Private Vlan's

First, we need to define secondary vlan's. We have to do it first, because they will be mapped to the primary vlan in a latter step.

vlan 201

 private-vlan community

vlan 202

 private-vlan isolated

Next, we need to identify primary vlan's and they association with secondary vlans

vlan 2

 private-vlan primary

 private-vlan association  201, 202

Now we need to identify switch ports. First, let's configure the ports connected to the user devices.

int fa0/1

 switchport mode private-vlan host

 switchport private-vlan host-association 2 201

int range fa0/2 - 3 

 switchport mode private-vlan host

 switchport private-vlan host-association 2 202

Now we need to identify any promiscuous ports on the switch. Routers will be connected to those ports.

int fa0/24

 switchport mode private-vlan promiscuous

 switchport private-vlan mapping 2 201, 202