Port Isolation

[sirhc]

I am not sure we have the option of specifying VLANs for "port" isolation with out switch core. but I will explore it. MT is a soft switch meaning it is all handled in software where are we are using a switch core.

[mike99]

Just tryed it on RC15. Working fine. For those who would like to know how it work (since I didn't find any information about it), ports with isolation active won't be able to communicate with other ports with port isolation active but the will be able to communicate with every ports that ports isolation si not active.

That not what I expected but it will be enough for my need and it's really easy to configure and understand. In the end, it's even better for our need since any tech on the field will be able to understand and configure it without needing help of our sys admin team.

[adairw]

Thanks for the detail. did you happen to test with any vlans enabled? does it also isolate the vlans?
I haven't been able to spend any time testing yet, but that's really where I want/need it is on vlan on an interface.
IF it isolates anything on that port plus the vlan's that would be perfect.

[mike99]

Everything was still pluged so I gived it a try. I added VLAN 100 to every device, the netonix still can ping both isolated device, my pc with tagged vlan (iso disable on this port) still can ping both edgerouter on VLAN 100 (tagged VLAN) both a a port with iso enabled. With iso enabled on both port the're connected to, the 2 edgerouter can't ping each other.

Everything seem also fine on VLAN also. Traffic between ports tagged on the same VLAN won't be able to communicate between each one. Inter-VLANs traffic pass through the router so the switch (layer 2 only) won't be able to block this traffic. If it's what your looking for, it's the job of your router to do so via paquets filtering.

[adairw]

That will work for me! whoop!

[wayneorack]

..." whoop!"

An Aggie? Really?

[amckillip]

Ok so if I am understanding this correctly we can isolate traffic between our AP ports and leave it off on the BH so the APs can get out to the internet. Am I understanding this correctly?

[sirhc]

Ports that have Port Isolation checked on the Ports Tab can not talk to another port that also has Port Isolation checked but can talk to ports that do not have Port Isolation Checked.

Ports that do not have Port Isolation Checked can talk to all port.

[philipt]

I hate reopening an old tread, but I seem to have an issue with this... I have a wireless access point on a Port that is Isolated and a cisco switch plugged into another Isolated port. It seems however the computers on the switch and the computers on the Access Point can access each other. Am I misunderstanding how this is supposed to work or is the Cisco somehow messing things up?

Thanks

[Eric Stern]

Port isolation prevents traffic being passed between isolated ports on layer 2. But if the traffic makes it to a router its quite possible for the devices to be able to communicate at layer 3. You would have to use a firewall or similar mechanism to prevent communication at layer 3.