Port isolation

[jamesrdelaney]

I would like to isolate some of my clients from other clients in the same VLAN.

I need each isolated client to be able to:

• Receive DHCP from DHCP server

• Access the internet

But I need each isolated client not to be able to talk in any way to the other isolated clients

I would also like to be able to ping the isolated clients from my laptop on a port that is not isolated for monitoring

I have tried to simulate this using eg:

configure ports 33 isolation on

configure ports 34 isolation on

When I plug two laptops into 33 and 34 and run wireshark on the laptop on port 34 I can see some broadcast messages from coming from the laptop in port 33 

Am I missing something - is my design OK?

Or do I need to restart the switch or something after issueing the command?

Switch type: X440G2-48td-10G

Version: 21.1.4

Thanks for any help!

James

[FredrikB · Accepted solution]

If you use port isolation in two switches and connect them via a distribution switch, the clients on one switch will still see the clients on the other one unless the dist also uses isolation. If you cascade the switches (no dist between them), you can isolate the downlink to the “downstream” switch in the “upstream” switch, but it will not work if you use EAPS or RSTP for redundancy.

If you still see broadcasts between two isolated ports, this feature may not be very good. I’d recommend upgrading to a recent EXOS before experimenting further. Right now, EXOS 30.7.1.1-patch1-54 is recommended for X440-G2 and EXOS 31.2.1.1  is the “Recommended Latest Feature Release”. I’d go for 31.2.

[jamesrdelaney]

Hi Stefan

So port isolation only works on a single switch?

Thanks

James

[Stefan_K_]

Can’t help you with your problem but if this vlan spans across several different switches, then port isolation is not the way to go anyways… Private VLAN would be the best solution here or ACLs.