H3C S12500R Switch Router Series
Port Isolation Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The information in this document is subject to change without notice.

 

Contents

Introduction· 1

Prerequisites· 1

General restrictions and guidelines· 1

Example: Configuring port isolation· 1

Network configuration· 1

Software versions used· 2

Restrictions and guidelines· 2

Procedures· 2

Verifying the configuration· 2

Configuration files· 2

Related documentation· 3

 

Introduction

This document provides port isolation configuration examples.

Prerequisites

This document is not restricted to specific software or hardware versions.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of port isolation.

General restrictions and guidelines

You cannot assign the member ports of a service loopback group to an isolation group. When you assign the member ports of an isolation group to a service loopback group, the port isolation settings are removed from these ports.

Example: Configuring port isolation

Network configuration

As shown in Figure 1:

·     LAN users Host A, Host B, and Host C are connected to HundredGigE 1/0/1, HundredGigE 1/0/2, and HundredGigE 1/0/3 on the device, respectively.

·     The device is connected to the Internet through HundredGigE 1/0/4.

Configure the device to provide Internet access for all the hosts, and isolate them from one another.

Figure 1 Network diagram

 

Software versions used

This configuration example was created and verified on R3606.

Restrictions and guidelines

By default, interfaces on the device are disabled (in ADM or Administratively Down state). To have an interface operate, you must use the undo shutdown command to enable that interface.

Procedures

# Configure HundredGigE1/0/1, HundredGigE1/0/2, and HundredGigE1/0/3 to operate in bridge mode.

<Device> system-view

[Device] interface range hundredgige 1/0/1 to hundredgige 1/0/3

[Device-if-range] port link-mode bridge

[Device-if-range] quit

# Assign HundredGigE 1/0/1, HundredGigE 1/0/2, HundredGigE 1/0/3 to the isolation group.

<Device> system-view

[Device] interface hundredgige 1/0/1

[Device-HundredGigE1/0/1] port-isolate enable

[Device-HundredGigE1/0/1] quit

[Device] interface hundredgige 1/0/2

[Device-HundredGigE1/0/2] port-isolate enable

[Device-HundredGigE1/0/2] quit

[Device] interface hundredgige 1/0/3

[Device-HundredGigE1/0/3] port-isolate enable

[Device-HundredGigE1/0/3] quit

Verifying the configuration

# Display information about the isolation group.

[Device] display port-isolate group

 Port isolation group information:

 Group ID: 1

 Group members:

    HundredGigE1/0/1

    HundredGigE1/0/2

    HundredGigE1/0/3

The output shows that HundredGigE 1/0/1, HundredGigE 1/0/2, HundredGigE 1/0/3 are in the isolation group. As a result, Host A, Host B, and Host C are isolated from one another at Layer 2.

Configuration files

#

interface HundredGigE1/0/1

port link-mode bridge

port-isolate enable

#

interface HundredGigE1/0/2

port link-mode bridge

port-isolate enable

#

interface HundredGigE1/0/3

port link-mode bridge

port-isolate enable

#

Related documentation

·     H3C S12500R Switch Router Series Layer 2—LAN Switching Command Reference-R3606

·     H3C S12500R Switch Router Series Layer 2—LAN Switching Configuration Guide-R3606