Private VLANs, protected ports and VLAN ACLs: isolating hosts inside one subnet

The problem: neighbours in one subnet

A VLAN is one broadcast domain, and devices inside it talk to each other directly through the switch. That is usually what you want, but not always. Guests in a hotel, tenants in a shared office or servers in a hosting DMZ all need to reach the gateway, yet have no reason to reach each other. Giving each one its own VLAN and subnet wastes addresses and creates a lot of configuration. The features below isolate devices while they stay in one subnet.

Private VLANs

A private VLAN (PVLAN) divides a primary VLAN into secondary VLANs. All of them share the primary VLAN's IP subnet.

• Isolated secondary VLAN: hosts can only talk to promiscuous ports, never to each other. There is one isolated VLAN per primary.
• Community secondary VLAN: hosts can talk to each other and to promiscuous ports, but not to other communities or isolated hosts. You can have several.
• Promiscuous port: usually the router, firewall or SVI. It can talk to every port in the primary VLAN.

vtp mode transparent
vlan 101
 private-vlan isolated
vlan 102
 private-vlan community
vlan 100
 private-vlan primary
 private-vlan association 101,102
interface GigabitEthernet1/0/5
 switchport mode private-vlan host
 switchport private-vlan host-association 100 101
interface GigabitEthernet1/0/48
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 100 101,102
interface Vlan100
 ip address 10.50.0.1 255.255.255.0
 private-vlan mapping 101,102

With VTP versions 1 and 2 the switch must be in transparent mode; VTP version 3 can carry private VLANs. Check with show vlan private-vlan. Across several switches, the private VLANs are carried on normal trunks, and each switch must know the same associations.

Protected ports

A protected port is a lightweight alternative. Traffic cannot pass directly between two protected ports on the same switch; it can only go to unprotected ports such as the uplink. The feature only works within one switch, and a protected port on one switch can still talk to a protected port on another.

interface range GigabitEthernet1/0/1 - 40
 switchport protected

It suits a single-switch guest area or a set of kiosks where you do not want the complexity of private VLANs.

VLAN ACLs (VACLs)

A router ACL only sees traffic that is routed in or out of an interface. Traffic between two hosts in the same VLAN never reaches it. A VLAN access map (VACL) is applied to the whole VLAN, so it filters every frame that enters the VLAN, whether it is bridged or routed.

ip access-list extended BLOCK-SMB
 permit tcp any any eq 445
vlan access-map GUEST-FILTER 10
 match ip address BLOCK-SMB
 action drop
vlan access-map GUEST-FILTER 20
 action forward
vlan filter GUEST-FILTER vlan-list 30

Note the logic: the ACL selects traffic, and the access map's action decides what happens. Without a final entry that forwards everything else, all other traffic is dropped. A common surprise is that a VACL matching a MAC access list does not filter IP packets: on Catalyst switches MAC ACLs only apply to non-IP frames, so to filter IP traffic you must match an IP ACL.

Real-world example: a co-working space

A co-working building gives forty small businesses wired desks on one floor. The network team puts every desk port in the isolated VLAN of a private VLAN, with the firewall as the promiscuous port, so no tenant can browse another's laptops or printers. Two firms that share an office suite are placed together in a community VLAN so their printers keep working. A VACL on the same VLAN drops file-sharing ports as an extra safety net. Everyone shares one /23 subnet, which keeps DHCP and firewall rules simple. For broader segmentation ideas, see zero trust and segmentation.