setup private VLAN on 6509 switch

Summary

Private VLANs only work on 6509 switches. This example is a 6509 with two MSFCs running HSRP and routing every segment. One of the private VLANs (901) also has an additional WAN router plugged into port 8/48, which is only accessible by the three ports in private VLAN 901. The hosts plugged into 8/1, 8/2, and 8/3 will be able to talk to each other and to the routers mapped to their private VLAN. The hosts plugged into ports 8/4 and 8/5 will only be able to talk to the routers mapped to their respective private VLANs. All of the hosts in this example are in the same IP address range of 10.6.27.0/24.

Most of this information was stolen from cisco's documentation

Switch config

set vlan 1 8/1-5
set vlan 1 8/48		 unassign the ports
set vlan 10 pvlan-type primary initialize the VLAN
set vlan 901 pvlan-type community
set vlan 904 pvlan-type community
set vlan 905 pvlan-type community		 initialize the private VLANs (note: any VLAN number can be used)
set pvlan 10 901 8/1-3
set pvlan 10 904 8/4
set pvlan 10 905 8/5		 assign ports to the private VLANs
set pvlan mapping 10 901 15/1
set pvlan mapping 10 901 16/1
set pvlan mapping 10 901 8/48
set pvlan mapping 10 904 15/1
set pvlan mapping 10 904 16/1
set pvlan mapping 10 905 15/1
set pvlan mapping 10 905 16/1		 map the promiscuous ports for the router(s). In this case, pvlan 901 has three ports for machines that can talk to each other and three routers. The two MSFC's are probably setup for HSRP, and the router plugged into 8/48 is a special router for pvlan 901

Next, make sure the MSFCs are configured with IP addresses

MSFC 1 config 

interface vlan10
  ip address 10.6.27.2 255.255.255.0
  no ip redirects
  standby 10 priority 105
  standby 10 ip 10.6.27.1

MSFC 2 config 

interface vlan10
  ip address 10.6.27.3 255.255.255.0
  no ip redirects
  standby 10 priority 100
  standby 10 ip 10.6.27.1

Turning it all off

Delete the interfaces on the MSFCs and issue the following switch commands 
clear pvlan mapping 10 901 904 905 8/1-48
clear vlan 901
clear vlan 904
clear vlan 905
clear vlan 10