Solved: Separate traffic from port to port

nguyenquangthuat · ‎05-13-2008

Dear experts,

I have 1 2960 switch. I need to separate traffic from each switch port to the others except for one or more common ports.

For example. I have 3 ports: 1,2,3. I need to make sure that

- Traffic from port 1 can not reach port 2 and vice-versa

- Traffic from both port 1 and 2 can reach port 3 and vice-versa.

Can I use VLAN to solve this problem ? As I see that some switch has the ability to assign multiple VLANs to one port. But I found no ways to do this with a cisco switch.

Would you please recommend me a solution to complete this task using no more than a 2960 switch?

Notes: I think that trunk port won't work as no other device in the system is VLAN-Sensitive except for that 2960

rsohi · ‎05-13-2008

This might add some value as well:

Some applications require that no traffic be forwarded at Layer 2 between ports on the same switch so that one neighbor does not see the traffic generated by another neighbor. In such an environment, the use of protected ports ensures that there is no exchange of unicast, broadcast, or multicast traffic between these ports on the switch.

Protected ports have these features:

â€¢A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that is also a protected port. Data traffic cannot be forwarded between protected ports at Layer 2; only control traffic, such as PIM packets, is forwarded because these packets are processed by the CPU and forwarded in software. All data traffic passing between protected ports must be forwarded through a Layer 3 device.

â€¢Forwarding behavior between a protected port and a nonprotected port proceeds as usual.

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_25_see/configuration/guide/swtrafc.html#wp1029319

regards,

Raj

View solution in original post

sirdudesly · ‎05-13-2008

Yes you would use VLAN's to do this, vlan design is fairly well documented on the cisco site.

Collin Clark · ‎05-13-2008

What you want to configure is private VLAN's. Here's a link with a good explaination.

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008013565f.shtml

Hope that helps.

rsohi · ‎05-13-2008

This might add some value as well:

Some applications require that no traffic be forwarded at Layer 2 between ports on the same switch so that one neighbor does not see the traffic generated by another neighbor. In such an environment, the use of protected ports ensures that there is no exchange of unicast, broadcast, or multicast traffic between these ports on the switch.

Protected ports have these features:

â€¢A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that is also a protected port. Data traffic cannot be forwarded between protected ports at Layer 2; only control traffic, such as PIM packets, is forwarded because these packets are processed by the CPU and forwarded in software. All data traffic passing between protected ports must be forwarded through a Layer 3 device.

â€¢Forwarding behavior between a protected port and a nonprotected port proceeds as usual.

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_25_see/configuration/guide/swtrafc.html#wp1029319

regards,

Raj

nguyenquangthuat · ‎05-13-2008

Tks for your replys so much,

As checking some guidelines I see that 2960 only supports PVLAN EDGE (PROTECTED PORT).

Please tell me that if PVLAN EDGE will work in my case or not ?

A sample configuration for my case (3 ports, port 3 is the common one) is appreciated

Tks so much

rsohi · ‎05-14-2008

Hello, from your description this should work. Basically, make ports 1 and 2 protected. Protected ports won't talk to each other. Port is unprotected so it should be able to communicate with the other ports.

regards,

Raj