Contents

Introduction· 1

Prerequisites· 1

General restrictions and guidelines· 1

Example: Configuring port isolation· 1

Network configuration· 1

Applicable hardware and software versions· 2

Restrictions and guidelines· 4

Procedures· 4

Verifying the configuration· 5

Configuration files· 5

 

Introduction

This document provides port isolation configuration examples.

Prerequisites

This document is not restricted to specific software or hardware versions.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of port isolation.

General restrictions and guidelines

You cannot assign the member ports of a service loopback group to an isolation group. You cannot assign the member ports of an isolation group to a service loopback group.

Example: Configuring port isolation

Network configuration

As shown in Figure 1, the company branches Site 1 and Site 2 transfer service traffic in VLAN 2 and VLAN 3. Device A connects to the Internet through GigabitEthernet 1/0/1.

Configure port isolation on Device A to meet the following requirements:

·     All hosts can access the Internet through Device A.

·     Host A and Host B are isolated from each other at Layer 2.

·     Host C and Host D are isolated from each other at Layer 2.

Figure 1 Network diagram

 

Applicable hardware and software versions

The following matrix shows the hardware and software versions to which this configuration example is applicable:

 

Hardware	Software version
S6812 switch series S6813 switch series	Release 66xx
S6550XE-HI switch series	Release 6008 and later
S6525XE-HI switch series	Release 6008 and later
S5850 switch series	Release 8005 and later
S5570S-EI switch series	Release 11xx
S5560X-EI switch series	Release 63xx, Release 65xx, Release 66xx
S5560X-HI switch series	Release 63xx, Release 65xx, Release 66xx
S5500V2-EI switch series	Release 63xx, Release 65xx, Release 66xx
MS4520V2-30F switch	Release 63xx, Release 65xx, Release 66xx
MS4520V2-30C switch MS4520V2-54C switch	Release 65xx, Release 66xx
MS4520V2-28S switch MS4520V2-24TP switch	Release 63xx
S6520X-HI switch series S6520X-EI switch series	Release 63xx, Release 65xx, Release 66xx
S6520X-SI switch series S6520-SI switch series	Release 63xx, Release 65xx, Release 66xx
S5000-EI switch series	Release 63xx, Release 65xx, Release 66xx
MS4600 switch series	Release 63xx, Release 65xx, Release 66xx
ES5500 switch series	Release 63xx, Release 65xx, Release 66xx
S5560S-EI switch series S5560S-SI switch series	Release 63xx
S5500V3-24P-SI switch S5500V3-48P-SI switch	Release 63xx
S5500V3-SI switch series (except S5500V3-24P-SI and S5500V3-48P-SI)	Release 11xx
S5170-EI switch series	Release 11xx
S5130S-HI switch series S5130S-EI switch series S5130S-SI switch series S5130S-LI switch series	Release 63xx
S5120V2-SI switch series S5120V2-LI switch series	Release 63xx
S5120V3-EI switch series	Release 11xx
S5120V3-36F-SI switch S5120V3-28P-HPWR-SI switch S5120V3-54P-PWR-SI switch	Release 11xx
S5120V3-SI switch series (except S5120V3-36F-SI, S5120V3-28P-HPWR-SI, and S5120V3-54P-PWR-SI)	Release 63xx
S5120V3-LI switch series	Release 63xx
S3600V3-EI switch series	Release 11xx
S3600V3-SI switch series	Release 11xx
S3100V3-EI switch series S3100V3-SI switch series	Release 63xx
S5110V2 switch series	Release 63xx
S5110V2-SI switch series	Release 63xx
S5000V3-EI switch series S5000V5-EI switch series	Release 63xx
S5000E-X switch series S5000X-EI switch series	Release 63xx
E128C switch E152C switch E500C switch series E500D switch series	Release 63xx
MS4320V2 switch series MS4320V3 switch series MS4300V2 switch series MS4320 switch series MS4200 switch series	Release 63xx
WS5850-WiNet switch series	Release 63xx
WS5820-WiNet switch series WS5810-WiNet switch series	Release 63xx
WAS6000 switch series	Release 63xx
IE4300-12P-AC switch IE4300-12P-PWR switch IE4300-M switch series IE4320 switch series	Release 63xx

 

Restrictions and guidelines

When you configure port isolation on the device, follow these restrictions and guidelines:

·     Before assigning a port to an isolation group, make sure the isolation group already exists.

·     You can assign a port to only one isolation group.

Procedures

# Create VLAN 2 and assign ports GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 to the VLAN.

<DeviceA> system-view

[DeviceA] vlan 2

[DeviceA-vlan2] port gigabitethernet 1/0/2

[DeviceA-vlan2] port gigabitethernet 1/0/3

[DeviceA-vlan2] quit

# Create VLAN 3 and assign ports GigabitEthernet 1/0/4 and GigabitEthernet 1/0/5 to the VLAN.

[DeviceA] vlan 3

[DeviceA-vlan3] port gigabitethernet 1/0/4

[DeviceA-vlan3] port gigabitethernet 1/0/5

[DeviceA-vlan3] quit

# Configure port GigabitEthernet 1/0/1 as a trunk port and assign it to VLAN 2 and VLAN 3.

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] port link-type trunk

[DeviceA-GigabitEthernet1/0/1] port trunk permit vlan 2 3

[DeviceA-GigabitEthernet1/0/1] quit

# Create isolation groups 1 and 2.

[DeviceA] port-isolate group 1

[DeviceA] port-isolate group 2

# Assign ports GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 to isolation group 1.

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] port-isolate enable group 1

[DeviceA-GigabitEthernet1/0/2] quit

[DeviceA] interface gigabitethernet 1/0/3

[DeviceA-GigabitEthernet1/0/3] port-isolate enable group 1

[DeviceA-GigabitEthernet1/0/3] quit

# Assign ports GigabitEthernet 1/0/4 and GigabitEthernet 1/0/5 to isolation group 2.

[DeviceA] interface gigabitethernet 1/0/4

[DeviceA-GigabitEthernet1/0/4] port-isolate enable group 2

[DeviceA-GigabitEthernet1/0/4] quit

[DeviceA] interface gigabitethernet 1/0/5

[DeviceA-GigabitEthernet1/0/5] port-isolate enable group 2

[DeviceA-GigabitEthernet1/0/5] quit

Verifying the configuration

# Display information about all isolation groups.

[DeviceA] display port-isolate group

 Port isolation group information:

 Group ID: 1

 Group members:

    GigabitEthernet1/0/2

    GigabitEthernet1/0/3

 

Group ID: 2

 Group members:

    GigabitEthernet1/0/4

    GigabitEthernet1/0/5

The output shows that:

·     Ports GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 are in isolation group 1. As a result, Host A and Host B are isolated from each other at Layer 2.

·     Ports GigabitEthernet 1/0/4 and GigabitEthernet 1/0/4 are in isolation group 2. As a result, Host C and Host D are isolated from each other at Layer 2.

Configuration files

	IMPORTANT: Support for the port link-mode bridge command depends on the device model.

 

#

 port-isolate group 1

 port-isolate group 2

#

vlan 2 to 3

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 3

#

interface GigabitEthernet1/0/2

 port link-mode bridge

 port access vlan 2

 port-isolate enable group 1

#

interface GigabitEthernet1/0/3

 port link-mode bridge

 port access vlan 2

 port-isolate enable group 1

#

interface GigabitEthernet1/0/4

 port link-mode bridge

 port access vlan 3

 port-isolate enable group 2

#

interface GigabitEthernet1/0/5

 port link-mode bridge

 port access vlan 3

 port-isolate enable group 2

#