https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37184#M1861 On Secure Stacks "Protected Port" is available for client isolation. This can be also combined with NAC dynamic vlan assignment. (Not tested really but feature description sounds very good.)<BR /> <BR /> Compareable Features on S-Series and EXOS are needed. <BR /> <BR /> Private VLANs is not a solution because private VLANs needs static VLAN and Port configurations, so dynamic VLAN assignment via RADIUS / NAC is not possible.<BR /> <BR /> Any solution available ?<BR /> Tue, 12 Sep 2017 19:37:00 GMT M_Nees 2017-09-12T19:37:00Z https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37184#M1861 On Secure Stacks "Protected Port" is available for client isolation. This can be also combined with NAC dynamic vlan assignment. (Not tested really but feature description sounds very good.)<BR /> <BR /> Compareable Features on S-Series and EXOS are needed. <BR /> <BR /> Private VLANs is not a solution because private VLANs needs static VLAN and Port configurations, so dynamic VLAN assignment via RADIUS / NAC is not possible.<BR /> <BR /> Any solution available ?<BR /> Tue, 12 Sep 2017 19:37:00 GMT https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37184#M1861 M_Nees 2017-09-12T19:37:00Z https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37185#M1862 In EXOS there is a feature "port isolation" which does the trick.<BR /> You can configure it on the port with an UPM that is triggered from the security profile, which comes along with the vlan assignment via Radius.<BR /> <BR /> /André Tue, 12 Sep 2017 19:45:00 GMT https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37185#M1862 André_Herkenrat 2017-09-12T19:45:00Z https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37186#M1863 many thanks for that advice.<BR /> Tue, 12 Sep 2017 19:45:00 GMT https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37186#M1863 M_Nees 2017-09-12T19:45:00Z https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37187#M1864 Hi Community,<BR /> <BR /> i am looking still for that feature on s-series ... any advices ?<BR /> <BR /> Given Szeanrio:<BR /> All Edge ports on EOS (D- and B-Series) and EXOS Switches are working with protected ports. All Edge Switches are linked with S-Series which is the L3- / Inter-VLAN Router and the Central point for Servers. So client are only alloweded to communicate with Router IP or central Servers - not with other Clients (not on same not on other edge switches).<BR /> <BR /> Regards,<BR /> Matthias<BR /> Tue, 19 Sep 2017 17:22:00 GMT https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37187#M1864 M_Nees 2017-09-19T17:22:00Z https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37188#M1865 Talking with two of extreme pre-sales guys bring a good solution:<BR /> <BR /> s-series L2 ACL (starting with V8.42)!<BR /> <BR /> with a few lines i can allow communication to MAC of L3 Router, ARP, needed Broadcast traffic only and deny all other Client to Client traffic. <BR /> Logging function is very helpful to see if ruleset is complete.<BR /> <BR /> Regards,<BR /> Matthias <BR /> Tue, 19 Sep 2017 17:22:00 GMT https://community.extremenetworks.com/t5/extremewireless-general/feature-quot-protected-port-quot-needed-exos-and-s-series/m-p/37188#M1865 M_Nees 2017-09-19T17:22:00Z