Brocade BigIron RX Series Configuration Guide - Manual (Page 396)

318 BigIron RX Series Configuration Guide
53-1002484-04
Private VLANs
11
Enabling broadcast, multicast or unknown unicast traffic
to the private VLAN
To enhance private VLAN security, the primary private VLAN does not forward broadcast or
unknown unicast packets to its community and isolated VLANs. For example, if port 3/2 in
Figure 30 on page 314 receives a broadcast packet from the firewall, the port does not forward the
packet to the other private VLAN ports (3/5, 3/6, 3/9, and 3/10).
This forwarding restriction does not apply to traffic from the private VLAN. The primary port does
forward broadcast and unknown unicast packets that are received from the isolated and
community VLANs. For example, if the host on port 3/9 sends an unknown unicast packet, port 3/2
forwards the packet to the firewall.
If you want to remove the forwarding restriction, you can enable the primary port to forward
broadcast or unknown unicast traffic, if desired, using the following CLI method. You can enable or
disable forwarding of broadcast or unknown unicast packets separately.
Using the CLI
To configure the ports in the primary VLAN to forward broadcast, multicast or unknown unicast
traffic received from sources outside the private VLAN, enter the following commands at the global
CONFIG level of the CLI.
BigIron RX(config)# pvlan-preference broadcast flood
BigIron RX(config)# pvlan-preference unknown-unicast flood
These commands enable forwarding of broadcast, multicast and unknown-unicast packets to ports
within the private VLAN. To again disable forwarding, enter a command such as the following.
BigIron RX(config)# no pvlan-preference broadcast flood
This command disables forwarding of broadcast packets within the private VLAN.
Syntax: [no] pvlan-preference broadcast | unknown-unicast flood
CLI example
To configure the private VLANs shown in Figure 30 on page 314, enter the following commands.
BigIron RX(config)# vlan 901
BigIron RX(config-vlan-901)# untagged ethernet 3/5 to 3/6
BigIron RX(config-vlan-901)# pvlan type community
BigIron RX(config-vlan-901)# exit
BigIron RX(config)# vlan 902
BigIron RX(config-vlan-902)# untagged ethernet 3/9 to 3/10
BigIron RX(config-vlan-902)# pvlan type isolated
BigIron RX(config-vlan-902)# exit
BigIron RX(config)# vlan 903
BigIron RX(config-vlan-903)# untagged ethernet 3/5 to 3/6
BigIron RX(config-vlan-903)# pvlan type community
BigIron RX(config-vlan-903)# exit
BigIron RX(config)# vlan 7
BigIron RX(config-vlan-7)# untagged ethernet 3/2
BigIron RX(config-vlan-7)# pvlan type primary
BigIron RX(config-vlan-7)# pvlan mapping 901 ethernet 3/2
BigIron RX(config-vlan-7)# pvlan mapping 902 ethernet 3/2
BigIron RX(config-vlan-7)# pvlan mapping 903 ethernet 3/2