Promiscuous ports must be ______________ to primary and secondary VLANs, and host ports must be ________________.