Private Vlans

I might of hit this before...but I read about private vlans, vacl's, switch spoofing, and vlan hopping again tonight in the exam study guide. I really feel like I am taking this material in very well. I work within a fully switched enviornment every day, and have had some good exposure to it throughout my career so this stuff is sitting pretty well in my mind, and even answering some questions I had coming into the exam topics.

Private VLAN's
Primary vlan must be associated with secondary vlans through an association statement. Primary vlans can communicate with secondary vlans. Secondary vlans can communicate with the primary vlan, but not with other secondary vlans unless they are in the same "community." Secondary vlans can be one of these two types:

1. Isolated- isolated from everything except the primary vlan. CAN NOT communicate with other secondary or isolated secondary vlans.
2. Community- secondary community hosts can communicate with each other, but not with any other secondary vlans. They can also communicate with the primary vlan, or normal vlan.

Switchports must also be configured for private vlan access. They can be in one of two modes:

1. Promiscous- use this for routers/firewalls/gateways. Ports in promiscous mode bypass the rules or private vlans and can communicate with any secondary or primary vlan in any type (isolated or community).
2. Host- connected to a regular host...must abide by the private vlan rulesets.

Configuration example:
(config)vlan [vlan-id]
(config-vlan)private vlan [isolated, primary, community]
(config-vlan)private-vlan association [secondary vlan list] [add|remove] - use this on the primary vlan to associate the secondary vlans ***

Interface config
(config-if)switchport mode private-vlan [host | promiscous] - set the mode
(config-if)switchport private-vlan host-association [primary vlan id] [secondary vlan id] - if in host mode
(config-if)switchport private-vlan mapping [primary vlan id][secondary vlan list] [add|remove] - this is for promiscous mode and used to apply mappings to SVI's as well.

look familiar :) It basically replace these....:

(config-if)switchport mode access
(config-if)switchport access vlan [vlan-id]