Please forgive VLAN noobishness.
I'm trying to segregate traffic on a network using VLANs. I want all users to be able to receive and transmit to the internet, so I have a VLAN for this.
I also have three other VLANs which should only see ports on the same VLAN, plus the internet VLAN. As far as I can see I need to use an asymmetric VLAN arrangement for this.
The problem I seem to be having is that some devices will not see any packets leaving a port that are tagged, while others do.
Ideally, I'd like to set more than one VLAN to be untagged for certain ports, but not all of my switches support this.
I had assumed that the tag would be ignored by any device not looking for tagged frames, but it seems that some just ignore the tagged frames completely, while processing untagged frames normally.
Am I just going to have to fork out for switches that support multiple untagged VLANs exiting a port?
Best Answer
There is a solution that does exactly what you are asking for, but its implementation depends on the vendor. Cisco calls it Private VLANs or PVLANs.
PVLANs provide layer 2 isolation between ports within the same broadcast domain. There are three types of PVLAN ports:
In your case, you would configure 3 communities and one promiscuous port.