Dell SmartFabric OS10 User Guide Release 10.5.3

Port security

OS10 supports the following port security features on promiscuous, secondary, and ISL ports: MAC address learning limit, sticky MAC, MAC address movement control, and MAC address aging.

For MAC address movement between secondary ports that are associated with different secondary VLANs within the PVLAN domain:

• The shutdown-original and shutdown-offending violation actions are supported.
• The drop and drop-and-log violation actions are not supported.

For more information on the Port Security feature, see Port security.

L3 interfaces, protocols, and applications

OS10 supports configuring IP addresses, both IPv4 and IPv6 addresses, only on primary VLANs including secondary IP addresses. Secondary VLANs are L2 VLANs.

In a PVLAN, Border Gateway Protocol (BGP), Open Shortest Path First (OSPF), and VRRP are supported only on the primary VLAN.

OS10 supports only the default VRF in a PVLAN domain. Nondefault VRF is not supported.

Spanning Tree Protocol

In a PVLAN, Rapid-PVST, RSTP, and MSTP are supported on the primary and secondary VLANs. Dell Technologies recommends that if you connect the secondary ports to servers or host devices and not to a switch:

• Configure secondary ports as edge ports for faster convergence.
• Enable BPDU guard to prevent loops that might occur because of misconfigurations.

Address Resolution Protocol

For communication between the PVLAN secondary port-connected devices, OS10 uses the Local Proxy ARP feature that Linux supports.

L2 communication is not permitted between hosts connected to ports in an isolated VLAN and hosts connected to ports in any of the secondary VLANs. Also, hosts connected to ports in a community VLAN cannot communicate with hosts connected to ports in another community or isolated VLAN.

However, these hosts can communicate with each other over L3 through the primary VLAN. To configure an L3 VLAN interface, enable the local proxy ARP feature. For more information, see Configure Layer 3 VLAN interface. For ARP requests from hosts in the secondary VLANs, the primary VLAN responds with an ARP reply and routes the packets between them.

Access control lists

You can apply IP ACLs and MAC ACLs on the primary VLAN, and MAC ACLs on the secondary VLAN ports.

Multicast support for PVLAN

OS10 supports enabling Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Protocol snooping in a PVLAN domain. Enabling IGMP and MLD snooping allows switches to forward multicast traffic only to IGMP and MLD receivers and hence conserve network resources. It offers the following benefits:

• Improves network bandwidth utilization by forwarding multicast traffic only to multicast receiver ports.
• Provides increased security by preventing an unknown multicast flood to all the VLAN member ports.

Important notes

• OS10 supports enabling IGMP and MLD snooping only on primary VLANs, and it automatically enables IGMP and MLD snooping on all the associated secondary VLANs. When you disable IGMP and MLD snooping on a primary VLAN, the system disables it from the associated secondary VLANs as well.
• IGMP and MLD snooping commands are not allowed on secondary VLANs.
• OS10 supports the Multicast Flood Restrict feature in a PVLAN domain.
• You cannot configure a secondary port as an mrouter port. Dynamic mrouter port learning is disabled on secondary ports.
• OS10 does not support L3 IGMP and PIM configuration commands in a PVLAN domain. These features are not allowed on primary, isolated, and community VLANs.

PVLAN with VLT

You can configure Virtual Link Trunking (VLT) peer nodes in a PVLAN domain. With VLT being an L2 redundancy mechanism, support for VLT nodes in a PVLAN:

• Provides a loop-free network with optimal bandwidth utilization.
• Enables L2 security functionalities.

Important notes

• PVLAN configurations of VLT-VLAN and VLT port channels must be identical on both VLT peer nodes. PVLAN IDs and mappings must be identical on both VLT peer nodes as well.
• Enable local proxy ARP in the primary VLAN on both VLT peers. Even though you configure the local proxy ARP on both the VLT peer nodes, only the VLT primary node processes the ARP requests. When the primary VLT node reboots and the secondary VLT node transitions to become the primary VLT node, it processes the ARP requests.
• If you enable the Local Proxy ARP feature, enable VLT peer routing on both the VLT peer nodes.
• A VLT port channel can be a promiscuous port, secondary VLAN port, or ISL trunk port.
• MAC address replication in a PVLAN domain is based on the local configuration of the VLT peer node.