Private VLAN Trunks :: Pt. 2: The Secondary (isolated) Trunk
Picking up where we left off on the first series, I want to discuss the other trunking option that we have in regards to PVLAN trunks. We might need a quick review on our PVLAN structure before we begin, however:
vlan 100 private-vlan primary private-vlan association 200-201 vlan 200 private-vlan community vlan 201 private-vlan isolated
This second trunk type is actually called the secondary, or isolated trunk. Much like the promiscuous trunk, this one has a pretty specific purpose, and that is to flip the VLAN tag when a frame is traversing a trunk. This time however, rather than removing the secondary VLAN tag, and replacing it with the primary tag, we are going to be doing the opposite! Remember how we were doing it with the promiscuous trunk? What happened here is the node with MAC A ingresses and is placed in VLAN 200. However, when it needs to reach the L3 GW (the router), we have to remove the secondary VLAN tag and replace it with the primary VLAN ID of 100 (so that it will hit the proper sub-interface on the router).
The routers return traffic will naturally be in VLAN 100 based on the sub-interface configuration. But Continue reading