This topology uses Private VLANs (PVLANs) to solve the residential isolation problem, alongside conventional VLANs for corporate staff and a centralized DHCP server. Everything is wired up through a two-tier switching hierarchy with a routed gateway to the internet.
Imagine a residential building where each flat gets internet through a shared switch. You could give every flat its own VLAN, but that is not scalable. A 50-flat building means 50 VLANs, 50 SVI interfaces on the core switch, 50 DHCP pools. Management becomes a nightmare fast.
Private VLANs solve this. One primary VLAN handles the addressing and routing. Isolated secondary VLANs under it prevent any lateral communication between tenants — at the access switch level. The hosts never know their neighbors exist. They can only talk upward to the promiscuous port (the core switch SVI), which routes their traffic out.
The corporate segment is a straightforward separate VLAN. DHCP is centralized.
Cisco router is configured as a DHCP/DNS server, sitting in its own network, serving scopes for both the residential block and the corporate floor via DHCP relay.
Below is the topology:
| VLAN | Type | Name | Subnet | Purpose |
|---|---|---|---|---|
| 20 | Primary PVLAN | RESIDENTIAL | 192.168.20.0/25 | Residential block addressing |
| 200 | Isolated PVLAN | FLAT-ISO | 192.168.20.0/25 | Per-flat tenant isolation |
| 201 | Community PVLAN | RESIDENTIAL | 192.168.20.0/25 | Residential block Lobby |
| 10 | Standard VLAN | CORPORATE | 192.168.10.0/24 | Corporate LAN |
| - | Firewall | Firewall | 10.0.0.6/32 | ZBF/PAT/Static NAT |
| - | Services BLK | DHCP/DNS | 192.168.30.0/24 | DHCP/DNS, DNS fowarding, NTP |
Note on PVLAN addressing: Isolated/community ports in VLAN 200 still use the 192.168.20.0/26 address space. The PVLAN relationship maps VLAN 200/201 traffic up to primary VLAN 20, so the SVI on CORE-SW only needs one IP for the entire residential block —
192.168.20.0/26.
PVLANs introduce a two-level VLAN hierarchy:
- Primary VLAN (20): The parent. Defines the IP subnet and carries traffic to/from the promiscuous port (the uplink to CORE-SW).
- Isolated VLAN (200): A secondary VLAN under VLAN 20. Ports in this VLAN can communicate with promiscuous ports only — never with each other, even within the same secondary VLAN.
- Community VLAN (201): Ports in this VLAN can communicate with each other and promiscuous ports only — never with Isolated ports.
In this topology:
- HSE-1 and HSE-2 connect to BLK-A-SW on isolated ports in VLAN 200. This means the two home routers are completely blind to each other at Layer 2.
- BLK-A-SW's uplink to CORE-SW is a promiscuous trunk. The core switch sees both VLAN 20 and the PVLAN mapping, which allows it to route residential traffic while still enforcing the isolation policy.
- CORE-SW has a promiscuous SVI on VLAN 10 (
interface Vlan20). This is the gateway destination isolated ports and Community ports can reach directly out the internet.
PC1 connects to Corp-SW on standard access ports in VLAN 10. This segment (192.168.10.0/24) is fully standard — no PVLAN complexity needed here since corporate staff are expected to collaborate and share resources normally.
Inter-VLAN communication from VLAN 10, VLAN 20 to host 10.0.0.6 (the server) is permitted and routed by the core switch SVI.
CORE-SW is a Layer 3 switch and does all the heavy lifting:
- Terminates SVIs for VLAN 10, and 20 — acting as the default gateway for each segment
- DHCP relay —
ip helper-addresson each SVI forwards DHCP broadcasts to the server 10.0.0.6 - Dynamic routing — OSPF is used as the dynamic routing protocol.
The gateway handles NAT (overload/PAT) for all RFC 1918 (private address) traffic going to the internet.
- One interface toward CORE-SW (LAN-facing NAT inside)
- One interface toward the internet (WAN-facing NAT Outside)
- Acts as a zone based firewall for LAN traffic between the LAN and the Internet and DNS/NTP/ICMP traffic between the DNS server and the Internet.
!
vlan 20
name RESIDENTIAL-VLAN
private-vlan primary
private-vlan association 200-201
!
vlan 200
private-vlan isolated
!
vlan 201
private-vlan community
!
!
policy-map Network-Access-Policy
class class-default
police cir 1000000 conform-action transmit exceed-action drop
!
!
interface Ethernet0/0
switchport private-vlan host-association 20 200
switchport mode private-vlan host
spanning-tree portfast edge
spanning-tree bpduguard enable
service-policy input Network-Access-Policy
service-policy output Network-Access-Policy
!
interface Ethernet0/1
switchport private-vlan host-association 20 200
switchport mode private-vlan host
spanning-tree portfast edge
spanning-tree bpduguard enable
service-policy input Network-Access-Policy
service-policy output Network-Access-Policy
!
interface Ethernet3/0
switchport private-vlan host-association 20 201
switchport mode private-vlan host
service-policy input Network-Access-Policy
service-policy output Network-Access-Policy
!
interface Ethernet3/1
switchport private-vlan host-association 20 201
switchport mode private-vlan host
service-policy input Network-Access-Policy
service-policy output Network-Access-Policy
!
interface Ethernet3/2
shutdown
!
interface Ethernet3/3
switchport private-vlan mapping 20 200-201
switchport mode private-vlan promiscuous
Important: PVLAN configuration requires VTP to be in Transparent mode on all switches participating in the private VLAN — VTP will not propagate PVLAN config correctly in Server/Client mode.
! Set VTP to transparent on all PVLAN switches
vtp mode transparent
!
vlan 20
name RESIDENTIAL-VLAN
private-vlan primary
private-vlan association 200-201
!
vlan 200
private-vlan isolated
!
vlan 201
private-vlan community
!
!
interface Port-channel1
switchport trunk allowed vlan 10
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Ethernet0/0
switchport trunk allowed vlan 10
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
!
interface Ethernet0/1
switchport trunk allowed vlan 10
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
!
interface Ethernet2/0
description LINK TO RESIDENTIAL BLOCK ONLY!
switchport private-vlan mapping 20 200,201
switchport mode private-vlan promiscuous
!
interface Ethernet3/2
no switchport
ip address 10.0.0.5 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
!
interface Ethernet3/3
no switchport
ip address 10.0.0.1 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
!
interface Vlan10
description CORPORATE VLAN SVI
ip address 192.168.10.1 255.255.255.0
ip helper-address 10.0.0.6
ip ospf 1 area 0
!
interface Vlan20
description RESIDENTIAL VLAN SVI
ip address 192.168.20.1 255.255.255.192
ip helper-address 10.0.0.6
ip ospf 1 area 20
!
router ospf 1
router-id 1.1.1.1
auto-cost reference-bandwidth 100000
passive-interface Vlan10
passive-interface Vlan20
passive-interface Ethernet3/2
!
Perimeter-Firewall # config router ospf
Perimeter-Firewall (ospf) # show
config router ospf
set auto-cost-ref-bandwidth 100000
set default-information-originate enable
set router-id 2.2.2.2
config area
edit 0.0.0.0
next
end
config ospf-interface
edit "LAN-Link"
set interface "port1"
set network-type point-to-point
next
end
config network
edit 1
set prefix 10.0.0.0 255.255.255.252
next
end
set passive-interface "port2"
config redistribute "connected"
end
config redistribute "static"
end
class-map type inspect match-all Inside-Outside-class
match access-group name Inside-Outside-acl
class-map type inspect match-all Outside-Inside-class
match access-group name Outside-Inside-acl
!
policy-map type inspect Outside-Inside-Policy
class type inspect Outside-Inside-class
inspect
class class-default
drop
policy-map type inspect Inside-Outside-Policy
class type inspect Inside-Outside-class
inspect
class class-default
drop
!
zone security Inside
zone security Outside
zone-pair security Outside-Inside-Zone source Outside destination Inside
service-policy type inspect Outside-Inside-Policy
zone-pair security Inside-Outside-Zone source Inside destination Outside
service-policy type inspect Inside-Outside-Policy
!
!
interface Ethernet0/0
ip address 192.168.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
zone-member security Inside
duplex auto
!
interface Ethernet0/3
ip address 10.0.0.6 255.255.255.252
ip nat outside
ip virtual-reassembly in
zone-member security Outside
ip ospf network point-to-point
ip ospf 1 area 0
duplex auto
!
router ospf 1
router-id 4.4.4.4
auto-cost reference-bandwidth 100000
!
ip nat inside source list Inside-Outside-acl interface Ethernet0/3 overload
ip nat inside source static udp 192.168.30.100 53 10.0.0.6 53 extendable
ip nat inside source static udp 192.168.30.100 67 10.0.0.6 67 extendable
ip nat inside source static udp 192.168.30.100 123 10.0.0.6 123 extendable
!
ip access-list extended Inside-Outside-acl
permit udp host 192.168.30.100 any eq domain
permit udp host 192.168.30.100 any eq ntp
ip access-list extended Outside-Inside-acl
permit udp any host 192.168.30.100 eq bootps
permit udp any host 192.168.30.100 eq domain
permit udp any host 192.168.30.100 eq ntp
ip dhcp excluded-address 192.168.20.1 192.168.20.4
ip dhcp excluded-address 192.168.10.1 192.168.10.10
!
ip dhcp pool RESIDENTIAL-DHCP-POOL
network 192.168.20.0 255.255.255.128
default-router 192.168.20.1
dns-server 10.0.0.6
domain-name munia.local
lease 0 3
ip dhcp pool CORPORATE-DHCP-POOL
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 10.0.0.6
domain-name munia.local
lease 0 3
!
!
!
ip domain name munia.local
ip host core.munia.local 192.168.10.1
ip host firewall.munia.local 10.0.0.2
ip host corpsw.munia.local 192.168.10.10
ip name-server 8.8.8.8
ip name-server 8.8.4.4
!
!
interface Ethernet0/0
ip address 192.168.30.100
no ip route-cache
duplex auto
!
ip default-gateway 192.168.30.1
!
ip dns server
From PC5
PC5> show ip all
NAME IP/MASK GATEWAY MAC DNS
PC5 192.168.10.12/24 192.168.10.1 00:50:79:66:68:00 10.0.0.6
PC5>
PC5> ping www.google.com
www.google.com resolved to 142.251.156.119
84 bytes from 142.251.156.119 icmp_seq=1 ttl=125 time=245.389 ms
84 bytes from 142.251.156.119 icmp_seq=2 ttl=125 time=101.823 ms
84 bytes from 142.251.156.119 icmp_seq=3 ttl=125 time=20.832 ms
84 bytes from 142.251.156.119 icmp_seq=4 ttl=125 time=16.401 ms
84 bytes from 142.251.156.119 icmp_seq=5 ttl=125 time=19.509 ms
PC5>
PC5> ping gateway.munia.local
gateway.munia.local resolved to 10.0.0.2
84 bytes from 10.0.0.2 icmp_seq=1 ttl=254 time=2.245 ms
84 bytes from 10.0.0.2 icmp_seq=2 ttl=254 time=2.507 ms
84 bytes from 10.0.0.2 icmp_seq=3 ttl=254 time=4.344 ms
84 bytes from 10.0.0.2 icmp_seq=4 ttl=254 time=2.720 ms
84 bytes from 10.0.0.2 icmp_seq=5 ttl=254 time=2.505 ms
From PC3
PC3> show ip all
NAME IP/MASK GATEWAY MAC DNS
PC3 192.168.20.16/25 192.168.20.1 00:50:79:66:68:01 10.0.0.6
PC3>
PC3> ping gateway.munia.local
gateway.munia.local resolved to 10.0.0.2
84 bytes from 10.0.0.2 icmp_seq=1 ttl=254 time=1.894 ms
84 bytes from 10.0.0.2 icmp_seq=2 ttl=254 time=2.011 ms
84 bytes from 10.0.0.2 icmp_seq=3 ttl=254 time=2.554 ms
84 bytes from 10.0.0.2 icmp_seq=4 ttl=254 time=1.994 ms
84 bytes from 10.0.0.2 icmp_seq=5 ttl=254 time=2.380 ms
PC3> ping 192.168.20.17
84 bytes from 192.168.20.17 icmp_seq=1 ttl=64 time=1.616 ms
84 bytes from 192.168.20.17 icmp_seq=2 ttl=64 time=1.697 ms
84 bytes from 192.168.20.17 icmp_seq=3 ttl=64 time=2.471 ms
84 bytes from 192.168.20.17 icmp_seq=4 ttl=64 time=1.094 ms
84 bytes from 192.168.20.17 icmp_seq=5 ttl=64 time=1.650 ms
PC3> ping www.google.com
www.google.com resolved to 142.251.150.119
84 bytes from 142.251.150.119 icmp_seq=1 ttl=125 time=18.040 ms
84 bytes from 142.251.150.119 icmp_seq=2 ttl=125 time=20.226 ms
84 bytes from 142.251.150.119 icmp_seq=3 ttl=125 time=19.829 ms
84 bytes from 142.251.150.119 icmp_seq=4 ttl=125 time=15.628 ms
84 bytes from 142.251.150.119 icmp_seq=5 ttl=125 time=18.289 ms