18 Responses

  1. MeOnTheW3
    MeOnTheW3 at |

    Nice Post. Quick, question; what is the limitation of Secondary PVLANs per Primary PVLAN? In otherwords, could I have 8000 “communities” under a single PVLAN thereby surpassing the VLAN limitation of 4096?

  2. MeOnTheW3
    MeOnTheW3 at |

    Thanks Chris; I was hoping to explore using PVLANs as a way to manage IP scope in a data-center with ~10K unique clients all requiring 10-50 10.x.x.x internal IPs sharing a single set of resources (GW, DNS, etc) but isolated from one another… the search continues.

    1. aZ
      aZ at |

      I might be wrong (and late), but you probably could explore using VXLAN, which, I think, might be the best way to solve this.
      But you need VXLAN aware physical switches.

  3. Brian Ragazzi
    Brian Ragazzi at |

    Thanks Chris. Is it necessary for the Primary VLAN to be dedicated to that role or can it be an existing VLAN in the common external network. Also, once the VLANs are defined in vSphere and the upstream switches, how can vShield Edge be configured to act as the gateway and provide DHCP to the secondary network?

  4. VCAP5-DCA: Objective 2.2 « TheSaffaGeek

    […] Wahl has done a brilliant overview of Private VLANS in his blog posting Understanding vSphere Private VLANs For Fun andĀ Profit and also did a brilliant breakdown of the whole objective in the vBrownbag he did which i would […]

  5. Ray
    Ray at |

    Why not just create multiple routing instances vrf and dump your VLANs into that. You can develope a services vrf (DNS, DHCP…etc) and have your firewall allow your other vrf(s) access to your vrf(s). I’ve done it its really simple and work great.

  6. #VDI Tip 75: Use Private VLAN’s For Your Virtual Desktop Subnets

    […] Understanding vSphere Private VLANs For Fun and Profit […]

  7. The world of Marc O'Polo – Blog VCAP5-DCA Objective 2.2 ā€“ Configure and Maintain VLANs, PVLANs and VLAN Settings

    […] Chris Wahl’s blog: Understanding vSphere Private VLANs For Fun and Profit […]

  8. Sk
    Sk at |

    Hi Chris,

    Wonderful post, which a lot of things clear. Although 1 doubt still remains.

    Are the vLAN Ids, configured on Community Secondary Private VLAN, valid vlan Id on the physical switch they finally connect to? Meaning, they are still taken out from the 4096 vlan Ids available to the physical switch or they do not have any validity per se into the physical network and are only known by their primary promiscuous vlan Id?

  9. AaronW
    AaronW at |

    I tested this today on a single ESXi 5.5 cluster, connected across two Cisco 4948E switches and the following is not 100% correct.

    “When you use a Private VLAN with VMs on multiple hosts, you must be aware that your physical switches must also support Private VLANs.”

    If you *just* want PVLANs between ESXi hosts in the same cluster, (same vDS) the switchport configuration towards the ESX servers is a standard trunk, and same with trunks between switches. The “PVLANs” are just regular VLANs on the switch. This is because the vDS is handling the PVLANs properly, as to whether a VM has a vmNIC in the isolated or promiscuous mode or not. Probably not a realistic scenario for many people though, as they will want some sort of non-ESX gateway device.

    We use PVLANs in our backup network, so we can run the same VLAN for all backup clients and prevent them from talking to each other.

  10. TrevorB
    TrevorB at |

    I am in the process of testing for proof of concept a PVLAN implementation. This is to replace an existing design that would exceed the dvPortGroup limit per dvSwitch well before the VMs would exceed the vCPU/vRAM resources within their cluster. Alternate options for this implementation would require dedicating additional pairs of 10Gbe interfaces (and physical switchports) for each new dvSwitch,

  11. Momj
    Momj at |

    we are integrating a service based on pvlan. so we configured our Distrubution-Switch a Cisco Nexus 7706 and our ESXi host to be pvlan aware.
    The port on Nexus is configured as normal trunk carring pvlans and regular vlans.
    I noticed that vms associated to secondary-isolated-vlan are seen on our Nexus 7706 with vlan-id of the primary-vlan-id instead of with secondary-vlan-id.

    Can you help me to resolve this issue so that i see vms in the corresponding secondary-vlan-id? Should i configure the port on Nexus as “private-vlan trunk secondary” carring pvlans – via vlan association – and regular vlans?

    Will be Thxfull for any reply

  12. VLAN tagging and PVLAN’s in vSphere 6 – Virtual Reality

    […] Understanding vSphere Private VLANs […]

  13. Abu Belal
    Abu Belal at |

    Thank you very much for this excellent article. Probably the easy explanation I’ve come across!


Share your point of view!