close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Understanding Layer 2 Networking
- Layer 2 Networking
play_arrow Configuring MAC Addresses
- MAC Addresses
play_arrow Configuring MAC Learning
- MAC Learning
play_arrow Configuring MAC Accounting
- MAC Accounting
play_arrow Configuring MAC Notification
- MAC Notification
play_arrow Configuring MAC Table Aging
- MAC Table Aging
play_arrow Configuring Learning and Forwarding
- Layer 2 Forwarding Tables
play_arrow Configuring Bridging and VLANs
- Bridging and VLANs
play_arrow Configuring 802.1Q VLANs
- 802.1Q VLANs Overview
- 802.1Q VLAN IDs and Ethernet Interface Types
- Configuring Dynamic 802.1Q VLANs
- Enabling VLAN Tagging
- Configuring Tagged Interface with multiple tagged vlans and native vlan
- Sending Untagged Traffic Without VLAN ID to Remote End
- Configuring Tag Protocol IDs (TPIDs) on QFX Series Switches
- Configuring Flexible VLAN Tagging on PTX Series Packet Transport Routers
- Configuring an MPLS-Based VLAN CCC with Pop, Push, and Swap and Control Passthrough
- Binding VLAN IDs to Logical Interfaces
- Associating VLAN IDs to VLAN Demux Interfaces
- Configuring VLAN and Extended VLAN Encapsulation
- Configuring a Layer 2 VPN Routing Instance on a VLAN-Bundled Logical Interface
- Example: Configuring a Layer 2 VPN Routing Instance on a VLAN-Bundled Logical Interface
- Specifying the Interface Over Which VPN Traffic Travels to the CE Router
- Configuring Access Mode on a Logical Interface
- Configuring a Logical Interface for Trunk Mode
- Configuring the VLAN ID List for a Trunk Interface
- Configuring a Trunk Interface on a Bridge Network
- Configuring a VLAN-Bundled Logical Interface to Support a Layer 2 VPN Routing Instance
- Configuring a VLAN-Bundled Logical Interface to Support a Layer 2 VPN Routing Instance
- Configuring a Layer 2 Circuit on a VLAN-Bundled Logical Interface
- Example: Configuring a Layer 2 Circuit on a VLAN-Bundled Logical Interface
- Guidelines for Configuring VLAN ID List-Bundled Logical Interfaces That Connect CCCs
- Specifying the Interface to Handle Traffic for a CCC
- Specifying the Interface to Handle Traffic for a CCC Connected to the Layer 2 Circuit
play_arrow Configuring Static ARP Table Entries
- Static ARP Table Entries Overview
- Static ARP Entries on Ethernet Interfaces
- Configuring Static ARP Table Entries For Mapping IP Addresses to MAC Addresses
- Example: Configuring Static ARP Entries on Ethernet Interfaces
play_arrow Configuring Restricted and Unrestricted Proxy ARP
- Restricted and Unrestricted Proxy ARP Overview
- Configuring Restricted and Unrestricted Proxy ARP
play_arrow Configuring Gratuitous ARP
- Configuring Gratuitous ARP
play_arrow Adjusting the ARP Aging Timer
- Adjusting the ARP Aging Timer
play_arrow Configuring Tagged VLANs
- Configuring Tagged VLANs
play_arrow Stacking and Rewriting Gigabit Ethernet VLAN Tags
- Stacking and Rewriting Gigabit Ethernet VLAN Tags Overview
- Stacking and Rewriting Gigabit Ethernet VLAN Tags
- Configuring Frames with Particular TPIDs to Be Processed as Tagged Frames
- Configuring Tag Protocol IDs (TPIDs) on PTX Series Packet Transport Routers
- Configuring Stacked VLAN Tagging
- Configuring Dual VLAN Tags
- Configuring Inner and Outer TPIDs and VLAN IDs
- Stacking a VLAN Tag
- Stacking Two VLAN Tags
- Removing a VLAN Tag
- Removing the Outer and Inner VLAN Tags
- Removing the Outer VLAN Tag and Rewriting the Inner VLAN Tag
- Rewriting the VLAN Tag on Tagged Frames
- Rewriting a VLAN Tag on Untagged Frames
- Rewriting a VLAN Tag and Adding a New Tag
- Rewriting the Inner and Outer VLAN Tags
- Examples: Stacking and Rewriting Gigabit Ethernet IQ VLAN Tags
- Understanding Transparent Tag Operations and IEEE 802.1p Inheritance
- Understanding swap-by-poppush
- Configuring IEEE 802.1p Inheritance push and swap from the Transparent Tag
play_arrow Configuring Private VLANs
- Private VLANs
- Understanding Private VLANs
- Bridge Domains Setup in PVLANs on MX Series Routers
- Bridging Functions With PVLANs
- Flow of Frames on PVLAN Ports Overview
- Guidelines for Configuring PVLANs on MX Series Routers
- Configuring PVLANs on MX Series Routers in Enhanced LAN Mode
- Example: Configuring PVLANs with Secondary VLAN Trunk Ports and Promiscuous Access Ports on a QFX Series Switch
- IRB Interfaces in Private VLANs on MX Series Routers
- Guidelines for Configuring IRB Interfaces in PVLANs on MX Series Routers
- Forwarding of Packets Using IRB Interfaces in PVLANs
- Configuring IRB Interfaces in PVLAN Bridge Domains on MX Series Routers in Enhanced LAN Mode
- Example: Configuring an IRB Interface in a Private VLAN on a Single MX Series Router
play_arrow Configuring Layer 2 Bridging Interfaces
- Layer 2 Bridging Interfaces Overview
- Configuring Layer 2 Bridging Interfaces
- Example: Configuring the MAC Address of an IRB Interface
play_arrow Configuring Layer 2 Virtual Switch Instances
- Layer 2 Virtual Switch Instances
play_arrow Configuring Link Layer Discovery Protocol
- LLDP Overview
- Configuring LLDP
- Example: Configuring LLDP
- Configuring the Transmission of Maximum VLAN Name TLVs in LLDP
- LLDP Operational Mode Commands
- Tracing LLDP Operations
play_arrow Configuring Layer 2 Protocol Tunneling
- Layer 2 Protocol Tunneling (L2PT)
play_arrow Configuring Virtual Routing Instances
- Virtual Routing Instances
play_arrow Configuring Layer 3 Logical Interfaces
- Layer 3 Logical Interfaces
play_arrow Configuring Routed VLAN Interfaces
- Routed VLAN Interfaces
play_arrow Configuring Integrated Routing and Bridging
- Integrated Routing and Bridging
play_arrow Configuring VLANS and VPLS Routing Instances
- VLANs and VPLS Routing Instances
play_arrow Configuring Multiple VLAN Registration Protocol (MVRP)
- Multiple VLAN Registration Protocol
play_arrow Configuring Ethernet Ring Protection Switching
- Example: Configuring Ethernet Ring Protection Switching on EX Series Switches
- Example: Configuring Ethernet Ring Protection Switching on QFX Series and EX Series Switches Supporting ELS
play_arrow Configuring Q-in-Q Tunneling and VLAN Translation
- Configuring Q-in-Q Tunneling and VLAN Q-in-Q Tunneling and VLAN Translation
play_arrow Configuring Redundant Trunk Groups
- Redundant Trunk Groups
- Q-in-Q Support on Redundant Trunk Links Using LAGs with Link Protection
play_arrow Configuring Proxy ARP
- Proxy ARP
play_arrow Configuring Layer 2 Interfaces on Security Devices
- Layer 2 Interfaces on Security Devices
play_arrow Configuring Security Zones and Security Policies on Security Devices
- Security Zones and Security Policies on Security Devices
play_arrow Configuring Ethernet Port Switching Modes on Security Devices
- Ethernet Port Switching Modes on Security Devices
play_arrow Configuring Ethernet Port VLANs in Switching Mode on Security Devices
- Ethernet Port VLANs in Switching Mode on Security Devices
play_arrow Configuring Secure Wire on Security Devices
- Secure Wire on Security Devices
play_arrow Configuring Reflective Relay on Switches
- Reflective Relay on Switches
play_arrow Configuring Edge Virtual Bridging
- Edge Virtual Bridging
play_arrow Troubleshooting Ethernet Switching
- Troubleshooting Ethernet Switching
- Troubleshooting Ethernet Switching on EX Series Switches
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

Example: Configuring an IRB Interface in a Private VLAN on a Single MX Series Router

date_range 20-Dec-24

arrow_backward

arrow_forward

For security reasons, it is often useful to restrict the flow of broadcast and unknown unicast traffic and to even limit the communication between known hosts. The private VLAN (PVLAN) feature on MX Series routers allows an administrator to split a broadcast domain into multiple isolated broadcast subdomains, essentially putting a VLAN inside a VLAN.

This example describes how to create an integrated routing and bridging (IRB) interface in a PVLAN bridge domain associated with a virtual switch instance on a single MX Series router:

Note:

Configuring a voice over IP (VoIP) VLAN on PVLAN interfaces is not supported.

Requirements

This example uses the following hardware and software components:

One MX Series router in enhanced LAN mode.
Junos OS Release 15.1 or later for MX Series routers

Before you begin configuring a PVLAN, make sure you have:

Created and configured the necessary VLANs. See Configuring VLAN and Extended VLAN Encapsulation and Enabling VLAN Tagging.
Configured MX240, MX480, and MX960 routers to function in enhanced LAN mode by entering the network-services lan statement at the [edit chassis] hierarchy level.

Overview and Topology

In a large office with multiple buildings and VLANs, you might need to isolate some workgroups or other endpoints for security reasons or to partition the broadcast domain. This configuration example shows a simple topology to illustrate how to create a PVLAN with one primary VLAN and four community VLANs, as well as two isolated ports.

Assume a sample deployment in which a primary VLAN named VP contains ports, p1, p2, t1, t2, i1, i2, cx1, and cx2. The port types of these configured ports are as follows:

Promiscuous ports = p1, p2
ISL ports = t1, t2
Isolated ports = i1, i2
Community VLAN = Cx
Community ports = cx1, cx2

An IRB interface, irb.0, is configured and mapped to the bridge domain in the virtual switch instance.

Bridge domains are provisioned for each of the VLANs, namely, Vp, Vi, and Vcx. Assume the bridge domains to be configured as follows:

Vp—BD_primary_Vp (ports contained are p1, t1, i1, i2, cx1, cx2)

Vi—BD_isolate_Vi (ports contained are p1, t1, *i1, *i2)

Vcx—BD_community_Vcx (ports contained are p1, t1, cx1, cx2)

The bridge domains for community, primary, and isolated VLANs are automatically created by the system internally when you configure a bridge domain with a trunk interface, access interface, or interswitch link. The bridge domains contain the same VLAN ID corresponding to the VLANs. To use bridge domains for PVLANs, you must configure the following additional attributes:

Configuration

To configure an IRB interface in a PVLAN, perform these tasks:

CLI Quick Configuration
Procedure
Results

CLI Quick Configuration

To quickly create and configure a PVLAN and include an IRB interface in a PVLAN bridge domain associated with a virtual switch instance, copy the following commands and paste them into the router terminal window:

Configuring an IRB Interface

content_copy zoom_out_map
set interfaces irb unit 0 family inet address 22.22.22.1/24

Configuring Promiscuous, ISL, Isolated, and Community Ports

content_copy zoom_out_map
set interfaces ge-0/0/9 unit 0 family bridge interface-mode trunk 
set interfaces ge-0/0/9 unit 0 family bridge vlan-id 100 
set interfaces ge-0/0/13 unit 0 family bridge interface-mode trunk 
set interfaces ge-0/0/13 unit 0 family bridge vlan-id 100 
set interfaces ge-0/0/10 unit 0 family bridge interface-mode access 
set interfaces ge-0/0/10 unit 0 family bridge vlan-id 10 
set interfaces ge-0/0/12 unit 0 family bridge interface-mode access 
set interfaces ge-0/0/12 unit 0 family bridge vlan-id 10 
set interfaces ge-0/0/1 unit 0 family bridge interface-mode access 
set interfaces ge-0/0/1 unit 0 family bridge vlan-id 50 
set interfaces ge-0/0/2 unit 0 family bridge interface-mode access 
set interfaces ge-0/0/2 unit 0 family bridge vlan-id 50 
set interfaces ge-0/0/3 unit 0 family bridge interface-mode access 
set interfaces ge-0/0/3 unit 0 family bridge vlan-id 60 
set interfaces ge-0/0/4 unit 0 family bridge interface-mode access 
set interfaces ge-0/0/4 unit 0 family bridge vlan-id 60

Configuring a Virtual Switch Instance With Bridge Domain Interfaces

content_copy zoom_out_map
set routing-instances vs-1 instance-type virtual-switch 
set routing-instances vs-1 interface ge-0/0/1.0 
set routing-instances vs-1 interface ge-0/0/2.0 
set routing-instances vs-1 interface ge-0/0/3.0 
set routing-instances vs-1 interface ge-0/0/4.0 
set routing-instances vs-1 interface ge-0/0/9.0 
set routing-instances vs-1 interface ge-0/0/10.0 
set routing-instances vs-1 interface ge-0/0/12.0 
set routing-instances vs-1 interface ge-0/0/13.0
set routing-instances vs-1 bridge-domains bd1

Specify the IRB Interface and Primary, Isolated, and Community VLAN IDs in the Bridge Domain

content_copy zoom_out_map
set routing-instances vs1 bridge-domains bd1 vlan-id 100  
set routing-instances vs1 bridge-domains bd1 isolated-vlan 10  
set routing-instances vs1 bridge-domains bd1 community-vlans [50 60]
set routing-instances vs1 bridge-domains bd1 routing-interface irb.0

Procedure

Step-by-Step Procedure

To configure the interswitch link (ISL) for a PVLAN, the PVLAN port types, and secondary VLANs for the PVLAN:

Create an IRB interface.

content_copy zoom_out_map
[edit interfaces]
user@host# set interfaces irb unit 0 family inet address 22.22.22.1/24

Create a promiscuous port for the PVLAN.

content_copy zoom_out_map
[edit interfaces] 
user@host# set ge-0/0/9 unit 0 family bridge interface-mode trunk 
user@host# set ge-0/0/9 unit 0 family bridge vlan-id 100 

Create the interswitch link (ISL) trunk port for the PVLAN.

content_copy zoom_out_map
[edit interfaces] 
user@host# set ge-0/0/13 unit 0 family bridge interface-mode trunk inter-switch-link
user@host# set ge-0/0/13 unit 0 family bridge vlan-id 100 

Create the isolated ports for the PVLAN.

content_copy zoom_out_map
[edit interfaces] 
user@host# set ge-0/0/10 unit 0 family bridge interface-mode access 
user@host# set ge-0/0/10 unit 0 family bridge vlan-id 10 
user@host# set ge-0/0/12 unit 0 family bridge interface-mode access 
user@host# set ge-0/0/12 unit 0 family bridge vlan-id 10 

Create the community ports for the PVLAN.

content_copy zoom_out_map
[edit interfaces] 
user@host# set ge-0/0/1 unit 0 family bridge interface-mode access 
user@host# set ge-0/0/1 unit 0 family bridge vlan-id 50 
user@host# set ge-0/0/2 unit 0 family bridge interface-mode access 
user@host# set ge-0/0/2 unit 0 family bridge vlan-id 50 
user@host# set ge-0/0/3 unit 0 family bridge interface-mode access 
user@host# set ge-0/0/3 unit 0 family bridge vlan-id 60 
user@host# set ge-0/0/4 unit 0 family bridge interface-mode access 
user@host# set ge-0/0/4 unit 0 family bridge vlan-id 60

Create a virtual switch instance with a bridge domain and associate the logical interfaces.

content_copy zoom_out_map
[edit routing-instances]
user@host# set vs-1 instance-type virtual-switch 
user@host# set vs-1 interface ge-0/0/1.0 
user@host# set vs-1 interface ge-0/0/2.0 
user@host# set vs-1 interface ge-0/0/3.0 
user@host# set vs-1 interface ge-0/0/4.0 
user@host# set vs-1 interface ge-0/0/9.0 
user@host# set vs-1 interface ge-0/0/10.0 
user@host# set vs-1 interface ge-0/0/12.0 
user@host# set vs-1 interface ge-0/0/13.0
user@host# set vs-1 bridge-domains bd1

Specify the IRB interface, primary, isolated, and community VLAN IDs, and associate the VLANs with the bridge domain.

content_copy zoom_out_map
[edit routing-instances vs1 bridge-domains bd1]
user@host# set vlan-id 100  
user@host# set isolated-vlan 10  
user@host# set community-vlans [50 60]
user@host# set routing-interface irb.0

Results

Check the results of the configuration:

content_copy zoom_out_map
[edit]
[interfaces]
     ge-0/0/9 {
         unit 0 {
             family bridge {
	 interface-mode trunk;
	     vlan-id 100;            Promiscuous port by vlan id
             }
         }
     }

     ge-0/0/13 {
         unit 0 {
             family bridge {
	 interface-mode trunk inter-switch-link;  ISL trunk 
	 vlan-id 100;
             }
         }
     }


     ge-0/0/10 {
         unit 0 {
             family bridge {
                   interface-mode access;
                   vlan-id 10;             isolated port by vlan ID
              }
         }
     }

     ge-0/0/12 {
         unit 0 {
             family bridge {
                   interface-mode access;
                   vlan-id 10;             isolated port by vlan ID
              }
         }
     }
     ge-0/0/1 {
         unit 0 {
             family bridge {
                   interface-mode access;
                   vlan-id 50;             community port by vlan ID
              }
         }
     }

     ge-0/0/2 {
         unit 0 {
             family bridge {
                   interface-mode access;
                   vlan-id 50;             community port by vlan ID
              }

         }
     }

     ge-0/0/3 {
         unit 0 {
             family bridge {
                   interface-mode access;
                   vlan-id 60;             community port by vlan ID
              }
         }
     }

     ge-0/0/4 {
         unit 0 {
             family bridge {
                   interface-mode access;
                   vlan-id 60;             community port by vlan ID
              }
         }
     }

     irb {
        unit 0 {
           family inet {
	            address 22.22.22.1/24;
           }
     }
}

content_copy zoom_out_map
[edit]
routing-instances {
    vs-1 {
        instance-type virtual-switch;
        interface ge-0/0/1.0;
        interface ge-0/0/2.0;
        interface ge-0/0/3.0;
        interface ge-0/0/4.0;
        interface ge-0/0/9.0;
        interface ge-0/0/10.0;
        interface ge-0/0/12.0;
        interface ge-0/0/13.0;

 bridge-domains {
     bd1 {
             vlan-id 100;                /* primary vlan */
                   isolated-vlan 10;
                   community-vlans [50 60]
                   routing-interface irb.0 /* IRB interface */
      }
}
}

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying That the Private VLAN and Secondary VLANs Were Created

Purpose
Action
Meaning

Purpose

Verify that the primary VLAN and secondary VLANs were properly created on the switch.

Action

Use the show bridge domain command:

content_copy zoom_out_map
user@host> show bridge domain
Routing instance          Bridge domain            VLAN ID     Interfaces
default-switch                   bd1-primary-100           100
 				         	                                                 ge-0/0/9.0
				           	            													 ge-0/0/10.0
					                                                          ge-0/0/12.0
					                                                          ge-0/0/13.0
				         	                                                  ge-0/0/1.0
				         	                                                  ge-0/0/2.0
				         	                                                  ge-0/0/3.0

				         	                                                  ge-0/0/4.0

default-switch            			 bd1-isolation-10          10
 				         	                                                   ge-0/0/9.0
				                                                               ge-0/0/10.0
					                                                            ge-0/0/12.0
					                                                            ge-0/0/13.0
				         	

default-switch                    bd1-comunity-50          50
 				         	                                                   ge-0/0/9.0
				           	                                                   ge-0/0/13.0
  			         	                                                    ge-0/0/1.0
				         	                                                    ge-0/0/2.0
				         	 
default-switch                     bd1-comunity-60          60
 				         	                                                   ge-0/0/9.0
				           	                                                   ge-0/0/13.0
                                    				         	              ge-0/0/3.0
				         	                                                   ge-0/0/4.0

Meaning

The output shows that the primary VLAN was created and identifies the interfaces and secondary VLANs associated with it.

arrow_backward PREVIOUS Configuring IRB Interfaces in PVLAN Bridge Domains on MX Series Routers in Enhanced LAN Mode

NEXT arrow_forward Layer 2 Bridging Interfaces Overview

Ethernet Switching User Guide

ON THIS PAGE

Example: Configuring an IRB Interface in a Private VLAN on a Single MX Series Router

Requirements

Overview and Topology

Configuration

CLI Quick Configuration

Procedure

Step-by-Step Procedure

Results

Verification

Verifying That the Private VLAN and Secondary VLANs Were Created

Purpose

Action

Meaning

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry