Private VLAN on HP Switch – Configuration Guide

When an isolated port transmits data, that data is mapped into an auxiliary VLAN. Data in the auxiliary VLAN will be mapped to the primary VLAN -only- for transmission to promiscuous ports. Promiscuous ports, in turn, transmit data into the primary VLAN. All ports can receive information in the primary VLAN.

Putting an otherwise isolated port into a community VLAN means that traffic it transmits will be mapped into both the auxiliary and the community VLAN. Community ports will receive data from both the primary and the community VLAN.

A given pair of ports will have bidirectional communication under the following conditions-

1. One or both are promiscuous, or...
2. Both are in the same PVLAN community.

VACL's are a completely different mechanism and provide some measure of per-packet (and usually protocol based) control of traffic bridged within a given VLAN. You might, for instance, block traffic on TCP/80 between all hosts within the VLAN while allowing all other traffic to pass.

It's possible to approximate the effects of PVLAN's by using a VACL but this tends to be somewhat fragile, difficult to manage and there are often inherent hardware limitations with which to contend (...highly dependent on platform).

The HP 2520 is a layer 2 switch: all you can do with it is bridge the individual VLANs tagged on port 48. Then, as long as what is at the other end of it has the right VLANs, gateway addresses and routing set up, all should be fine.

Update: any intermediate switches will also need the VLANs present: tagged on both the uplink and downlink ports.

You do not need to worry about IP ranges.