二层技术-端口隔离配置概论.pdfVIP

目 录 1 端口隔离配置 ······························································································································ ······· 1-1  1.1 端口隔离简介·····································································································································1-1  1.2 配置设备的隔离组 ····························································································································· 1-2  1.2.1 将端口加入隔离组 ··················································································································· 1-2  1.2.2 配置隔离组的上行端口 ··········································································································· 1-2  1.3 隔离组显示和维护 ····························································································································· 1-3  1.4 端口隔离典型配置举例 ······················································································································ 1-3  i 1 端口隔离配置 1.1 端口隔离简介 为了实现报文之间的二层隔离，可以将不同的端口加入不同的 VLAN ，但会浪费有限的VLAN 资源。 采用端口隔离特性，可以实现同一 VLAN 内端口之间的隔离。用户只需要将端口加入到隔离组中， 就可以实现隔离组内端口之间二层数据的隔离。端口隔离功能为用户提供了更安全、更灵活的组网 方案。 为了使隔离组内端口与隔离组外二层互通，用户必须为隔离组配置上行口。 目前，隔离组内可以加入的端口数量没有限制。 • 聚合组的成员端口不允许配置成为上行端口。反之，已经配置为上行端口的接口不能加入聚合 组。特殊情况下（为了兼容旧的配置文件），如果用户同时配置端口为聚合组的成员端口和隔离 组的上行端口，则只有聚合组配置生效，隔离组将被删除。（聚合相关内容请参见“二层技术- 以太网交换配置指导”中的“以太网链路聚合”）。 • 目前隔离组中的普通端口，除了支持MAC 地址学习、部分应用在此端口上入方向的策略所对应 的流行为（accounting、filter deny、car cir committed-information-rate red discard、流镜 像）、聚合功能外，其它功能均不支持。 • 建议您不要在隔离组的普通端口上配置二三层协议（例如GVRP 等二层协议；组播、路由等三 层协议）。否则可能造成数据转发的异常或者协议振荡。 对于属于不同VLAN 的端口，只有同一个隔离组的普通端口到上行端口的二层报文可以单向通过， 其它情况的端口二层数据是