Here are the key aspects of Private VLAN functioning: The Primary VLAN delivers frames downstream from the router (promisc port) to all mapped hosts. The Isolated VLAN transports frames from the stub hosts upstream to the router The Community VLANs allow bi-directional frame exchange withing a single group, in addition to forwarding frames upstream towards “P”-ports. Ethernet MAC address learning and forwarding procedure remain the same, as well as broadcast/multicast flooding procedure within boundaries of primary/secondary VLANs.