Document version: 6W100-20190628

Contents

Introduction· 1

Prerequisites· 1

General configuration restrictions and guidelines· 1

Example: Configuring port isolation· 1

Network configuration· 1

Software versions used· 2

Restrictions and guidelines· 2

Procedures· 2

Verifying the configuration· 2

Configuration files· 2

Related documentation· 3

Introduction

This document provides port isolation configuration examples.

Prerequisites

This document is not restricted to specific software or hardware versions.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of port isolation.

General configuration restrictions and guidelines

You cannot assign the member ports of a service loopback group to an isolation group. You cannot assign the member ports of an isolation group to a service loopback group.

Example: Configuring port isolation

Network configuration

As shown in Figure 1:

·          LAN users Host A, Host B, and Host C are connected to Ten-GigabitEthernet 1/0/1, Ten-GigabitEthernet 1/0/2, and Ten-GigabitEthernet 1/0/3 on the device, respectively.

·          The device is connected to the Internet through Ten-GigabitEthernet 1/0/4.

Configure the device to provide Internet access for all the hosts, and isolate them from one another.

Figure 1 Network diagram

Software versions used

This configuration example was created and verified on S6890-CMW710-R2712.

Restrictions and guidelines

By default, interfaces on the device are disabled (in ADM or Administratively Down state). To have an interface operate, you must use the undo shutdown command to enable that interface.

Procedures

# Assign Ten-GigabitEthernet 1/0/1, Ten-GigabitEthernet 1/0/2, Ten-GigabitEthernet 1/0/3 to isolation group 1.

<Device> system-view

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] port-isolate enable

[Device-Ten-GigabitEthernet1/0/1] quit

[Device] interface ten-gigabitethernet 1/0/2

[Device-Ten-GigabitEthernet1/0/2] port-isolate enable

[Device-Ten-GigabitEthernet1/0/2] quit

[Device] interface ten-gigabitethernet 1/0/3

[Device-Ten-GigabitEthernet1/0/3] port-isolate enable

[Device-Ten-GigabitEthernet1/0/3] quit

Verifying the configuration

# Display information about the isolation group.

[Device] display port-isolate group

 Port isolation group information:

 Group ID: 1

 Group members:

    Ten-GigabitEthernet1/0/1

    Ten-GigabitEthernet1/0/2

    Ten-GigabitEthernet1/0/3

The output shows that Ten-GigabitEthernet 1/0/1, Ten-GigabitEthernet 1/0/2, Ten-GigabitEthernet 1/0/3 are in isolation group 1. As a result, Host A, Host B, and Host C are isolated from one another at Layer 2.

Configuration files

#                                                                              

 port-isolate enable                                                          

#

interface Ten-GigabitEthernet1/0/1

port link-mode bridge

port-isolate enable

#

interface Ten-GigabitEthernet1/0/2

port link-mode bridge

port-isolate enable

#

interface Ten-GigabitEthernet1/0/3

port link-mode bridge

port-isolate enable

#

Related documentation

·          H3C S6890 Switch Series Layer 2—LAN Switching Command Reference (R27xx)

·          H3C S6890 Switch Series Layer 2—LAN Switching Configuration Guide (R27xx)