasts, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the trunk would also see those broadcasts,
and tag them, and forward them as normal 802.1 Q tag traffic.
So that's our conversation on promiscuous ports.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.