WEBVTT

1
00:00.000 --> 00:00.750 align:middle line:84%


2
00:00.750 --> 00:02.730 align:middle line:90%
In this video, I'm
excited to chat with you

3
00:02.730 --> 00:05.700 align:middle line:90%
about a special type
of port or interface

4
00:05.700 --> 00:09.510 align:middle line:90%
inside a private VLANs that's
willing to talk to just

5
00:09.510 --> 00:11.460 align:middle line:84%
anybody, no restrictions.

6
00:11.460 --> 00:13.770 align:middle line:84%
It's called a promiscuous port.

7
00:13.770 --> 00:16.140 align:middle line:90%
So to understand the importance
of a promiscuous port,

8
00:16.140 --> 00:17.940 align:middle line:90%
let's just review our
topology real quick.

9
00:17.940 --> 00:21.270 align:middle line:90%
So logically, we're
going to create VLAN 100.

10
00:21.270 --> 00:24.450 align:middle line:90%
It's going to be a primary
VLAN as part of private VLANs.

11
00:24.450 --> 00:26.820 align:middle line:90%
The address space we're
going to use everywhere,

12
00:26.820 --> 00:29.100 align:middle line:90%
on the primary VLANs
and all the secondaries,

13
00:29.100 --> 00:33.150 align:middle line:90%
is one logical layer 3 network
address space of 10.100.0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.100 --> 00:33.150 align:middle line:90%
is one logical layer 3 network
address space of 10.100.0.

14
00:33.150 --> 00:36.960 align:middle line:90%
And then, we've created
three secondary VLANs,

15
00:36.960 --> 00:40.860 align:middle line:90%
two that are type community,
and one that is type isolated.

16
00:40.860 --> 00:43.150 align:middle line:90%
And what we need is we need
to allow these devices.

17
00:43.150 --> 00:45.990 align:middle line:90%
Let's say this is a PC
that's a server, that's

18
00:45.990 --> 00:47.670 align:middle line:90%
the internet of
things device here.

19
00:47.670 --> 00:50.490 align:middle line:90%
We need to all those devices
to have a default gateway if we

20
00:50.490 --> 00:53.100 align:middle line:90%
ever want them to communicate
outside of the 10.100 address

21
00:53.100 --> 00:53.890 align:middle line:84%
space.

22
00:53.890 --> 00:56.310 align:middle line:90%
And so what we can do is we
can have a layer 3 interface.

23
00:56.310 --> 00:57.870 align:middle line:90%
You can also do
this with layer 2.

24
00:57.870 --> 00:59.520 align:middle line:90%
But in the case of
a multilayer switch,

25
00:59.520 --> 01:02.940 align:middle line:90%
we could have a switched
virtual interface for this VLAN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.520 --> 01:02.940 align:middle line:90%
we could have a switched
virtual interface for this VLAN

26
01:02.940 --> 01:05.310 align:middle line:90%
100, the primary
VLAN, and we could

27
01:05.310 --> 01:07.430 align:middle line:84%
specify that is promiscuous.

28
01:07.430 --> 01:10.590 align:middle line:90%
The promiscuous port, from
the private VLAN perspective,

29
01:10.590 --> 01:12.985 align:middle line:90%
is a port associated
with the primary VLAN--

30
01:12.985 --> 01:14.735 align:middle line:90%
so if this was a switch
virtual interface,

31
01:14.735 --> 01:17.640 align:middle line:90%
it would be like
interface VLAN 100.

32
01:17.640 --> 01:19.260 align:middle line:84%
It would have an IP address.

33
01:19.260 --> 01:22.020 align:middle line:90%
And we would specify that
it is a promiscuous port.

34
01:22.020 --> 01:23.940 align:middle line:90%
And a promiscuous
port is allowed

35
01:23.940 --> 01:26.230 align:middle line:84%
to communicate with everybody.

36
01:26.230 --> 01:27.700 align:middle line:84%
So I'm going to draw lines here.

37
01:27.700 --> 01:30.720 align:middle line:90%
So that port, that port,
everybody in VLAN 200
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:27.700 --> 01:30.720 align:middle line:90%
So that port, that port,
everybody in VLAN 200

38
01:30.720 --> 01:32.880 align:middle line:90%
could communicate with
the promiscuous port.

39
01:32.880 --> 01:35.833 align:middle line:90%
And VLAN 300, everybody
in that secondary VLAN

40
01:35.833 --> 01:37.500 align:middle line:90%
can communicate with
a promiscuous port.

41
01:37.500 --> 01:40.890 align:middle line:90%
And even these guys over
here, the isolated ports

42
01:40.890 --> 01:43.020 align:middle line:90%
and the isolated
VLAN, they can also

43
01:43.020 --> 01:45.240 align:middle line:90%
talk with the promiscuous
port, and that's

44
01:45.240 --> 01:47.640 align:middle line:90%
because they do need a
default gateway if they ever

45
01:47.640 --> 01:50.890 align:middle line:90%
hope to forward traffic
off of their local subnet.

46
01:50.890 --> 01:52.230 align:middle line:84%
So let's do a little "what if."

47
01:52.230 --> 01:53.970 align:middle line:90%
Let's imagine this
promiscuous port,

48
01:53.970 --> 01:56.430 align:middle line:90%
a switch virtual interface
on this multilayer switch was

49
01:56.430 --> 01:59.200 align:middle line:84%
at 10.100.0.1.

50
01:59.200 --> 02:00.360 align:middle line:84%
We'll call it .1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:59.200 --> 02:00.360 align:middle line:84%
We'll call it .1.

51
02:00.360 --> 02:06.630 align:middle line:90%
And let's go to use .50,
and .60, and .70 over here.

52
02:06.630 --> 02:08.759 align:middle line:90%
What we would do is
configure all these devices

53
02:08.759 --> 02:12.000 align:middle line:90%
that are connected to our
private VLAN regardless

54
02:12.000 --> 02:13.680 align:middle line:90%
of the secondary
VLAN that they're in.

55
02:13.680 --> 02:15.763 align:middle line:90%
We would configure them
to use the default gateway

56
02:15.763 --> 02:17.910 align:middle line:84%
of 10.100.0.1.

57
02:17.910 --> 02:20.010 align:middle line:90%
And because it's a
promiscuous port,

58
02:20.010 --> 02:22.468 align:middle line:90%
this guy right
here, in VLAN 200,

59
02:22.468 --> 02:24.510 align:middle line:90%
would be allowed to
communicate, and frames could

60
02:24.510 --> 02:26.370 align:middle line:84%
be forwarded to that port.

61
02:26.370 --> 02:29.820 align:middle line:90%
Also, frames would be
sent between that device

62
02:29.820 --> 02:32.090 align:middle line:90%
and any other device in
that same community VLAN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:29.820 --> 02:32.090 align:middle line:90%
and any other device in
that same community VLAN.

63
02:32.090 --> 02:35.460 align:middle line:90%
The same is true for
VLAN 300, which is also

64
02:35.460 --> 02:37.530 align:middle line:84%
a community VLAN for VLAN 300.

65
02:37.530 --> 02:40.050 align:middle line:90%
So these devices can
all communicate here.

66
02:40.050 --> 02:42.960 align:middle line:90%
And they can also communicate
with the default gateway

67
02:42.960 --> 02:45.240 align:middle line:90%
if that default
gateway is configured

68
02:45.240 --> 02:46.620 align:middle line:84%
as a promiscuous port.

69
02:46.620 --> 02:48.150 align:middle line:90%
And again, the
promiscuous port is

70
02:48.150 --> 02:50.730 align:middle line:90%
going to be associated
with the primary VLAN.

71
02:50.730 --> 02:52.980 align:middle line:90%
You're not going to want to
put-- in fact, if you try,

72
02:52.980 --> 02:53.820 align:middle line:84%
it won't work.

73
02:53.820 --> 02:57.000 align:middle line:90%
You won't want to put a
promiscuous port associated

74
02:57.000 --> 02:59.310 align:middle line:90%
with a secondary
VLAN of any type,

75
02:59.310 --> 03:00.657 align:middle line:84%
because it just won't work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:59.310 --> 03:00.657 align:middle line:84%
because it just won't work.

76
03:00.657 --> 03:02.490 align:middle line:90%
So the promiscuous port
has to be associated

77
03:02.490 --> 03:03.407 align:middle line:84%
with the primary VLAN.

78
03:03.407 --> 03:07.620 align:middle line:90%
So if this is VLAN 100, this
could be interface VLAN 100

79
03:07.620 --> 03:10.050 align:middle line:90%
given an IP address
associated VLAN 100,

80
03:10.050 --> 03:13.710 align:middle line:90%
and you'd also specify
the secondary VLANs it's

81
03:13.710 --> 03:15.360 align:middle line:84%
willing to communicate with.

82
03:15.360 --> 03:18.690 align:middle line:90%
And then for the isolated
VLAN, the devices there

83
03:18.690 --> 03:21.690 align:middle line:90%
could all communicate
with the promiscuous port,

84
03:21.690 --> 03:23.700 align:middle line:90%
but they would not be
able to communicate

85
03:23.700 --> 03:26.340 align:middle line:90%
with any other ports
in the private VLAN.

86
03:26.340 --> 03:29.070 align:middle line:90%
So they couldn't communicate
with other people in 400.

87
03:29.070 --> 03:31.237 align:middle line:90%
And they certainly couldn't
communicate with anybody
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:29.070 --> 03:31.237 align:middle line:90%
And they certainly couldn't
communicate with anybody

88
03:31.237 --> 03:34.500 align:middle line:90%
in 300 or 200, because the type
of secondary VLAN that they're

89
03:34.500 --> 03:36.500 align:middle line:84%
in is isolated.

90
03:36.500 --> 03:38.250 align:middle line:90%
Now, the other thing
I'd like to point out

91
03:38.250 --> 03:41.970 align:middle line:90%
is that if you have a trunk--
so let's imagine as a switch 1.

92
03:41.970 --> 03:44.266 align:middle line:90%
And we've got a trunk
port, let's call it 0/0,

93
03:44.266 --> 03:46.530 align:middle line:84%
and that goes over to switch 2.

94
03:46.530 --> 03:50.460 align:middle line:90%
If you've got a trunk that's
supporting VLANs 200, 300, 400,

95
03:50.460 --> 03:53.100 align:middle line:90%
if these guys do
a broadcast, if we

96
03:53.100 --> 03:54.840 align:middle line:90%
have a trunk here
between switch 1

97
03:54.840 --> 03:58.680 align:middle line:90%
and switch 2 that supporting our
carrying VLANs 200, 300, 400,

98
03:58.680 --> 04:02.490 align:middle line:90%
if a device here-- let's call
it .50-- does a broadcast,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:58.680 --> 04:02.490 align:middle line:90%
if a device here-- let's call
it .50-- does a broadcast,

99
04:02.490 --> 04:05.880 align:middle line:90%
that broadcast will not only be
seen by the promiscuous port,

100
04:05.880 --> 04:07.830 align:middle line:90%
because the switch allows
it, but it will also

101
04:07.830 --> 04:09.660 align:middle line:84%
be allowed to go over the trunk.

102
04:09.660 --> 04:11.190 align:middle line:90%
So the switch
basically is in charge

103
04:11.190 --> 04:14.190 align:middle line:90%
of enforcing the port
control based on what ports

104
04:14.190 --> 04:16.422 align:middle line:84%
conduct other ports on itself.

105
04:16.422 --> 04:17.880 align:middle line:90%
So you might ask,
well, Keith, what

106
04:17.880 --> 04:21.870 align:middle line:90%
if you have switch 2 over here,
and we don't want this VLAN 200

107
04:21.870 --> 04:23.640 align:middle line:84%
traffic to go over that trunk?

108
04:23.640 --> 04:26.220 align:middle line:90%
Great, just tell the trunk
not to carry VLAN 200,

109
04:26.220 --> 04:27.720 align:middle line:90%
and that traffic
won't be sent over.

110
04:27.720 --> 04:30.450 align:middle line:90%
Or what we can also do
is we could replicate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
04:27.720 --> 04:30.450 align:middle line:90%
Or what we can also do
is we could replicate

111
04:30.450 --> 04:33.480 align:middle line:90%
our private VLAN configuration
over here on switch 2,

112
04:33.480 --> 04:36.000 align:middle line:90%
and then it can receive
those frames from VLAN 200

113
04:36.000 --> 04:38.400 align:middle line:90%
and know exactly how they're
allowed to be forwarded.

114
04:38.400 --> 04:40.870 align:middle line:90%
And if it was a
broadcast from VLAN 200,

115
04:40.870 --> 04:43.680 align:middle line:90%
it would be forwarded to all
the other ports associated

116
04:43.680 --> 04:46.450 align:middle line:90%
with the VLAN 200
over here on switch 2.

117
04:46.450 --> 04:48.900 align:middle line:90%
So the ability to
extend our private VLANs

118
04:48.900 --> 04:52.140 align:middle line:90%
exists, but we'd also have to
replicate that private VLAN

119
04:52.140 --> 04:54.480 align:middle line:90%
configuration over
on switch 2 if we

120
04:54.480 --> 04:56.160 align:middle line:84%
want the policy to be enforced.

121
04:56.160 --> 04:59.130 align:middle line:90%
In this video, we've taken a
look at the promiscuous port.

122
04:59.130 --> 05:01.358 align:middle line:90%
And there's two key
takeaways that I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:59.130 --> 05:01.358 align:middle line:90%
And there's two key
takeaways that I

123
05:01.358 --> 05:03.150 align:middle line:90%
would love you to
remember about this video

124
05:03.150 --> 05:04.192 align:middle line:84%
and the promiscuous port.

125
05:04.192 --> 05:06.960 align:middle line:90%
Number one, the promiscuous
port is associated

126
05:06.960 --> 05:08.740 align:middle line:84%
with the primary VLAN number.

127
05:08.740 --> 05:12.090 align:middle line:90%
So in our case, our
primary VLAN is VLAN 100,

128
05:12.090 --> 05:14.280 align:middle line:90%
so a switch virtual interface
in our case that we're

129
05:14.280 --> 05:17.130 align:middle line:90%
going to be using is going
to be interface VLAN 100.

130
05:17.130 --> 05:19.140 align:middle line:90%
So the promiscuous port
is going to associated

131
05:19.140 --> 05:20.583 align:middle line:84%
with the primary VLAN number.

132
05:20.583 --> 05:22.500 align:middle line:90%
And the second thing I'd
love you to take away

133
05:22.500 --> 05:24.660 align:middle line:90%
from this video
is realizing what

134
05:24.660 --> 05:28.070 align:middle line:90%
traffic flows are allowed inside
of a private VLAN architecture.

135
05:28.070 --> 05:30.780 align:middle line:90%
So you have the primary VLAN,
the secondary VLANs, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
05:28.070 --> 05:30.780 align:middle line:90%
So you have the primary VLAN,
the secondary VLANs, which

136
05:30.780 --> 05:33.240 align:middle line:90%
ports traffic are
allowed to be sent back

137
05:33.240 --> 05:36.578 align:middle line:90%
and forth between that port,
and any of the secondary VLANs,

138
05:36.578 --> 05:37.620 align:middle line:84%
and the promiscuous port?

139
05:37.620 --> 05:40.980 align:middle line:90%
And the answer is all
of them, everybody.

140
05:40.980 --> 05:43.290 align:middle line:90%
Any secondary VLAN
port, all that traffic

141
05:43.290 --> 05:46.260 align:middle line:90%
is allowed between that port
and the promiscuous port.

142
05:46.260 --> 05:49.380 align:middle line:90%
Also, in those secondary
VLANs the broadcasts

143
05:49.380 --> 05:51.240 align:middle line:90%
are also to be
forwarded to a trunk

144
05:51.240 --> 05:53.980 align:middle line:90%
if that trunk is supporting
their respective secondary

145
05:53.980 --> 05:54.480 align:middle line:84%
VLAN.

146
05:54.480 --> 05:57.210 align:middle line:90%
In our case, it was
VLANs 200, 300, 400.

147
05:57.210 --> 05:59.310 align:middle line:90%
If those VLANs are
support of trunk,

148
05:59.310 --> 06:01.080 align:middle line:90%
the trunk would also
see those broadcasts,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
05:59.310 --> 06:01.080 align:middle line:90%
the trunk would also
see those broadcasts,

149
06:01.080 --> 06:05.580 align:middle line:90%
and tag them, and forward them
as normal 802.1 Q tag traffic.

150
06:05.580 --> 06:07.688 align:middle line:90%
So that's our conversation
on promiscuous ports.

151
06:07.688 --> 06:08.980 align:middle line:84%
I'll see you in the next video.

152
06:08.980 --> 06:11.370 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

153
06:11.370 --> 06:14.570 align:middle line:90%
And I'd like to thank
you for viewing.