WEBVTT

1
00:00.000 --> 00:00.767 align:middle line:84%


2
00:00.767 --> 00:02.350 align:middle line:90%
It's one thing and
a pretty good thing

3
00:02.350 --> 00:03.880 align:middle line:84%
to configure private VLANs.

4
00:03.880 --> 00:05.320 align:middle line:90%
It's even a better
thing to verify

5
00:05.320 --> 00:07.487 align:middle line:90%
that it's working, which
is exactly what we're going

6
00:07.487 --> 00:09.610 align:middle line:84%
to do in this video right now.

7
00:09.610 --> 00:13.000 align:middle line:90%
So here on the switch, let's
do a show interface status.

8
00:13.000 --> 00:14.200 align:middle line:84%
That's a good one.

9
00:14.200 --> 00:16.600 align:middle line:90%
So show interface status
shows us that we have,

10
00:16.600 --> 00:18.460 align:middle line:90%
for the ports that
we configured,

11
00:18.460 --> 00:20.350 align:middle line:90%
we've got a couple
of VLANs associated

12
00:20.350 --> 00:23.720 align:middle line:90%
with a primary VLAN and the
secondary VLANs respectively.

13
00:23.720 --> 00:24.990 align:middle line:84%
That's a very good sign.

14
00:24.990 --> 00:29.518 align:middle line:90%
Another great command
is show VLAN private,

15
00:29.518 --> 00:31.310 align:middle line:90%
and that's going to
show us our association
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.518 --> 00:31.310 align:middle line:90%
and that's going to
show us our association

16
00:31.310 --> 00:32.890 align:middle line:90%
between primary and
secondary VLANs,

17
00:32.890 --> 00:35.362 align:middle line:90%
also the type of
secondary VLANs,

18
00:35.362 --> 00:36.820 align:middle line:90%
whether it's isolated
or community,

19
00:36.820 --> 00:39.460 align:middle line:90%
and then also the ports
involved with that.

20
00:39.460 --> 00:41.140 align:middle line:90%
If we hit the Up
Arrow key and we

21
00:41.140 --> 00:43.303 align:middle line:90%
added the keyword Type,
that's going to show us

22
00:43.303 --> 00:45.220 align:middle line:90%
very similar information,
but it won't show us

23
00:45.220 --> 00:46.160 align:middle line:84%
the ports involved.

24
00:46.160 --> 00:48.400 align:middle line:90%
So we have VLANs
100, 200, 300 and 400

25
00:48.400 --> 00:51.610 align:middle line:90%
respectively and their
types, primary, community

26
00:51.610 --> 00:53.260 align:middle line:84%
and isolated.

27
00:53.260 --> 00:56.050 align:middle line:90%
Another really great command
is if we took a look at a port.

28
00:56.050 --> 00:58.690 align:middle line:90%
For example, let's take
a look at port gig 0/1.

29
00:58.690 --> 01:02.830 align:middle line:90%
If we did a show
interface gig 0/1,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:58.690 --> 01:02.830 align:middle line:90%
If we did a show
interface gig 0/1,

30
01:02.830 --> 01:05.170 align:middle line:90%
I highlighted it to copy
it and I didn't use it,

31
01:05.170 --> 01:07.540 align:middle line:90%
and then we tag along
the words switch port.

32
01:07.540 --> 01:10.060 align:middle line:90%
That's going to give us good
detail about what's really

33
01:10.060 --> 01:12.580 align:middle line:90%
going on with that
port including how it's

34
01:12.580 --> 01:15.910 align:middle line:90%
administratively configured, how
it's operationally functioning,

35
01:15.910 --> 01:18.910 align:middle line:90%
so private VLAN host,
and then under here,

36
01:18.910 --> 01:21.240 align:middle line:90%
the administrative private
VLAN host association,

37
01:21.240 --> 01:23.740 align:middle line:90%
it shows 100 is
the primary VLAN.

38
01:23.740 --> 01:25.270 align:middle line:90%
That's my title,
by the way, based

39
01:25.270 --> 01:27.250 align:middle line:90%
on the name I gave
that VLAN, and it

40
01:27.250 --> 01:29.020 align:middle line:90%
shows the secondary
VLAN, which is

41
01:29.020 --> 01:31.690 align:middle line:90%
appropriate for
that port gig 0/1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.020 --> 01:31.690 align:middle line:90%
appropriate for
that port gig 0/1.

42
01:31.690 --> 01:36.160 align:middle line:90%
If we did that for a port
in the VLAN 300, it was 1/1,

43
01:36.160 --> 01:39.020 align:middle line:90%
and that shows us the
secondary VLAN of 300.

44
01:39.020 --> 01:41.290 align:middle line:90%
And if would do the
Up Arrow key again,

45
01:41.290 --> 01:44.500 align:middle line:90%
2/1 should be in the
isolated secondary VLAN,

46
01:44.500 --> 01:46.180 align:middle line:84%
which was VLAN 400.

47
01:46.180 --> 01:48.550 align:middle line:90%
So sure enough, so there's
the host association.

48
01:48.550 --> 01:52.420 align:middle line:90%
100 is the primary VLAN and
400 is the isolated VLAN.

49
01:52.420 --> 01:54.930 align:middle line:90%
So besides looking at
the show commands, what's

50
01:54.930 --> 01:57.550 align:middle line:90%
another way we can really verify
that the private VLANs are

51
01:57.550 --> 02:00.460 align:middle line:90%
controlling the traffic
the way we expect them to?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:57.550 --> 02:00.460 align:middle line:90%
controlling the traffic
the way we expect them to?

52
02:00.460 --> 02:03.220 align:middle line:90%
And the answer to that would
be, let's connect some devices

53
02:03.220 --> 02:06.610 align:middle line:90%
to those ports and verify
whether the traffic is allowed

54
02:06.610 --> 02:07.747 align:middle line:84%
or not.

55
02:07.747 --> 02:09.289 align:middle line:90%
So to verify that,
here's what I did.

56
02:09.289 --> 02:12.010 align:middle line:90%
I took the switch that we just
configured and I connected

57
02:12.010 --> 02:13.580 align:middle line:84%
a couple of virtual PCs to it.

58
02:13.580 --> 02:16.300 align:middle line:90%
So this is the
secondary VLAN of 200

59
02:16.300 --> 02:21.160 align:middle line:90%
which we associated gig 0/1
0/2 with, and then 1/1 and 1/2,

60
02:21.160 --> 02:22.820 align:middle line:90%
we did the secondary
VLAN of 300,

61
02:22.820 --> 02:25.480 align:middle line:90%
and those were both
community secondary VLANs.

62
02:25.480 --> 02:27.760 align:middle line:90%
And then this guy,
400, we associated

63
02:27.760 --> 02:31.070 align:middle line:90%
ports 2/1 and 2/2, and
this is an isolated VLAN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:27.760 --> 02:31.070 align:middle line:90%
ports 2/1 and 2/2, and
this is an isolated VLAN.

64
02:31.070 --> 02:33.490 align:middle line:90%
So what should happen
is these devices,

65
02:33.490 --> 02:36.520 align:middle line:90%
we should have connectivity
between here and here

66
02:36.520 --> 02:39.640 align:middle line:90%
and between here and
here, but we should not

67
02:39.640 --> 02:42.760 align:middle line:90%
have any connectivity
between devices

68
02:42.760 --> 02:45.520 align:middle line:90%
that are in the
secondary VLAN of 200

69
02:45.520 --> 02:48.420 align:middle line:90%
and the devices that are in
the secondary VLAN of 300,

70
02:48.420 --> 02:50.440 align:middle line:90%
and then for these
poor saps over here,

71
02:50.440 --> 02:52.790 align:middle line:90%
because this is
the isolated VLAN,

72
02:52.790 --> 02:55.510 align:middle line:90%
that secondary VLAN is not
allowing any communication

73
02:55.510 --> 02:56.680 align:middle line:84%
between each other.

74
02:56.680 --> 02:58.180 align:middle line:90%
Now the good news
is they should all

75
02:58.180 --> 03:01.525 align:middle line:90%
have access to the promiscuous
port, which is our SVI.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:58.180 --> 03:01.525 align:middle line:90%
have access to the promiscuous
port, which is our SVI.

76
03:01.525 --> 03:06.640 align:middle line:90%
So interface VLAN 100, which
is the primary VLAN, that's

77
03:06.640 --> 03:07.900 align:middle line:84%
the interface for it.

78
03:07.900 --> 03:10.510 align:middle line:90%
We associated that interface
with the secondary VLANs

79
03:10.510 --> 03:13.780 align:middle line:90%
of 200, 300, 400, so all these
devices should be able to ping

80
03:13.780 --> 03:17.260 align:middle line:90%
10.100.0.1, which is the IP
address associated with this

81
03:17.260 --> 03:19.300 align:middle line:90%
SVI, the Switch
Virtual Interface,

82
03:19.300 --> 03:22.540 align:middle line:90%
because it is a promiscuous
port associated with the primary

83
03:22.540 --> 03:23.890 align:middle line:84%
VLAN of 100.

84
03:23.890 --> 03:26.282 align:middle line:90%
So also, let me configure
some DHCP services

85
03:26.282 --> 03:28.240 align:middle line:90%
right here so I won't
have to manually hand out

86
03:28.240 --> 03:31.450 align:middle line:90%
IP addresses to these
devices as they come up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:28.240 --> 03:31.450 align:middle line:90%
IP addresses to these
devices as they come up

87
03:31.450 --> 03:33.550 align:middle line:90%
and the multilayer
switch off of this SVI

88
03:33.550 --> 03:34.960 align:middle line:84%
which they all have access to.

89
03:34.960 --> 03:36.730 align:middle line:90%
Because it's a
promiscuous port, we

90
03:36.730 --> 03:39.063 align:middle line:90%
should be able to hand out
IP addresses from this range.

91
03:39.063 --> 03:42.430 align:middle line:84%
It's in 100.0 network via DHCP.

92
03:42.430 --> 03:44.680 align:middle line:90%
So let's do that real quick
to make it a little easier

93
03:44.680 --> 03:46.352 align:middle line:84%
to test, and then we'll test.

94
03:46.352 --> 03:48.435 align:middle line:90%
So here the switch will
go into configuration mode

95
03:48.435 --> 03:51.910 align:middle line:84%
and we'll make a DHCP pool.

96
03:51.910 --> 03:56.590 align:middle line:90%
We'll call our pool, and
then we'll put in a network

97
03:56.590 --> 04:01.217 align:middle line:84%
of 10.100.0.0, the 24-bit mask.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:56.590 --> 04:01.217 align:middle line:84%
of 10.100.0.0, the 24-bit mask.

98
04:01.217 --> 04:02.800 align:middle line:90%
We really don't need
a default gateway

99
04:02.800 --> 04:06.310 align:middle line:90%
because everybody's giving me
that same logical IP subnet.

100
04:06.310 --> 04:08.810 align:middle line:90%
And we'll type in exit, then
we also exclude some addresses.

101
04:08.810 --> 04:16.180 align:middle line:90%
So IP DHCP, excluded address,
and we'll exclude 10.100.0.1

102
04:16.180 --> 04:20.050 align:middle line:84%
all the way through 10.100.0.50.

103
04:20.050 --> 04:23.212 align:middle line:90%
All right, with DHCP services in
place on the multilayer switch,

104
04:23.212 --> 04:23.920 align:middle line:84%
give me a moment.

105
04:23.920 --> 04:27.280 align:middle line:90%
I'll up those virtual PCs
and then we'll go to the CLI

106
04:27.280 --> 04:28.480 align:middle line:84%
for each one of them.

107
04:28.480 --> 04:30.530 align:middle line:84%
All right, so there's 200.1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:28.480 --> 04:30.530 align:middle line:84%
All right, so there's 200.1.

108
04:30.530 --> 04:33.910 align:middle line:90%
That's the first PC and
the secondary VLAN of 200,

109
04:33.910 --> 04:37.640 align:middle line:84%
and there's two IP DHCP.

110
04:37.640 --> 04:41.470 align:middle line:90%
And there we go, discover,
offer, request, acknowledge.

111
04:41.470 --> 04:42.250 align:middle line:84%
Fantastic.

112
04:42.250 --> 04:45.160 align:middle line:90%
I'll repeat that for
the rest here, IP DHCP.

113
04:45.160 --> 04:48.970 align:middle line:90%
These are little virtual PCs as
part of either GNS3 or Eve-NG.

114
04:48.970 --> 04:51.490 align:middle line:90%
I happen to be using
Eve-NG for this lab.

115
04:51.490 --> 04:56.530 align:middle line:90%
And we'll go to 300-2
IP DHCP, and that

116
04:56.530 --> 05:01.970 align:middle line:90%
looks like it's working,
and then we'll to 400-1
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:56.530 --> 05:01.970 align:middle line:90%
looks like it's working,
and then we'll to 400-1

117
05:01.970 --> 05:06.980 align:middle line:90%
And we'll go to 400-2
and just make sure

118
05:06.980 --> 05:09.070 align:middle line:90%
that it's working
across the board.

119
05:09.070 --> 05:10.070 align:middle line:84%
All right, that's great.

120
05:10.070 --> 05:11.070 align:middle line:84%
And let me also do this.

121
05:11.070 --> 05:13.340 align:middle line:90%
I'm going to close my
connection to the switch

122
05:13.340 --> 05:16.670 align:middle line:90%
and bring up an option that
I can send commands to all

123
05:16.670 --> 05:18.350 align:middle line:84%
these devices at the same time.

124
05:18.350 --> 05:20.160 align:middle line:90%
It'll save us a bunch
of time as well.

125
05:20.160 --> 05:21.500 align:middle line:90%
So I'm going to click
on View, and I'm

126
05:21.500 --> 05:22.792 align:middle line:84%
going to go to the Command bar.

127
05:22.792 --> 05:24.510 align:middle line:90%
And this is secure
CRT by the way.

128
05:24.510 --> 05:28.280 align:middle line:90%
I'm going to go and do a
Send Commands to all sessions

129
05:28.280 --> 05:31.123 align:middle line:84%
and let's do a Show IP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
05:28.280 --> 05:31.123 align:middle line:84%
and let's do a Show IP.

130
05:31.123 --> 05:31.790 align:middle line:84%
That'd be great.

131
05:31.790 --> 05:34.248 align:middle line:90%
That way, we can see the IP
addresses on all these devices.

132
05:34.248 --> 05:40.390 align:middle line:90%
So 201 is 51, and then
we have 52, 53, 54.

133
05:40.390 --> 05:42.140 align:middle line:90%
That's because I brought
them up in order.

134
05:42.140 --> 05:44.090 align:middle line:90%
And they just got IP
addresses from DHCP.

135
05:44.090 --> 05:44.810 align:middle line:84%
OK, great.

136
05:44.810 --> 05:47.300 align:middle line:90%
So what should be able to
happen, if we go to 200-1,

137
05:47.300 --> 05:50.160 align:middle line:90%
it should be able to
ping .52 because they

138
05:50.160 --> 05:53.300 align:middle line:90%
are in the same
secondary community VLAN.

139
05:53.300 --> 05:59.790 align:middle line:90%
So if we do a ping to
10.100.0.52, that works,

140
05:59.790 --> 06:02.330 align:middle line:90%
but if we are going to
try to ping like anybody
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
05:59.790 --> 06:02.330 align:middle line:90%
but if we are going to
try to ping like anybody

141
06:02.330 --> 06:05.658 align:middle line:90%
in the secondary community
with a VLAN of 300 or 400,

142
06:05.658 --> 06:06.450 align:middle line:84%
that wouldn't work.

143
06:06.450 --> 06:07.492 align:middle line:84%
So that's good to device.

144
06:07.492 --> 06:08.580 align:middle line:84%
This is 300.

145
06:08.580 --> 06:11.020 align:middle line:84%
Let's try 53 and also 55.

146
06:11.020 --> 06:13.890 align:middle line:84%
Those should both fail.

147
06:13.890 --> 06:16.290 align:middle line:90%
So we'll try to pin
53, and because it's

148
06:16.290 --> 06:18.192 align:middle line:90%
in a different community,
this isn't working.

149
06:18.192 --> 06:19.650 align:middle line:90%
And if we go to
the last one, which

150
06:19.650 --> 06:21.200 align:middle line:84%
is-- what was the address?

151
06:21.200 --> 06:25.730 align:middle line:90%
55, that's device 400-1
in the isolated VLAN,

152
06:25.730 --> 06:27.570 align:middle line:90%
and we try to ping
that, we're not

153
06:27.570 --> 06:31.080 align:middle line:90%
going any success there either
because isolated devices can't
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
06:27.570 --> 06:31.080 align:middle line:90%
going any success there either
because isolated devices can't

154
06:31.080 --> 06:33.510 align:middle line:90%
ping any devices in
other communities.

155
06:33.510 --> 06:37.680 align:middle line:90%
If we went to these two
devices, which is 400-1 400-2,

156
06:37.680 --> 06:40.620 align:middle line:90%
and they are at the IP
addresses of 55 and 56.

157
06:40.620 --> 06:42.670 align:middle line:90%
They won't be able to
ping even each other.

158
06:42.670 --> 06:49.680 align:middle line:90%
So if we go ping 10.100.0.55, so
even though PC 400-1 and 400-2

159
06:49.680 --> 06:52.260 align:middle line:90%
are both in the
same secondary VLAN,

160
06:52.260 --> 06:55.920 align:middle line:90%
because it's a type isolated,
the switch is not allowing any

161
06:55.920 --> 06:59.623 align:middle line:90%
frames of traffic between any of
those ports in that same VLAN.

162
06:59.623 --> 07:02.040 align:middle line:90%
Now what should be allowed to
happen is every one of these
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

162
06:59.623 --> 07:02.040 align:middle line:90%
Now what should be allowed to
happen is every one of these

163
07:02.040 --> 07:06.000 align:middle line:90%
devices should be able to ping
the promiscuous switch virtual

164
07:06.000 --> 07:08.220 align:middle line:90%
interface up on the
multilayer switch,

165
07:08.220 --> 07:11.460 align:middle line:90%
so if we did a
ping to 10.100.0.1,

166
07:11.460 --> 07:15.230 align:middle line:90%
that should be successful
from all of our devices.

167
07:15.230 --> 07:17.640 align:middle line:90%
So if we go back and
look at all of them,

168
07:17.640 --> 07:19.890 align:middle line:90%
the two PCs in the
secondary VLAN of 200,

169
07:19.890 --> 07:21.480 align:middle line:84%
they both had success.

170
07:21.480 --> 07:24.810 align:middle line:90%
The two pieces, and the
secondary VLAN of 300,

171
07:24.810 --> 07:29.430 align:middle line:90%
they both had success, and the
two PCs in the isolated VLAN,

172
07:29.430 --> 07:30.870 align:middle line:84%
they also had success.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

172
07:29.430 --> 07:30.870 align:middle line:84%
they also had success.

173
07:30.870 --> 07:33.750 align:middle line:90%
And the reason all these devices
and all these secondary VLANs

174
07:33.750 --> 07:36.630 align:middle line:90%
can ping that SVI, that Switch
Virtual Interface address,

175
07:36.630 --> 07:40.290 align:middle line:90%
is because that switch virtual
interface is associated

176
07:40.290 --> 07:42.930 align:middle line:90%
with the primary
VLAN and it was told

177
07:42.930 --> 07:46.060 align:middle line:90%
about these secondary VLANs it
was able to communicate with.

178
07:46.060 --> 07:48.540 align:middle line:90%
So effectively, it's a
promiscuous type of port

179
07:48.540 --> 07:51.780 align:middle line:90%
or interface on the multilayer
switch that all those devices

180
07:51.780 --> 07:54.420 align:middle line:90%
could then use as a default
gateway if they needed forward

181
07:54.420 --> 07:58.140 align:middle line:90%
packets off of the
local 10.100.0 subnet.

182
07:58.140 --> 08:00.030 align:middle line:90%
I'd also like to
discuss with you further
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

182
07:58.140 --> 08:00.030 align:middle line:90%
I'd also like to
discuss with you further

183
08:00.030 --> 08:03.720 align:middle line:90%
about how VLAN tagging is
used if we have private VLANs

184
08:03.720 --> 08:05.820 align:middle line:90%
and yet we have a trunk
that goes from our switch

185
08:05.820 --> 08:06.992 align:middle line:84%
to yet another switch.

186
08:06.992 --> 08:08.950 align:middle line:90%
Let me walk you through
that in the next video.

187
08:08.950 --> 08:11.400 align:middle line:90%
Meanwhile, I hope this has
been informative for you

188
08:11.400 --> 08:15.110 align:middle line:90%
and I'd like to thank
you for viewing.