Private VLANs - across a trunk

When implementing private VLANs, it is possible to span those VLANs to multiple switches using regular trunk links with no specific configurations. However, note that when you configure private VLANs across multiple switches, they are sent just like any other VLANs, but they must be manually configured on both switches, or you must use VTP version 3 which supports private VLANs.

Now it is possible to configure a trunk as a promiscuous trunk. In such a case, whenever a frame from a secondary VLAN is sent out a promiscuous trunk, its VLAN tag will be rewritten with the appropriate primary VLAN ID. This is helpful if you are, for example, doing a Router on a Stick between several primary private VLANs. As the router does not understand that multiple secondary PVLANs actually map to a single particular primary PVLAN ID.

It is also possible to configure a trunk as an isolated trunk. An isolated PVLAN trunk translates the primary PVLAN ID tag into the isolated secondary PVLAN ID that is associated with the primary PVLAN. This is useful if you want to extend the secondary isolated PVLAN onto a switch that does not support PVLANs. Thus, if a frame is coming from a promiscuous host port somewhere in the primary PVLAN and is about to be sent out the isolated PVLAN trunk port, its VLAN tag currently carrying the primary PVLAN ID will be rewritten to the isolated secondary PVLAN ID. If a frame comes in with the isolated secondary PVLAN ID, the tag won't be changed.

In summary:

• A regular trunk sends all PVLAN IDs over the trunk without changing any values.
• A promiscuous trunk port rewrites the secondary PVLAN ID into the primary PVLAN ID upon sending a frame. When a frame is received, no tag manipulation is performed.
• An isolated trunk port rewrites the primary PVLAN ID into the isolated secondary PVLAN ID upon sending a frame. When a frame is received, no tag manipulation is performed.