- Table of Contents
- 02-Layer 2-LAN Switching Configuration Guide
- 01-MAC address table configuration
- 02-Bulk interface configuration
- 03-Ethernet interface configuration
- 04-Ethernet link aggregation configuration
- 05-Port isolation configuration
- 06-VLAN configuration
- 07-Loopback, null, and inloopback interface configuration
- 08-VLAN mapping configuration
- 09-VLAN termination configuration
- 10-Loop detection configuration
- 11-LLDP configuration
- 12-Service loopback group configuration
- 13-Spanning tree configuration
- 14-Cut-through Layer 2 forwarding configuration
- Related Documents
|05-Port isolation configuration||63.98 KB|
The port isolation feature isolates Layer 2 traffic for data privacy and security without using VLANs.
Ports in an isolation group cannot communicate with each other. However, they can communicate with ports outside the isolation group.
About this task
The device supports only one isolation group that is automatically created as isolation group 1. You cannot remove the isolation group or create other isolation groups on the device. The number of ports assigned to the isolation group is not limited.
Restrictions and guidelines
· The configuration in Layer 2 Ethernet interface view applies only to the interface.
· The configuration in Layer 2 aggregate interface view applies to the Layer 2 aggregate interface and its aggregation member ports. If the device fails to apply the configuration to the aggregate interface, it does not assign any aggregation member port to the isolation group. If the failure occurs on an aggregation member port, the device skips the port and continues to assign other aggregation member ports to the isolation group.
1. Enter system view.
2. Enter interface view.
¡ Enter Layer 2 Ethernet interface view.
interface interface-type interface-number
¡ Enter Layer 2 aggregate interface view.
interface bridge-aggregation interface-number
3. Assign the port to the isolation group.
By default, the port is not in the isolation group.
Execute display commands in any view.
Display port isolation group information.
display port-isolate group
As shown in Figure 1:
· LAN users Host A, Host B, and Host C are connected to HundredGigE 1/0/1, HundredGigE 1/0/2, and HundredGigE 1/0/3 on the device, respectively.
· The device connects to the Internet through HundredGigE 1/0/4.
Configure the device to provide Internet access for all the hosts, and isolate them from one another.
· By default, interfaces on the device are disabled (in ADM or Administratively Down state). To have an interface operate, you must use the undo shutdown command to enable that interface.
· The physical interfaces in this example operate in Layer 2 mode. By default, physical interfaces on the device operate in Layer 3 mode. To switch the interface operating mode for an interface, execute the port link-mode command on the interface.
# Assign HundredGigE1/0/1, HundredGigE1/0/2, and HundredGigE1/0/3 to the isolation group.
[Device] interface hundredgige 1/0/1
[Device-HundredGigE1/0/1] port-isolate enable
[Device] interface hundredgige 1/0/2
[Device-HundredGigE1/0/2] port-isolate enable
[Device] interface hundredgige 1/0/3
[Device-HundredGigE1/0/3] port-isolate enable
Verifying the configuration
# Display information about the isolation group.
[Device] display port-isolate group
Port isolation group information:
Group ID: 1
HundredGigE1/0/1 HundredGigE1/0/2 HundredGigE1/0/3
The output shows that HundredGigE 1/0/1, HundredGigE 1/0/2, and HundredGigE 1/0/3 are assigned to the isolation group. As a result, Host A, Host B, and Host C are isolated from one another at Layer 2.