This morning I had a nice email discussion with a fellow VCI who has attended my online VLAN training. His question had to do with the VLAN IDs that need to be configured at the physical Cisco switch. Do you only need to configure the primary or do you also need to configure the secondary and isolated VLAN IDs?
Hi Eric, when you configure PVLAN, the Switch itself should configured with ONLY the PRIMARY VLAN not the whole range of Primary / secondary… doing so could be a security issue… Could you check at your side that using 23-23 instead of 23-26 at timecode 31:07 in your movie, don't change the behaviour or the communications between VMs?
After applying 23-23 of both port 2 and 3 at the Cisco switch, virtual machines within both the communities cannot connect to the router and to each other. After putting in 23-25, the virtual machines in community 2 (26) could not ping each other and in community 1 (25) can.
I knew I’ve seen it somewhere -> Community and Isolated PVLANs traffic travels tagged as the associated Secondary PVLAN. At the bottom of this KB article.
•Promiscuous PVLANs have the same VLAN ID both for Primary and Secondary VLAN.
•Community and Isolated PVLANs traffic travels tagged as the associated Secondary PVLAN.
•Traffic inside PVLANs is not encapsulated (no Secondary PVLAN encapsulated inside a Primary PVLAN Packet).
•Traffic between virtual machines on the same PVLAN but on different ESX hosts go through the Physical Switch. Therefore, the Physical Switch must be PVLAN aware and configured appropriately, to allow the secondary PVLANs to reach destination.
•Switches discover MAC addresses per VLAN. This can be a problem for PVLANs because each virtual machine appears to the physical switch to be in more than one VLAN, or at least, it appears that there is no reply to the request, because the reply travels back in a different VLAN. For this reason, it is a requirement that each physical switch, where ESX with PVLANs are connected, must be PVLAN aware.
