Contents

Configuring port isolation· 1

About port isolation· 1

Configuration profile support for commands· 1

Assigning a port to the isolation group· 1

Verifying and maintaining port isolation· 1

Port isolation configuration example· 2

Configuring port isolation

About port isolation

The port isolation feature isolates Layer 2 traffic for data privacy and security without using VLANs.

Ports in an isolation group cannot communicate with each other. However, they can communicate with ports outside the isolation group. ‌

Configuration profile support for commands

You can execute some commands of this feature in configuration profile view. For more information, see the command reference for this feature. For more information about configuration profiles, see configuration file management in Fundamentals Configuration Guide.

Assigning a port to the isolation group

About this task

The device supports only one isolation group that is automatically created as isolation group 1. You cannot remove the isolation group or create other isolation groups on the device. The number of ports assigned to the isolation group is not limited.

Restrictions and guidelines

·     The configuration in Layer 2 Ethernet interface view applies only to the interface.

·     The configuration in Layer 2 aggregate interface view applies to the Layer 2 aggregate interface and its aggregation member ports. If the device fails to apply the configuration to the aggregate interface, it does not assign any aggregation member port to the isolation group. If the failure occurs on an aggregation member port, the device skips the port and continues to assign other aggregation member ports to the isolation group.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

¡     Enter Layer 2 Ethernet interface view.

interface interface-type interface-number

¡     Enter Layer 2 aggregate interface view.

interface bridge-aggregation interface-number

3.     Assign the port to the isolation group.

port-isolate enable

By default, the port is not in the isolation group.

Verifying and maintaining port isolation

To display the information about an isolation group, execute the following command in any view.

display port-isolate group

Port isolation configuration example

Network requirements

As shown in Figure 1, AP 1, AP 2, and AP 3 are connected to GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 on the AC, respectively. The AC connects to the Internet through GigabitEthernet 1/0/4.

Configure the AC to provide Internet access for the APs, and isolate APs from one another.

Figure 1 Network diagram

Configuration procedure

# Assign ports GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 to the isolation group.

<AC> system-view

[AC] interface gigabitethernet 1/0/1

[AC-GigabitEthernet1/0/1] port-isolate enable

[AC-GigabitEthernet1/0/1] quit

[AC] interface gigabitethernet 1/0/2

[AC-GigabitEthernet1/0/2] port-isolate enable

[AC-GigabitEthernet1/0/2] quit

[AC] interface gigabitethernet 1/0/3

[AC-GigabitEthernet1/0/3] port-isolate enable

[AC-GigabitEthernet1/0/3] quit

Verifying the configuration

# Display information about the isolation group.

[AC] display port-isolate group

 Port isolation group information:

 Group ID: 1

 Group members:

    GigabitEthernet1/0/1     GigabitEthernet1/0/2     GigabitEthernet1/0/3

The output shows that ports GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 are assigned to the isolation group. As a result, the APs are isolated from one another at Layer 2.