Contents

Introduction· 1

Prerequisites· 1

Example: Configuring port isolation· 1

Network configuration· 1

Software versions used· 2

Restrictions and guidelines· 2

Procedures· 2

Verifying the configuration· 2

Configuration files· 3

Related documentation· 3

Introduction

The following information provides examples for port isolation.

Prerequisites

This document applies to Comware 9-based routers. Procedures and information in the examples might be slightly different depending on the software or hardware version of the router.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of port isolation.

Example: Configuring port isolation

Network configuration

As shown in Figure 1:

·     LAN users Host A and Host B are connected to GigabitEthernet 0/0/1 and GigabitEthernet 0/0/2 on the device, respectively.

·     The device connects to the Internet through GigabitEthernet 0/0/3.

Configure the device to provide Internet access for Host A and Host B, and isolate them from each other.

Figure 1 Network diagram

‌

Software versions used

This configuration example was created and verified on R9141P16 of the MSR2630E-X1 device.

Restrictions and guidelines

The device supports only one isolation group, which is automatically created by the system as isolation group 1. Users cannot delete this isolation group or create other isolation groups. The number of ports that can be added to the isolation group is not limited.

Procedures

# Assign GigabitEthernet 0/0/1 and GigabitEthernet 0/0/2 to the isolation group.

<Device> system-view

[Device] interface gigabitethernet 0/0/1

[Device-GigabitEthernet0/0/1] port-isolate enable

[Device-GigabitEthernet0/0/1] quit

[Device] interface gigabitethernet 0/0/1

[Device-GigabitEthernet0/0/2] port-isolate enable

[Device-GigabitEthernet0/0/2] quit

Verifying the configuration

# Display information about the isolation group.

[Device] display port-isolate group

Port isolation group information:

Group ID: 1

Group members:

GigabitEthernet0/0/1   GigabitEthernet0/0/2

The output shows that GigabitEthernet 0/0/1 and GigabitEthernet 0/0/2 are assigned to the isolation group. As shown in Figure 2, Host A and Host B are isolated from each other at Layer 2.

Figure 2 Host A ping Host B

Configuration files

#

interface GigabitEthernet0/0/1

 port link-mode bridge

port-isolate enable

#

interface GigabitEthernet0/0/2

 port link-mode bridge

port-isolate enable

#

Related documentation

·     H3C MSR1000[2600][3600] Routers Configuration Guides(V9)

·     H3C MSR1000[2600][3600] Routers Command References(V9)