Dell SmartFabric OS10 User Guide Release 10.5.4

Configuration notes

• Only the primary VLANs are extended to the core L3 switch (spine).
• On the leaf nodes, the primary VLAN port that is connected to the spine switch is the promiscuous port.
• The spine switch is PVLAN agnostic. On the spine switch, the ports that connect to the leaf nodes AG1 and AG2 are normal trunk ports in the respective VLANs.
• Primary VLANs on the leaf nodes do not have an IP address. IP address is configured only on the spine switch, which is the gateway for all hosts in the PVLAN domains. The spine switch performs the L3 IPv4 and IPv6 routing.

AG1 Leaf Switch

1. Configure the VLTi member links between AG1 and AG2.

   AG1(config)# interface ethernet1/1/11
   AG1(conf-if-eth1/1/11)# no shutdown
   AG1(conf-if-eth1/1/11)# no switchport
   AG1(conf-if-eth1/1/11)# exit
   
   AG1(config)# interface ethernet1/1/12
   AG1(conf-if-eth1/1/12)# no shutdown
   AG1(conf-if-eth1/1/12)# no switchport
   AG1(conf-if-eth1/1/12)# exit
   

2. Configure the VLT domain.

   AG1(config)# vlt-domain 255
   AG1(conf-vlt-255)# backup destination 100.104.80.12
   AG1(conf-vlt-255)# discovery-interface ethernet1/1/11-1/1/12
   AG1(conf-vlt-255)# peer-routing
   AG1(conf-vlt-255)# primary-priority 1
   AG1(conf-vlt-255)# vlt-mac 06:00:00:00:01:01
   AG1(conf-vlt-255)# exit
   

3. Configure the VLT LAGs.

   AG1(config)# interface ethernet1/1/15
   AG1(conf-if-eth1/1/15)# no shutdown
   AG1(conf-if-eth1/1/15)# no switchport
   AG1(conf-if-eth1/1/15)# channel-group 1 mode active
   AG1(conf-if-eth1/1/15)# exit
   
   AG1(config)# interface port-channel 1
   AG1(conf-if-po-1)# vlt-port-channel 1
   AG1(conf-if-po-1)# exit
   
   AG1(config)# interface ethernet1/1/16
   AG1(conf-if-eth1/1/16)# no shutdown
   AG1(conf-if-eth1/1/16)# no switchport
   AG1(conf-if-eth1/1/16)# channel-group 2 mode active
   AG1(conf-if-eth1/1/16)# exit
   
   AG1(config)# interface port-channel 2
   AG1(conf-if-po-2)# vlt-port-channel 2
   AG1(conf-if-po-2)# exit
   
   AG1(config)# interface ethernet1/1/17
   AG1(conf-if-eth1/1/17)# no shutdown
   AG1(conf-if-eth1/1/17)# no switchport
   AG1(conf-if-eth1/1/17)# channel-group 3 mode active
   AG1(conf-if-eth1/1/17)# exit
   
   AG1(config)# interface port-channel 3
   AG1(conf-if-po-3)# vlt-port-channel 3
   AG1(conf-if-po-3)# exit
   
   AG1(config)# interface ethernet1/1/18
   AG1(conf-if-eth1/1/18)# no shutdown
   AG1(conf-if-eth1/1/18)# no switchport
   AG1(conf-if-eth1/1/18)# channel-group 4 mode active
   AG1(conf-if-eth1/1/18)# exit
   
   AG1(config)# interface port-channel 4
   AG1(conf-if-po-4)# vlt-port-channel 4
   AG1(conf-if-po-4)# exit
   
   AG1(config)# interface ethernet1/1/21
   AG1(conf-if-eth1/1/21)# no shutdown
   AG1(conf-if-eth1/1/21)# no switchport
   AG1(conf-if-eth1/1/21)# channel-group 128 mode active
   AG1(conf-if-eth1/1/21)# exit
   
   AG1(config)# interface ethernet1/1/22
   AG1(conf-if-eth1/1/22)# no shutdown
   AG1(conf-if-eth1/1/22)# no switchport
   AG1(conf-if-eth1/1/22)# channel-group 128 mode active
   AG1(conf-if-eth1/1/22)# exit
   
   AG1(config)# interface port-channel 128
   AG1(conf-if-po-128)# vlt-port-channel 1024
   AG1(conf-if-po-128)# exit
   
   AG1(config)# interface ethernet1/1/10
   AG1(conf-if-eth1/1/10)# no shutdown
   AG1(conf-if-eth1/1/10)# no switchport
   AG1(conf-if-eth1/1/10)# channel-group 101 mode active
   AG1(conf-if-eth1/1/10)# exit
   
   AG1(config)# interface port-channel 101
   AG1(conf-if-po-101)# vlt-port-channel 1022
   AG1(conf-if-po-101)# exit
   

4. Configure the primary VLANs and the PVLAN mode.

   AG1(config)# interface vlan 100
   AG1(conf-if-vl-100)# private-vlan mode primary 
   AG1(conf-if-vl-100)# exit
   
   AG1(config)# interface vlan 200
   AG1(conf-if-vl-200)# private-vlan mode primary 
   AG1(conf-if-vl-200)# exit
   

5. Configure the secondary VLANs and the respective PVLAN modes.

   AG1(config)# interface vlan 11
   AG1(conf-if-vl-11)# private-vlan mode community 
   AG1(conf-if-vl-11)# exit
   
   AG1(config)# interface vlan 12
   AG1(conf-if-vl-12)# private-vlan mode community 
   AG1(conf-if-vl-12)# exit
   
   AG1(config)# interface vlan 13
   AG1(conf-if-vl-13)# private-vlan mode isolated
   AG1(conf-if-vl-13)# exit
   
   AG1(config)# interface vlan 21
   AG1(conf-if-vl-21)# private-vlan mode community 
   AG1(conf-if-vl-21)# exit
   
   AG1(config)# interface vlan 22
   AG1(conf-if-vl-22)# private-vlan mode isolated
   AG1(conf-if-vl-22)# exit
   

6. Associate the secondary VLANs to the primary VLAN.

   AG1(config)# interface vlan 100
   AG1(conf-if-vl-100)# private-vlan mapping secondary-vlans 11-13
   AG1(conf-if-vl-100)# exit
   
   AG1(config)# interface vlan 200
   AG1(conf-if-vl-200)# private-vlan mapping secondary-vlans 21-22
   AG1(conf-if-vl-200)# exit
   

7. Configure the port mode on the community and isolated ports.

   AG1(config)# interface port-channel1
   AG1(conf-if-po-1)# no shutdown
   AG1(conf-if-po-1)# private-vlan mode secondary-port
   AG1(conf-if-po-1)# exit
   
   AG1(config)# interface port-channel2
   AG1(conf-if-po-2)# no shutdown
   AG1(conf-if-po-2)# private-vlan mode secondary-port
   AG1(conf-if-po-2)# exit
   
   AG1(config)# interface port-channel3
   AG1(conf-if-po-3)# no shutdown
   AG1(conf-if-po-3)# private-vlan mode secondary-port
   AG1(conf-if-po-3)# exit
   
   AG1(config)# interface port-channel4
   AG1(conf-if-po-4)# no shutdown
   AG1(conf-if-po-4)# private-vlan mode secondary-port
   AG1(conf-if-po-4)# exit
   
   AG1(config)# interface ethernet1/1/1 
   AG1(conf-if-eth1/1/1)# no shutdown
   AG1(conf-if-eth1/1/1)# private-vlan mode secondary-port
   AG1(conf-if-eth1/1/1)# exit
   
   AG1(config)# interface ethernet1/1/2
   AG1(conf-if-eth1/1/2)# no shutdown
   AG1(conf-if-eth1/1/2)# private-vlan mode secondary-port
   AG1(conf-if-eth1/1/2)# exit
   

8. Associate the member ports to the secondary VLANs.

   AG1(config)# interface port-channel1
   AG1(conf-if-po-1)# switchport mode trunk
   AG1(conf-if-po-1)# switchport trunk allowed vlan 12
   AG1(conf-if-po-1)# exit
   
   AG1(config)# interface port-channel2
   AG1(conf-if-po-2)# switchport mode trunk 
   AG1(conf-if-po-2)# switchport trunk allowed vlan 13
   AG1(conf-if-po-2)# exit
   
   AG1(config)# interface port-channel3
   AG1(conf-if-po-3)# switchport mode trunk
   AG1(conf-if-po-3)# switchport trunk allowed vlan 21
   AG1(conf-if-po-3)# exit
   
   AG1(config)# interface port-channel4
   AG1(conf-if-po-4)# switchport mode trunk
   AG1(conf-if-po-4)# switchport trunk allowed vlan 22
   AG1(conf-if-po-4)# exit
   
   AG1(config)# interface ethernet1/1/1 
   AG1(conf-if-eth1/1/1)# switchport mode trunk
   AG1(conf-if-eth1/1/1)# switchport trunk allowed vlan 11
   AG1(conf-if-eth1/1/1)# exit
   
   AG1(config)# interface ethernet1/1/2
   AG1(conf-if-eth1/1/2)# switchport mode trunk
   AG1(conf-if-eth1/1/2)# switchport trunk allowed vlan 13
   AG1(conf-if-eth1/1/2)# exit
   

9. Associate the ISL to the primary and the secondary VLANs as a normal trunk port.

   AG1(config)# interface port-channel128
   AG1(conf-if-po-128)# switchport mode trunk
   AG1(conf-if-po-128)# switchport trunk allowed vlan 11-13,21-22,100,200
   AG1(conf-if-po-128)# exit
   

10. Configure the spine-facing port in promiscuous mode.

    AG1(config)# interface port-channel101
    AG1(conf-if-po-101)# no shutdown
    AG1(conf-if-po-101)# private-vlan mode promiscuous
    AG1(conf-if-po-101)# exit
    

11. Associate the promiscuous port to the primary VLANs.

    AG1(config)# interface port-channel101
    AG1(conf-if-po-101)# switchport mode trunk
    AG1(conf-if-po-101)# switchport trunk allowed vlan 100,200
    AG1(conf-if-po-101)# exit
    

AG2 Leaf Switch

1. Configure the VLTi member links between AG1 and AG2.

   AG2(config)# interface ethernet1/1/11
   AG2(conf-if-eth1/1/11)# no shutdown
   AG2(conf-if-eth1/1/11)# no switchport
   AG2(conf-if-eth1/1/11)# exit
   
   AG2(config)# interface ethernet1/1/12
   AG2(conf-if-eth1/1/12)# no shutdown
   AG2(conf-if-eth1/1/12)# no switchport
   AG2(conf-if-eth1/1/12)# exit
   

2. Configure the VLT domain.

   AG2(config)# vlt-domain 255
   AG2(conf-vlt-255)# backup destination 100.104.80.14
   AG2(conf-vlt-255)# discovery-interface ethernet1/1/11-1/1/12
   AG2(conf-vlt-255)# peer-routing
   AG2(conf-vlt-255)# primary-priority 65535
   AG2(conf-vlt-255)# vlt-mac 06:00:00:00:01:01
   AG2(conf-vlt-255)# exit
   

3. Configure the VLT LAGs.

   AG2(config)# interface ethernet1/1/15
   AG2(conf-if-eth1/1/15)# no shutdown
   AG2(conf-if-eth1/1/15)# no switchport
   AG2(conf-if-eth1/1/15)# channel-group 1 mode active
   AG2(conf-if-eth1/1/15)# exit
   
   AG2(config)# interface port-channel1
   AG2(conf-if-po-1)# vlt-port-channel 1
   AG2(conf-if-po-1)# exit
   
   AG2(config)# interface ethernet1/1/16
   AG2(conf-if-eth1/1/16)# no shutdown
   AG2(conf-if-eth1/1/16)# no switchport
   AG2(conf-if-eth1/1/16)# channel-group 2 mode active
   AG2(conf-if-eth1/1/16)# exit
   
   AG2(config)# interface port-channel2
   AG2(conf-if-po-2)# vlt-port-channel 2
   AG2(conf-if-po-2)# exit
   
   AG2(config)# interface ethernet1/1/17
   AG2(conf-if-eth1/1/17)# no shutdown
   AG2(conf-if-eth1/1/17)# no switchport
   AG2(conf-if-eth1/1/17)# channel-group 3 mode active
   AG2(conf-if-eth1/1/17)# exit
   
   AG2(config)# interface port-channel3
   AG2(conf-if-po-3)# vlt-port-channel 3
   AG2(conf-if-po-3)# exit
   
   AG2(config)# interface ethernet1/1/18
   AG2(conf-if-eth1/1/18)# no shutdown
   AG2(conf-if-eth1/1/18)# no switchport
   AG2(conf-if-eth1/1/18)# channel-group 4 mode active
   AG2(conf-if-eth1/1/18)# exit
   
   AG2(config)# interface port-channel4
   AG2(conf-if-po-4)# vlt-port-channel 4
   AG2(conf-if-po-4)# exit
   
   AG2(config)# interface ethernet1/1/21
   AG2(conf-if-eth1/1/21)# no shutdown
   AG2(conf-if-eth1/1/21)# no switchport
   AG2(conf-if-eth1/1/21)# channel-group 128 mode active
   AG2(conf-if-eth1/1/21)# exit
   
   AG2(config)# interface ethernet1/1/22
   AG2(conf-if-eth1/1/22)# no shutdown
   AG2(conf-if-eth1/1/22)# no switchport
   AG2(conf-if-eth1/1/22)# channel-group 128 mode active
   AG2(conf-if-eth1/1/22)# exit
   
   AG2(config)# interface port-channel 128
   AG2(conf-if-po-128)# vlt-port-channel 1024
   AG2(conf-if-po-128)# exit
   
   AG2(config)# interface ethernet1/1/10
   AG2(conf-if-eth1/1/10)# no shutdown
   AG2(conf-if-eth1/1/10)# no switchport
   AG2(conf-if-eth1/1/10)# channel-group 101 mode active
   AG2(conf-if-eth1/1/10)# exit
   
   AG2(config)# interface port-channel 101
   AG2(conf-if-po-101)# vlt-port-channel 1022
   AG2(conf-if-po-101)# exit
   

4. Configure the primary VLANs and the PVLAN mode.

   AG2(config)# interface vlan 100
   AG2(conf-if-vl-100)# private-vlan mode primary 
   AG2(conf-if-vl-100)# exit
   
   AG2(config)# interface vlan 200
   AG2(conf-if-vl-200)# private-vlan mode primary 
   AG2(conf-if-vl-200)# exit
   

5. Configure the secondary VLANs and the respective PVLAN modes.

   AG2(config)# interface vlan 11
   AG2(conf-if-vl-11)# private-vlan mode community 
   AG2(conf-if-vl-11)# exit
   
   AG2(config)# interface vlan 12
   AG2(conf-if-vl-12)# private-vlan mode community 
   AG2(conf-if-vl-12)# exit
   
   AG2(config)# interface vlan 13
   AG2(conf-if-vl-13)# private-vlan mode isolated
   AG2(conf-if-vl-13)# exit
   
   AG2(config)# interface vlan 21
   AG2(conf-if-vl-21)# private-vlan mode community 
   AG2(conf-if-vl-21)# exit
   
   AG2(config)# interface vlan 22
   AG2(conf-if-vl-22)# private-vlan mode isolated
   AG2(conf-if-vl-22)# exit
   

6. Associate the secondary VLANs to the primary VLAN.

   AG2(config)# interface vlan 100
   AG2(conf-if-vl-100)# private-vlan mapping secondary-vlans 11-13
   AG2(conf-if-vl-100)# exit
   
   AG2(config)# interface vlan 200
   AG2(conf-if-vl-200)# private-vlan mapping secondary-vlans 21-22
   AG2(conf-if-vl-200)# exit
   

7. Configure the port mode on the community and isolated ports.

   AG2(config)# interface port-channel1
   AG2(conf-if-po-1)# no shutdown
   AG2(conf-if-po-1)# private-vlan mode secondary-port
   AG2(conf-if-po-1)# exit
   
   AG2(config)# interface port-channel2
   AG2(conf-if-po-2)# no shutdown
   AG2(conf-if-po-2)# private-vlan mode secondary-port
   AG2(conf-if-po-2)# exit
   
   AG2(config)# interface port-channel3
   AG2(conf-if-po-3)# no shutdown
   AG2(conf-if-po-3)# private-vlan mode secondary-port
   AG2(conf-if-po-3)# exit
   
   AG2(config)# interface port-channel4
   AG2(conf-if-po-4)# no shutdown
   AG2(conf-if-po-4)# private-vlan mode secondary-port
   AG2(conf-if-po-4)# exit
   
   AG2(config)# interface ethernet1/1/1 
   AG2(conf-if-eth1/1/1)# no shutdown
   AG2(conf-if-eth1/1/1)# private-vlan mode secondary-port
   AG2(conf-if-eth1/1/1)# exit
   
   AG2(config)# interface ethernet1/1/2
   AG2(conf-if-eth1/1/2)# no shutdown
   AG2(conf-if-eth1/1/2)# private-vlan mode secondary-port
   AG2(conf-if-eth1/1/2)# exit
   

8. Associate the member ports to the secondary VLANs.

   AG2(config)# interface port-channel1
   AG2(conf-if-po-1)# switchport mode trunk
   AG2(conf-if-po-1)# switchport trunk allowed vlan 12
   AG2(conf-if-po-1)# exit
   
   AG2(config)# interface port-channel2
   AG2(conf-if-po-2)# switchport mode trunk 
   AG2(conf-if-po-2)# switchport trunk allowed vlan 13
   AG2(conf-if-po-2)# exit
   
   AG2(config)# interface port-channel3
   AG2(conf-if-po-3)# switchport mode trunk
   AG2(conf-if-po-3)# switchport trunk allowed vlan 21
   AG2(conf-if-po-3)# exit
   
   AG2(config)# interface port-channel4
   AG2(conf-if-po-4)# switchport mode trunk
   AG2(conf-if-po-4)# switchport trunk allowed vlan 22
   AG2(conf-if-po-4)# exit
   
   AG2(config)# interface ethernet1/1/1 
   AG2(conf-if-eth1/1/1)# switchport mode trunk
   AG2(conf-if-eth1/1/1)# switchport trunk allowed vlan 12
   AG2(conf-if-eth1/1/1)# exit
   
   AG2(config)# interface ethernet1/1/2
   AG2(conf-if-eth1/1/2)# switchport mode trunk
   AG2(conf-if-eth1/1/2)# switchport trunk allowed vlan 13
   AG2(conf-if-eth1/1/2)# exit
   

9. Associate the ISL to the primary and the secondary VLANs as a normal trunk port.

   AG2(config)# interface port-channel128
   AG2(conf-if-po-128)# switchport mode trunk
   AG2(conf-if-po-128)# switchport trunk allowed vlan 11-13,21-22,100,200
   AG2(conf-if-po-128)# exit
   

10. Configure the spine-facing port in promiscuous mode.

    AG2(config)# interface port-channel101
    AG2(conf-if-po-101)# no shutdown
    AG2(conf-if-po-101)# private-vlan mode promiscuous
    AG2(conf-if-po-101)# exit
    

11. Associate the promiscuous port to the primary VLANs.

    AG2(config)# interface port-channel101
    AG2(conf-if-po-101)# switchport mode trunk
    AG2(conf-if-po-101)# switchport trunk allowed vlan 100,200
    AG2(conf-if-po-101)# exit
    

AG3 Leaf Switch

1. Configure the VLTi member links between AG3 and AG4.

   AG3(config)# interface ethernet1/1/11
   AG3(conf-if-eth1/1/11)# no shutdown
   AG3(conf-if-eth1/1/11)# no switchport
   AG3(conf-if-eth1/1/11)# exit
   
   AG3(config)# interface ethernet1/1/12
   AG3(conf-if-eth1/1/12)# no shutdown
   AG3(conf-if-eth1/1/12)# no switchport
   AG3(conf-if-eth1/1/12)# exit
   

2. Configure the VLT domain.

   AG3(config)# vlt-domain 255
   AG3(conf-vlt-255)# backup destination 100.104.80.15
   AG3(conf-vlt-255)# discovery-interface ethernet1/1/11-1/1/12
   AG3(conf-vlt-255)# peer-routing
   AG3(conf-vlt-255)# primary-priority 1
   AG3(conf-vlt-255)# vlt-mac 02:00:00:00:00:02
   AG3(conf-vlt-255)# exit
   

3. Configure the VLT LAGs.

   AG3(config)# interface ethernet1/1/15
   AG3(conf-if-eth1/1/15)# no shutdown
   AG3(conf-if-eth1/1/15)# no switchport
   AG3(conf-if-eth1/1/15)# channel-group 1 mode active
   AG3(conf-if-eth1/1/15)# exit
   
   AG3(config)# interface port-channel 1
   AG3(conf-if-po-1)# vlt-port-channel 1
   AG3(conf-if-po-1)# exit
   
   AG3(config)# interface ethernet1/1/16
   AG3(conf-if-eth1/1/16)# no shutdown
   AG3(conf-if-eth1/1/16)# no switchport
   AG3(conf-if-eth1/1/16)# channel-group 2 mode active
   AG3(conf-if-eth1/1/16)# exit
   
   AG3(config)# interface port-channel 2
   AG3(conf-if-po-2)# vlt-port-channel 2
   AG3(conf-if-po-2)# exit
   
   AG3(config)# interface ethernet1/1/22
   AG3(conf-if-eth1/1/22)# no shutdown
   AG3(conf-if-eth1/1/22)# no switchport
   AG3(conf-if-eth1/1/22)# channel-group 128 mode active
   AG3(conf-if-eth1/1/22)# exit
   
   AG3(config)# interface ethernet1/1/23
   AG3(conf-if-eth1/1/23)# no shutdown
   AG3(conf-if-eth1/1/23)# no switchport
   AG3(conf-if-eth1/1/23)# channel-group 128 mode active
   AG3(conf-if-eth1/1/23)# exit
   
   AG3(config)# interface port-channel 128
   AG3(conf-if-po-128)# vlt-port-channel 1024
   AG3(conf-if-po-128)# exit
   

4. Configure the primary VLANs and the PVLAN mode.

   AG3(config)# interface vlan 100
   AG3(conf-if-vl-100)# private-vlan mode primary 
   AG3(conf-if-vl-100)# exit
   
   AG3(config)# interface vlan 200
   AG3(conf-if-vl-200)# private-vlan mode primary 
   AG3(conf-if-vl-200)# exit
   

5. Configure the secondary VLANs and the respective PVLAN modes.

   AG3(config)# interface vlan 11
   AG3(conf-if-vl-11)# private-vlan mode community 
   AG3(conf-if-vl-11)# exit
   
   AG3(config)# interface vlan 12
   AG3(conf-if-vl-12)# private-vlan mode community 
   AG3(conf-if-vl-12)# exit
   
   AG3(config)# interface vlan 13
   AG3(conf-if-vl-13)# private-vlan mode isolated
   AG3(conf-if-vl-13)# exit
   
   AG3(config)# interface vlan 21
   AG3(conf-if-vl-21)# private-vlan mode community 
   AG3(conf-if-vl-21)# exit
   
   AG3(config)# interface vlan 22
   AG3(conf-if-vl-22)# private-vlan mode isolated
   AG3(conf-if-vl-22)# exit
   

6. Associate the secondary VLANs to the primary VLAN.

   AG3(config)# interface vlan 100
   AG3(conf-if-vl-100)# private-vlan mapping secondary-vlans 11-13
   AG3(conf-if-vl-100)# exit
   
   AG3(config)# interface vlan 200
   AG3(conf-if-vl-200)# private-vlan mapping secondary-vlans 21-22
   AG3(conf-if-vl-200)# exit
   

7. Configure the port mode on the community and isolated ports.

   AG3(config)# interface port-channel1
   AG3(conf-if-po-1)# no shutdown
   AG3(conf-if-po-1)# private-vlan mode secondary-port
   AG3(conf-if-po-1)# exit
   
   AG3(config)# interface port-channel2
   AG3(conf-if-po-2)# no shutdown
   AG3(conf-if-po-2)# private-vlan mode secondary-port
   AG3(conf-if-po-2)# exit
   
   AG3(config)# interface ethernet1/1/1 
   AG3(conf-if-eth1/1/1)# no shutdown
   AG3(conf-if-eth1/1/1)# private-vlan mode secondary-port
   AG3(conf-if-eth1/1/1)# exit
   

8. Associate the member ports to the secondary VLANs.

   AG3(config)# interface port-channel1
   AG3(conf-if-po-1)# switchport mode trunk
   AG3(conf-if-po-1)# switchport trunk allowed vlan 11
   AG3(conf-if-po-1)# exit
   
   AG3(config)# interface port-channel2
   AG3(conf-if-po-2)# switchport mode trunk 
   AG3(conf-if-po-2)# switchport trunk allowed vlan 13
   AG3(conf-if-po-2)# exit
   
   AG3(config)# interface ethernet1/1/1 
   AG3(conf-if-eth1/1/1)# switchport mode trunk
   AG3(conf-if-eth1/1/1)# switchport trunk allowed vlan 21
   AG3(conf-if-eth1/1/1)# exit
   

9. Associate the ISL to the primary and the secondary VLANs as a normal trunk port.

   AG3(config)# interface port-channel128
   AG3(conf-if-po-128)# switchport mode trunk
   AG3(conf-if-po-128)# switchport trunk allowed vlan 11-13,21-22,100,200
   AG3(conf-if-po-128)# exit
   

AG4 Leaf Switch

1. Configure the VLTi member links between AG3 and AG4.

   AG4(config)# interface ethernet1/1/11
   AG4(conf-if-eth1/1/11)# no shutdown
   AG4(conf-if-eth1/1/11)# no switchport
   AG4(conf-if-eth1/1/11)# exit
   
   AG4(config)# interface ethernet1/1/12
   AG4(conf-if-eth1/1/12)# no shutdown
   AG4(conf-if-eth1/1/12)# no switchport
   AG4(conf-if-eth1/1/12)# exit
   

2. Configure the VLT domain.

   AG4(config)# vlt-domain 255
   AG4(conf-vlt-255)# backup destination 100.104.80.16
   AG4(conf-vlt-255)# discovery-interface ethernet1/1/11-1/1/12
   AG4(conf-vlt-255)# peer-routing
   AG4(conf-vlt-255)# primary-priority 65535
   AG4(conf-vlt-255)# vlt-mac 02:00:00:00:00:02
   AG4(conf-vlt-255)# exit
   

3. Configure the VLT LAGs.

   AG4(config)# interface ethernet1/1/15
   AG4(conf-if-eth1/1/15)# no shutdown
   AG4(conf-if-eth1/1/15)# no switchport
   AG4(conf-if-eth1/1/15)# channel-group 1 mode active
   AG4(conf-if-eth1/1/15)# exit
   
   AG4(config)# interface port-channel1
   AG4(conf-if-po-1)# vlt-port-channel 1
   AG4(conf-if-po-1)# exit
   
   AG4(config)# interface ethernet1/1/16
   AG4(conf-if-eth1/1/16)# no shutdown
   AG4(conf-if-eth1/1/16)# no switchport
   AG4(conf-if-eth1/1/16)# channel-group 2 mode active
   AG4(conf-if-eth1/1/16)# exit
   
   AG4(config)# interface port-channel2
   AG4(conf-if-po-2)# vlt-port-channel 2
   AG4(conf-if-po-2)# exit
   
   AG4(config)# interface ethernet1/1/21
   AG4(conf-if-eth1/1/21)# no shutdown
   AG4(conf-if-eth1/1/21)# no switchport
   AG4(conf-if-eth1/1/21)# channel-group 128 mode active
   AG4(conf-if-eth1/1/21)# exit
   
   AG4(config)# interface ethernet1/1/24
   AG4(conf-if-eth1/1/24)# no shutdown
   AG4(conf-if-eth1/1/24)# no switchport
   AG4(conf-if-eth1/1/24)# channel-group 128 mode active
   AG4(conf-if-eth1/1/24)# exit
   
   AG4(config)# interface port-channel128
   AG4(conf-if-po-128)# vlt-port-channel 1024
   AG4(conf-if-po-128)# exit
   

4. Configure the primary VLANs and the PVLAN mode.

   AG4(config)# interface vlan 100
   AG4(conf-if-vl-100)# private-vlan mode primary 
   AG4(conf-if-vl-100)# exit
   
   AG4(config)# interface vlan 200
   AG4(conf-if-vl-200)# private-vlan mode primary 
   AG4(conf-if-vl-200)# exit
   

5. Configure the secondary VLANs and the respective PVLAN modes.

   AG4(config)# interface vlan 11
   AG4(conf-if-vl-11)# private-vlan mode community 
   AG4(conf-if-vl-11)# exit
   
   AG4(config)# interface vlan 12
   AG4(conf-if-vl-12)# private-vlan mode community 
   AG4(conf-if-vl-12)# exit
   
   AG4(config)# interface vlan 13
   AG4(conf-if-vl-13)# private-vlan mode isolated
   AG4(conf-if-vl-13)# exit
   
   AG4(config)# interface vlan 21
   AG4(conf-if-vl-21)# private-vlan mode community
   AG4(conf-if-vl-21)# exit
   
   AG4(config)# interface vlan 22
   AG4(conf-if-vl-22)# private-vlan mode isolated
   AG4(conf-if-vl-22)# exit
   

6. Associate the secondary VLANs to the primary VLAN.

   AG4(config)# interface vlan 100
   AG4(conf-if-vl-100)# private-vlan mapping secondary-vlans 11-13
   AG4(conf-if-vl-100)# exit
   
   AG4(config)# interface vlan 200
   AG4(conf-if-vl-200)# private-vlan mapping secondary-vlans 21-22
   AG4(conf-if-vl-200)# exit
   

7. Configure the port mode on the community and isolated ports.

   AG4(config)# interface port-channel1
   AG4(conf-if-po-1)# no shutdown
   AG4(conf-if-po-1)# private-vlan mode secondary-port
   AG4(conf-if-po-1)# exit
   
   AG4(config)# interface port-channel2
   AG4(conf-if-po-2)# no shutdown
   AG4(conf-if-po-2)# private-vlan mode secondary-port
   AG4(conf-if-po-2)# exit
   
   AG4(config)# interface ethernet1/1/1 
   AG4(conf-if-eth1/1/1)# no shutdown
   AG4(conf-if-eth1/1/1)# private-vlan mode secondary-port
   AG4(conf-if-eth1/1/1)# exit
   
   AG4(config)# interface ethernet1/1/2
   AG4(conf-if-eth1/1/2)# no shutdown
   AG4(conf-if-eth1/1/2)# private-vlan mode secondary-port
   AG4(conf-if-eth1/1/2)# exit
   

8. Associate the member ports to the secondary VLANs.

   AG4(config)# interface port-channel1
   AG4(conf-if-po-1)# switchport mode trunk
   AG4(conf-if-po-1)# switchport trunk allowed vlan 11
   AG4(conf-if-po-1)# exit
   
   AG4(config)# interface port-channel2
   AG4(conf-if-po-2)# switchport mode trunk 
   AG4(conf-if-po-2)# switchport trunk allowed vlan 13
   AG4(conf-if-po-2)# exit
   
   AG4(config)# interface ethernet1/1/1 
   AG4(conf-if-eth1/1/1)# switchport mode trunk
   AG4(conf-if-eth1/1/1)# switchport trunk allowed vlan 12
   AG4(conf-if-eth1/1/1)# exit
   
   AG4(config)# interface ethernet1/1/2
   AG4(conf-if-eth1/1/2)# switchport mode trunk
   AG4(conf-if-eth1/1/2)# switchport trunk allowed vlan 22
   AG4(conf-if-eth1/1/2)# exit
   

9. Associate the ISL to the primary and the secondary VLANs as a normal trunk port.

   AG4(config)# interface port-channel128
   AG4(conf-if-po-128)# switchport mode trunk
   AG4(conf-if-po-128)# switchport trunk allowed vlan 11-13,21-22,100,200
   AG4(conf-if-po-128)# exit
   

Spine Switch

1. Create the primary VLANs extended from AG1 and AG2.

   SPINE(config)# interface vlan 100
   SPINE(conf-if-vl-100)# ip address 172.1.1.1/16 
   SPINE(conf-if-vl-100)# exit
   
   SPINE(config)# interface vlan 200
   SPINE(conf-if-vl-200)# ip address 172.2.1.1/16
   SPINE(conf-if-vl-200)# exit
   

2. Associate the VLT LAGs to the primary VLANs extended from AG1 and AG2.

   SPINE(config)# interface ethernet1/1/10
   SPINE(conf-if-eth1/1/10)# no shutdown
   SPINE(conf-if-eth1/1/10)# no switchport
   SPINE(conf-if-eth1/1/10)# channel-group 101 mode active
   SPINE(conf-if-eth1/1/10)# exit
   
   SPINE(config)# interface ethernet1/1/11
   SPINE(conf-if-eth1/1/11)# no shutdown
   SPINE(conf-if-eth1/1/11)# no switchport
   SPINE(conf-if-eth1/1/11)# channel-group 101 mode active
   SPINE(conf-if-eth1/1/11)# exit
   

3. (Optional) To enable connectivity between end devices that belong to different secondary VLANs (community or isolated or both) of a PVLAN domain, enable ip local-proxy arp on the VLAN in the spine switch.

   SPINE(config)# interface vlan100
   SPINE(conf-if-vl-100)# ip address 172.1.1.1/16
   SPINE(conf-if-vl-100)# ip local-proxy-arp
   
   SPINE(config)# interface vlan200
   SPINE(conf-if-vl-200)# ip address 172.2.1.1/16
   SPINE(conf-if-vl-200)# ip local-proxy-arp
   

Verify the configuration

To verify the configuration, use the show vlan private-vlan command on the leaf nodes:

PVLAN 100

AG1# show vlan private-vlan 100
Primary Secondary Type      Active Ports                                       
------- --------- --------- ------ --------------
100               Primary   Yes    Po101,128,1000 
        11        Community Yes    Eth1/1/1 
                                   Po128,1000 
        12        Community Yes    Po1,128,1000 
        13        Isolated  Yes    Eth1/1/2
                                   Po2,128,1000 

PVLAN 200

AG1# show vlan private-vlan 200
Primary Secondary Type      Active Ports                                       
------- --------- --------- ------ --------------
200               Primary   Yes    Po101,128,1000 
        21        Community Yes    Po3,128,1000 
        22        Isolated  Yes    Po4,128,1000 

To verify private VLAN configurations, use the show vlan private-vlan mapping command.

AG1# show vlan private-vlan mapping 
Private Vlan:
 Primary   : 100
 Isolated  : 13
 Community : 11-12
 
Private Vlan:
 Primary   : 200
 Isolated  : 22
 Community : 21
AG1#

To verify the MAC address table entries for the primary VLAN, use the show mac address-table command.

On primary VLAN

The output of this show command displays:

• The MAC addresses that are learned on the primary VLAN.
• The MAC addresses that are learned on the secondary VLANs being replicated to the primary VLAN.

AG1# show mac address-table vlan 100
Codes: pv <vlan-id> - private vlan where the mac is originally learnt
VlanId        Mac Address         Type        Interface               
100           54:bf:64:bd:d8:45   dynamic     port-channel101         
100           00:00:06:00:88:01   dynamic     ethernet1/1/1           pv 11   
100           00:00:06:00:89:01   dynamic     port-channel1           pv 12   
100           00:00:06:00:8a:01   dynamic     port-channel2           pv 13     

On secondary VLAN

The output of this show command displays:

• The MAC addresses that are learned on the secondary VLAN.
• The MAC addresses that are learned on the primary VLAN being replicated to the secondary VLAN.

AG1# show mac address-table vlan 11
Codes: pv <vlan-id> - private vlan where the mac is originally learnt
VlanId        Mac Address         Type        Interface               
11            00:00:06:00:88:01   dynamic     ethernet1/1/1 
11            54:bf:64:bd:d8:45   dynamic     port-channel101         pv 100