%BOOK_ENTITIES; ]>

Isolation of guest traffic in shared networks can be achieved by using Private VLANs (PVLAN). PVLANs provide Layer 2 isolation between ports within the same VLAN. In a PVLAN-enabled shared network, a user VM cannot reach other user VM though they can reach the DHCP server and gateway, this would in turn allow users to control traffic within a network and help them deploy multiple applications without communication between application as well as prevent communication with other users’ VMs. Isolate VMs in a shared networks by using Private VLANs. Supported in both VPC and non-VPC deployments. Supported on all hypervisors. Allow end users to deploy VMs in an isolated networks, or a VPC, or a Private VLAN-enabled shared network.

In an Ethernet switch, a VLAN is a broadcast domain where hosts can establish direct communication with each another at Layer 2. Private VLAN is designed as an extension of VLAN standard to add further segmentation of the logical broadcast domain. A regular VLAN is a single broadcast domain, whereas a private VLAN partitions a larger VLAN broadcast domain into smaller sub-domains. A sub-domain is represented by a pair of VLANs: a Primary VLAN and a Secondary VLAN. The original VLAN that is being divided into smaller groups is called Primary, which implies that all VLAN pairs in a private VLAN share the same Primary VLAN. All the secondary VLANs exist only inside the Primary. Each Secondary VLAN has a specific VLAN ID associated to it, which differentiates one sub-domain from another. Three types of ports exist in a private VLAN domain, which essentially determine the behaviour of the participating hosts. Each ports will have its own unique set of rules, which regulate a connected host's ability to communicate with other connected host within the same private VLAN domain. Configure each host that is part of a PVLAN pair can be by using one of these three port designation: Promiscuous: A promiscuous port can communicate with all the interfaces, including the community and isolated host ports that belong to the secondary VLANs. In Promiscuous mode, hosts are connected to promiscuous ports and are able to communicate directly with resources on both primary and secondary VLAN. Routers, DHCP servers, and other trusted devices are typically attached to promiscuous ports. Isolated VLANs: The ports within an isolated VLAN cannot communicate with each other at the layer-2 level. The hosts that are connected to Isolated ports can directly communicate only with the Promiscuous resources. If your customer device needs to have access only to a gateway router, attach it to an isolated port. Community VLANs: The ports within a community VLAN can communicate with each other and with the promiscuous ports, but they cannot communicate with the ports in other communities at the layer-2 level. In a Community mode, direct communication is permitted only with the hosts in the same community and those that are connected to the Primary PVLAN in promiscuous mode. If your customer has two devices that need to be isolated from other customers' devices, but to be able to communicate among themselves, deploy them in community ports. For further reading: Understanding Private VLANs Cisco Systems' Private VLANs: Scalable Security in a Multi-Client Environment Private VLAN (PVLAN) on vNetwork Distributed Switch - Concept Overview (1010691)

Use a PVLAN supported switch. See Private VLAN Catalyst Switch Support Matrixfor more information. All the layer 2 switches, which are PVLAN-aware, are connected to each other, and one of them is connected to a router. All the ports connected to the host would be configured in trunk mode. Open Management VLAN, Primary VLAN (public) and Secondary Isolated VLAN ports. Configure the switch port connected to the router in PVLAN promiscuous trunk mode, which would translate an isolated VLAN to primary VLAN for the PVLAN-unaware router. Note that only Cisco Catalyst 4500 has the PVLAN promiscuous trunk mode to connect both normal VLAN and PVLAN to a PVLAN-unaware switch. For other Catalyst PVLAN support switch, connect the switch to upper switch by using cables. The number of cables should be greater than the number of PVLANs used. If your Catalyst switch supports PVLAN, but not PVLAN promiscuous trunk mode, perform the following: Configure one of the switch port as trunk for management network (management VLAN). For each PVLAN, perform the following: Connect a port of the Catalyst switch to the upper switch. Set the port in the Catalyst Switch in promiscuous mode for one pair of PVLAN. Set the port in the upper switch to access mode, and allow only the traffic of the primary VLAN of the PVLAN pair. Configure private VLAN on your physical switches out-of-band. Open vSwitch (OVS) used by XenServer and KVM does not support PVLAN. Therefore, simulate PVLAN on OVS for XenServer and KVM by modifying the flow table to achieve the following: For every traffic leaving user VMs, tag with the secondary isolated VLAN ID. Change the VLAN ID to primary VLAN ID. This allows the traffic which is tagged with the secondary isolated VLAN ID reach the DHCP server. The gateway is PVLAN-unaware; therefore, the switch connected to the gateway should translate all the secondary VLAN to primary VLAN for communicating with the gateway.

Log in to the CloudPlatform UI as administrator. In the left navigation, choose Infrastructure. On Zones, click View More. Click the zone to which you want to add a guest network. Click the Physical Network tab. Click the physical network you want to work with. On the Guest node of the diagram, click Configure. Click the Network tab. Click Add guest network. The Add guest network window is displayed. Specify the following: Name: Description: VLAN ID: Private VLAN ID: Scope: Network Offering: Gateway: Netmask: IP Range: IPv6 CIDR: Network Domain: Click OK to confirm.