Contents

Introduction· 1

Prerequisites· 1

Example: Configuring port-based VLANs· 1

Network requirements· 1

Software version used· 1

Configuration procedures· 1

Verifying the configuration· 2

Configuration files· 3

Example: Configuring the private VLAN·· 3

Network requirements· 3

Requirements analysis· 4

Software version used· 4

Configuration restrictions and guidelines· 4

Configuration procedures· 4

Configuring Device B· 4

Configuring Device A· 5

Verifying the configuration· 5

Configuration files· 6

Related documentation· 8

 

Introduction

This document provides examples of configuring the port-based VLAN and private VLAN.

Prerequisites

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of H3C VLANs.

 

Example: Configuring port-based VLANs

Network requirements

As shown in Figure 1:

·     Host A and Host C belong to Department A. VLAN 100 is assigned to Department A.

·     Host B and Host D belong to Department B. VLAN 200 is assigned to Department B.

Configure port-based VLANs so that hosts only in the same department can communicate with each other.

Figure 1 Network diagram

 

Software version used

This configuration example was created and verified on S6300-CMW710-R2310.

Configuration procedures

1.     Configure Device A:

# Create VLAN 100, and assign Ten-GigabitEthernet 1/0/1 to VLAN 100.

[DeviceA] vlan 100

[DeviceA-vlan100] port ten-gigabitethernet 1/0/1

[DeviceA-vlan100] quit

# Create VLAN 200, and assign Ten-GigabitEthernet 1/0/2 to VLAN 200.

[DeviceA] vlan 200

[DeviceA-vlan200] port ten-gigabitethernet 1/0/2

[DeviceA-vlan200] quit

# Configure Ten-GigabitEthernet 1/0/3 as a trunk port, and assign it to VLANs 100 and 200.

[DeviceA] interface ten-gigabitethernet 1/0/3

[DeviceA-Ten-GigabitEthernet1/0/3] port link-type trunk

[DeviceA-Ten-GigabitEthernet1/0/3] port trunk permit vlan 100 200

2.     Configure Device B in the same way Device A is configured. (Details not shown.)

3.     Configure hosts:

a.     Configure Host A and Host C to be on the same IP subnet. For example, 192.168.100.0/24.

b.     Configure Host B and Host D to be on the same IP subnet. For example, 192.168.200.0/24.

Verifying the configuration

# Verify that Host A and Host C can ping each other, but they both fail to ping Host B or Host D. (Details not shown.)

# Verify that Host B and Host D can ping each other, but they both fail to ping Host A or Host C. (Details not shown.)

# Display information about VLANs 100 and 200 on Device A.

[DeviceA-Ten-GigabitEthernet1/0/3] display vlan 100

 VLAN ID: 100

 VLAN type: Static

 Route interface: Not configured

 Description: VLAN 0100

 Name: VLAN 0100

 Tagged ports:

    Ten-GigabitEthernet1/0/3

 Untagged ports:

    Ten-GigabitEthernet1/0/1

[DeviceA-Ten-GigabitEthernet1/0/3] display vlan 200

 VLAN ID: 200

 VLAN type: Static

 Route interface: Not configured

 Description: VLAN 0200

 Name: VLAN 0200

 Tagged ports:

    Ten-GigabitEthernet1/0/3

 Untagged ports:

    Ten-GigabitEthernet1/0/2

The output shows that:

·     Ten-GigabitEthernet 1/0/3 and Ten-GigabitEthernet 1/0/1 permit packets from 100 to pass through.

·     Ten-GigabitEthernet 1/0/3 and Ten-GigabitEthernet 1/0/2 permit packets from 200 to pass through.

Configuration files

Configuration files on both Device B and Device A are the same. The following configuration files use Device A as an example.

#

vlan 100

#

vlan 200

#

interface Ten-GigabitEthernet1/0/1

 port access vlan 100

#

interface Ten-GigabitEthernet1/0/2

 port access vlan 200

#

interface Ten-GigabitEthernet1/0/3

 port link-type trunk

 port trunk permit vlan 1 100 200

#

Example: Configuring the private VLAN

Network requirements

As shown in Figure 2:

·     The aggregation-layer device Device A assigns VLAN 10 to Device B. Hosts access the network through VLAN-interface 10.

·     Users connected to Device B are on the same subnet 10.0.0.0/24.

·     Host A and Host B are in the Marketing department. Host C and Host D are in the Finance department.

Configure the private VLAN feature to meet the following requirements:

·     Device A is only aware of the primary VLAN 10.

·     Hosts in the same secondary VLAN are interoperable at Layer 2.

·     Hosts in different secondary VLANs are isolated at Layer 2.

Figure 2 Network diagram

 

Requirements analysis

The private VLAN configuration is required only on Device B.

Software version used

This configuration example was created and verified on S6300-CMW710-R2310.

Configuration restrictions and guidelines

The system default VLAN (VLAN 1) does not support the private VLAN configuration.

Configuration procedures

Configuring Device B

# Create VLAN 10 and configure it as a primary VLAN.

<DeviceB> system-view

[DeviceB] vlan 10

[DeviceB-vlan10] private-vlan primary

[DeviceB-vlan10] quit

# Create VLANs 201 and 202.

[DeviceB] vlan 201 to 202

# Associate primary VLAN 10 with secondary VLANs 201 and 202.

[DeviceB] vlan 10

[DeviceB-vlan10] private-vlan secondary 201 to 202

[DeviceB-vlan10] quit

# Configure the uplink port Ten-GigabitEthernet 1/0/1 as a promiscuous port of VLAN 10.

[DeviceB] interface ten-gigabitethernet 1/0/1

[DeviceB-Ten-GigabitEthernet1/0/1] port private-vlan 10 promiscuous

[DeviceB-Ten-GigabitEthernet1/0/1] quit

# Assign the downlink ports Ten-GigabitEthernet 1/0/2 and Ten-GigabitEthernet 1/0/3 to VLAN 201 as host ports.

[DeviceB] interface range ten-gigabitethernet 1/0/2 to ten-gigabitethernet 1/0/3

[DeviceB-if-range] port access vlan 201

[DeviceB-if-range] port private-vlan host

[DeviceB-if-range] quit

# Assign the downlink ports Ten-GigabitEthernet 1/0/4 and Ten-GigabitEthernet 1/0/5 to VLAN 202 as host ports.

[DeviceB] interface range ten-gigabitethernet 1/0/4 to ten-gigabitethernet 1/0/5

[DeviceB-if-range] port access vlan 202

[DeviceB-if-range] port private-vlan host

[DeviceB-if-range] quit

Configuring Device A

# Create VLAN 10.

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA] quit

# Assign Ten-GigabitEthernet 1/0/1 to VLAN 10.

[DeviceA] interface ten-gigabitethernet 1/0/1

[DeviceA-Ten-GigabitEthernet1/0/1] port access vlan 10

[DeviceA-Ten-GigabitEthernet1/0/1] quit

# Create VLAN-interface 10, and assign IP address 10.0.0.1 to it.

[DeviceA] interface vlan-interface 10

[DeviceA-Vlan-interface10] ip address 10.0.0.1 24

[DeviceA-Vlan-interface10] quit

Verifying the configuration

# Verify that Device A can ping Host A, Host B, Host C, and Host D successfully. (Details not shown.)

# Display the ARP table of Device A.

[DeviceA] display arp

  Type: S-Static   D-Dynamic   O-Openflow   M-Multiport  I-Invalid

IP address      MAC address    VLAN     Interface                 Aging Type

10.0.0.2        d485-64a1-7e4a 10       XGE1/0/1                  19    D

10.0.0.3        7446-a0aa-7774 10       XGE1/0/1                  19    D

10.0.0.4        6805-ca05-39ae 10       XGE1/0/1                  20    D

10.0.0.5        6805-ca05-414e 10       XGE1/0/1                  20    D

# Display the private VLAN configuration on Device B.

[DeviceB] display private-vlan

 Primary VLAN ID: 10

 Secondary VLAN ID: 201-202

 VLAN ID: 10

 VLAN type: Static

 Private VLAN type: Primary

 Route interface: Not configured

 Description: VLAN 0010

 Name: VLAN 0010

 Tagged ports:   None

 Untagged ports:

    Ten-GigabitEthernet1/0/1          Ten-GigabitEthernet1/0/2

    Ten-GigabitEthernet1/0/3          Ten-GigabitEthernet1/0/4

    Ten-GigabitEthernet1/0/5

 VLAN ID: 201

 VLAN type: Static

 Private VLAN type: Secondary

 Route interface: Not configured

 Description: VLAN 0201

 Name: VLAN 0201

 Tagged ports:   None

 Untagged ports:

    Ten-GigabitEthernet1/0/1          Ten-GigabitEthernet1/0/2

    Ten-GigabitEthernet1/0/3

 VLAN ID: 202

 VLAN type: Static

 Private VLAN type: Secondary

 Route interface: Not configured

 Description: VLAN 0202

 Name: VLAN 0202

 Tagged ports:   None

 Untagged ports:

    Ten-GigabitEthernet1/0/1          Ten-GigabitEthernet1/0/4

    Ten-GigabitEthernet1/0/5

The output shows that:

·     The promiscuous port Ten-GigabitEthernet1/0/1 is an untagged member of primary VLAN 10 and secondary VLANs 201 and 202.

·     The host ports Ten-GigabitEthernet 1/0/2 and Ten-GigabitEthernet 1/0/3 are untagged members of secondary VLANs 201.

·     The host ports Ten-GigabitEthernet 1/0/4 and Ten-GigabitEthernet 1/0/5 are untagged members of secondary VLANs 202.

# Verify that Hosts in the same secondary VLAN can ping each other, but they fail to ping hosts in the other secondary VLAN. (Details not shown.)

Configuration files

·     Device B:

#

vlan 1

#

vlan 10

 private-vlan primary

 private-vlan secondary 201 to 202

#

vlan 201 to 202

#

interface Ten-GigabitEthernet1/0/1

 port link-type hybrid

 undo port hybrid vlan 1

 port hybrid vlan 10 201 to 202 untagged

 port hybrid pvid vlan 10

 port private-vlan 10 promiscuous

#

interface Ten-GigabitEthernet1/0/2

 port link-type hybrid

 undo port hybrid vlan 1

 port hybrid vlan 10 201 untagged

 port hybrid pvid vlan 201

 port private-vlan host

#

interface Ten-GigabitEthernet1/0/3

 port link-type hybrid

 undo port hybrid vlan 1

 port hybrid vlan 10 201 untagged

 port hybrid pvid vlan 201

 port private-vlan host

#

interface Ten-GigabitEthernet1/0/4

 port link-type hybrid

 undo port hybrid vlan 1

 port hybrid vlan 10 202 untagged

 port hybrid pvid vlan 202

 port private-vlan host

#

interface Ten-GigabitEthernet1/0/5

 port link-type hybrid

 undo port hybrid vlan 1

 port hybrid vlan 10 202 untagged

 port hybrid pvid vlan 202

 port private-vlan host

#

·     Device A:

#

vlan 1

#

vlan 10

#

interface Vlan-interface10

 ip address 10.0.0.1 255.255.255.0

#

interface Ten-GigabitEthernet1/0/1

 port access vlan 10

#

Related documentation

·     H3C S6300 Switch Series Layer 2—LAN Switching Configuration Guide-Release 23xx

·     H3C S6300 Switch Series Layer 2—LAN Switching Command Reference-Release 23xx