Contents

Configuring port isolation· 1

About port isolation· 1

Restrictions: Hardware compatibility with port isolation· 1

Assigning a port to the isolation group· 1

Display and maintenance commands for port isolation· 2

Port isolation configuration examples· 2

Example: Configuring port isolation for multiple isolation groups· 2

 

Configuring port isolation

About port isolation

The port isolation feature isolates Layer 2 traffic for data privacy and security without using VLANs.

Ports in an isolation group cannot communicate with each other. However, they can communicate with ports outside the isolation group.

Restrictions: Hardware compatibility with port isolation

Port isolation is not supported on the CSPC-GE16XP4L-E, CSPC-GE24L-E, CSPC-GP24GE8XP2L-E, CSPEX, or CEPC cards. A Layer 2 aggregate interface with member ports on these cards cannot be assigned to an isolation group. Ports on these cards cannot be assigned to a Layer 2 aggregate interface if the aggregate interface has been assigned to an isolation group.

Assigning a port to the isolation group

About port assignment to the isolation group

The device supports only one isolation group that is automatically created as isolation group 1. You cannot remove the isolation group or create other isolation groups on the device. The number of ports assigned to the isolation group is not limited.

Restrictions and guidelines

·          The configuration in Layer 2 Ethernet interface view applies only to the interface.

·          The configuration in Layer 2 aggregate interface view applies to the Layer 2 aggregate interface and its aggregation member ports. If the device fails to apply the configuration to the aggregate interface, it does not assign any aggregation member port to the isolation group. If the failure occurs on an aggregation member port, the device skips the port and continues to assign other aggregation member ports to the isolation group.

Procedure

1.        Enter system view.

system-view

2.        Enter interface view.

¡  Enter Layer 2 Ethernet interface view.

interface interface-type interface-number

¡  Enter Layer 2 aggregate interface view.

interface bridge-aggregation interface-number

3.        Assign the port to the isolation group.

port-isolate enable

By default, the port is not in the isolation group.

Display and maintenance commands for port isolation

Execute display commands in any view.

 

Task	Command
Display isolation group information.	display port-isolate group [ group-id ]

 

Port isolation configuration examples

Example: Configuring port isolation for multiple isolation groups

Network configuration

As shown in Figure 1:

·          LAN users Host A, Host B, and Host C are connected to GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 on the device, respectively.

·          The device connects to the Internet through GigabitEthernet 1/0/4.

Configure the device to provide Internet access for the hosts, and isolate them from one another at Layer 2.

Figure 1 Network diagram

‌

Procedure

# Create isolation group 2.

<Device> system-view

[Device] port-isolate group 2

# Assign GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 to isolation group 2.

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] port-isolate enable group 2

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] port-isolate enable group 2

[Device-GigabitEthernet1/0/2] quit

[Device] interface gigabitethernet 1/0/3

[Device-GigabitEthernet1/0/3] port-isolate enable group 2

[Device-GigabitEthernet1/0/3] quit

Verifying the configuration

# Display information about isolation group 2.

[Device] display port-isolate group 2

 Port isolation group information:

 Group ID: 2

 Group members:

   GigabitEthernet1/0/1     GigabitEthernet1/0/2     GigabitEthernet1/0/3

 Community VLAN ID: None

The output shows that GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 are assigned to isolation group 2. As a result, Host A, Host B, and Host C are isolated from one another at layer 2.