H3C S6805 & S6825 & S6850 & S9850 & S9820
Port Isolation Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

General restrictions and guidelines· 1

Example: Configuring port isolation· 1

Network configuration· 1

Applicable hardware and software versions· 2

Restrictions and guidelines· 2

Procedures· 2

Verifying the configuration· 3

Configuration files· 4

Related documentation· 4

 

Introduction

This document provides port isolation configuration examples.

Prerequisites

This document is not restricted to specific software or hardware versions.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of port isolation.

General restrictions and guidelines

You cannot assign the member ports of a service loopback group to an isolation group. You cannot assign the member ports of an isolation group to a service loopback group.

Example: Configuring port isolation

Network configuration

As shown in Figure 1, the company branches Site 1 and Site 2 transfer service traffic in VLAN 2 and VLAN 3. Device A connects to the Internet through HundredGigE 1/0/1.

Configure port isolation on Device A to meet the following requirements:

·     All hosts can access the Internet through Device A.

·     Host A and Host B are isolated from each other at Layer 2.

·     Host C and Host D are isolated from each other at Layer 2.

Figure 1 Network diagram

 

Applicable hardware and software versions

The following matrix shows the hardware and software versions to which this configuration example is applicable:

 

Hardware	Software version
S6850 switch series	Release 6607, Release 6616, Release 6616P01, Release 6635 and later versions.
S6825 switch series	Release 6616, Release 6616P01, Release 6635 and later versions.
S6850 switch series S9850 switch series	Release 6555P01, Release 6607, Release 6616, Release 6616P01, Release 6635 and later versions.
S9820-64H switch	Release 6555P01, Release 6607, Release 6616, Release 6616P01, Release 6635 and later versions.
S9820-8C switch	Release 6607, Release 6616, Release 6616P01, Release 6635 and later versions.

 

Restrictions and guidelines

When you configure port isolation on the device, follow these restrictions and guidelines:

·     Before assigning a port to an isolation group, make sure the isolation group already exists.

·     You can assign a port to only one isolation group.

Procedures

# Create VLAN 2 and assign ports HundredGigE 1/0/2 and HundredGigE 1/0/3 to the VLAN.

<DeviceA> system-view

[DeviceA] vlan 2

[DeviceA-vlan2] port hundredgige 1/0/2

[DeviceA-vlan2] port hundredgige 1/0/3

[DeviceA-vlan2] quit

# Create VLAN 3 and assign ports HundredGigE 1/0/4 and HundredGigE 1/0/5 to the VLAN.

[DeviceA] vlan 3

[DeviceA-vlan3] port hundredgige 1/0/4

[DeviceA-vlan3] port hundredgige 1/0/5

[DeviceA-vlan3] quit

# Configure port HundredGigE 1/0/1 as a trunk port and assign it to VLAN 2 and VLAN 3.

[DeviceA] interface hundredgige 1/0/1

[DeviceA-HundredGigE1/0/1] port link-type trunk

[DeviceA-HundredGigE1/0/1] port trunk permit vlan 2 3

[DeviceA-HundredGigE1/0/1] quit

# Create isolation groups 1 and 2.

[DeviceA] port-isolate group 1

[DeviceA] port-isolate group 2

# Assign ports HundredGigE 1/0/2 and HundredGigE 1/0/3 to isolation group 1.

[DeviceA] interface hundredgige 1/0/2

[DeviceA-HundredGigE1/0/2] port-isolate enable group 1

[DeviceA-HundredGigE1/0/2] quit

[DeviceA] interface hundredgige 1/0/3

[DeviceA-HundredGigE1/0/3] port-isolate enable group 1

[DeviceA-HundredGigE1/0/3] quit

# Assign ports HundredGigE 1/0/4 and HundredGigE 1/0/5 to isolation group 2.

[DeviceA] interface hundredgige 1/0/4

[DeviceA-HundredGigE1/0/4] port-isolate enable group 2

[DeviceA-HundredGigE1/0/4] quit

[DeviceA] interface hundredgige 1/0/5

[DeviceA-HundredGigE1/0/5] port-isolate enable group 2

[DeviceA-HundredGigE1/0/5] quit

Verifying the configuration

# Display information about all isolation groups.

[DeviceA] display port-isolate group

 Port isolation group information:

 Group ID: 1

 Group members:

    HundredGigE1/0/2

    HundredGigE1/0/3

 

Group ID: 2

 Group members:

    HundredGigE1/0/4

    HundredGigE1/0/5

The output shows that:

·     Ports HundredGigE 1/0/2 and HundredGigE 1/0/3 are in isolation group 1. As a result, Host A and Host B are isolated from each other at Layer 2.

·     Ports HundredGigE 1/0/4 and HundredGigE 1/0/4 are in isolation group 2. As a result, Host C and Host D are isolated from each other at Layer 2.

Configuration files

#

 port-isolate group 1

 port-isolate group 2

#

vlan 2 to 3

#

interface HundredGigE1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 3

#

interface HundredGigE1/0/2

 port link-mode bridge

 port access vlan 2

 port-isolate enable group 1

#

interface HundredGigE1/0/3

 port link-mode bridge

 port access vlan 2

 port-isolate enable group 1

#

interface HundredGigE1/0/4

 port link-mode bridge

 port access vlan 3

 port-isolate enable group 2

#

interface HundredGigE1/0/5

 port link-mode bridge

 port access vlan 3

 port-isolate enable group 2

#

Related documentation

Use this document in conjunction with the following documents for the product and software version you are working with:

·     Layer 2—LAN Switching Configuration Guide

·     Layer 2—LAN Switching Command Reference