CloudEngine S5700 V600R022C01 Command Reference
Port Isolation Configuration Commands
am isolate
Function
The am isolate command enables unidirectional isolation of an interface from a specified interface.
The undo am isolate command disables unidirectional isolation of an interface from a specified interface.
By default, unidirectional isolation of an interface from a specified interface is disabled.
Format
am isolate { { interface-type interface-number1 | interface-name } &<1-8> | { interface-type interface-number1 to interface-number2 } }
undo am isolate [ { interface-type interface-number1 | interface-name } &<1-8> | { interface-type interface-number1 to interface-number2 } ]
Parameters
| Parameter | Description | Value |
|---|---|---|
| interface-type |
Specifies the type of an interface. |
- |
| interface-number1 |
Specifies the start interface number. |
- |
| interface-name |
Specifies the name of an interface. |
- |
| to interface-number2 |
Specifies the end interface number. |
- |
Views
Layer 2 100GE interface view, 100GE interface view, Layer 2 10GE interface view, 10GE interface view, 25GE-L2 view, 25GE interface view, Layer 2 40GE interface view, 40GE interface view, Layer 2 Eth-Trunk interface view, Eth-Trunk interface view, Layer 2 GE interface view, GE optical interface view, GE electrical interface view, Layer 2 multi-GE interface view, Multi-GE interface view, Interface group view
Usage Guidelines
Usage Scenario
The am isolate command enables unidirectional isolation. For example, if unidirectional isolation is enabled on interface A, the packets sent by interface A cannot reach interface B, but the packets sent from interface B can reach interface A.
Precautions
Unidirectional isolation is supported on interfaces of different types but not on an interface from itself, an interface from a management network interface, or an Eth-Trunk interface from its member interface.
clear configuration port-isolate
Function
The clear configuration port-isolate command clears all the port isolation configurations on the device.
By default, port isolation configurations on the device are not cleared.
Usage Guidelines
To clear all the port isolation configurations on the device, you need to delete the configurations one by one. If a large number of configurations exist on the device, deleting the configurations takes much time and increases the maintenance workload. To reduce the maintenance workload and operation complexity, run the clear configuration port-isolate command in the system view to clear all the port isolation configurations on the device. The configurations involve the port isolation group, unidirectional port isolation, and isolation mode.
port-isolate enable
Function
The port-isolate enable command enables port isolation.
The undo port-isolate enable command disables port isolation.
By default, interface isolation is disabled.
Parameters
| Parameter | Description | Value |
|---|---|---|
| group group-id |
Specifies the ID of a port isolation group. |
The value is an integer ranging from 1 to 64. |
Views
Layer 2 100GE interface view, 100GE interface view, Layer 2 10GE interface view, 10GE interface view, 25GE-L2 view, 25GE interface view, Layer 2 40GE interface view, 40GE interface view, Layer 2 Eth-Trunk interface view, Eth-Trunk interface view, Layer 2 GE interface view, GE optical interface view, GE electrical interface view, Layer 2 multi-GE interface view, Multi-GE interface view, Interface group view
Usage Guidelines
Usage Scenario
The port isolation function isolates ports in the same VLAN. Port isolation provides more secure and flexible networking solutions.
Configuration Impact
Interfaces in a port isolation group are isolated from each other, but interfaces in different port isolation groups can communicate.
Precautions
Management interfaces do not support the port-isolate enable command.
port-isolate exclude vlan
Function
The port-isolate exclude vlan command excludes VLANs to make port isolation ineffective for them.
The undo port-isolate exclude vlan command cancels the configuration.
By default, no VLAN is excluded when port isolation is configured.
Format
port-isolate exclude vlan { beginVlanId [ to endVlanId ] } &<1-10>
undo port-isolate exclude vlan { beginVlanId [ to endVlanId ] } &<1-10>
Parameters
| Parameter | Description | Value |
|---|---|---|
| beginVlanId |
Specifies the start VLAN ID. |
The value is an integer ranging from 1 to 4094. |
| to endVlanId |
Specifies the end VLAN ID. |
The value is an integer ranging from 1 to 4094. |
port-isolate l3 enable
Function
The port-isolate l3 enable command enables Layer 3 port isolation.
The undo port-isolate l3 enable command disables Layer 3 port isolation.
By default, Layer 3 port isolation is disabled.
This command is supported only on the S6730-H-V2 and S5732-H-V2.
Views
100GE interface view, 10GE interface view, 25GE interface view, 40GE sub-interface view, 40GE interface view, GE interface view, Multi-GE interface view
Usage Guidelines
Usage Scenario
During routing protocol convergence, the outbound and inbound interfaces of some Layer 3 traffic are the same, namely, a loop occurs temporarily. After Layer 3 port isolation is configured, Layer 3 forwarding traffic whose outbound and inbound interfaces are the same is discarded on the outbound interface to prevent the loop. After Layer 3 port isolation is enabled, only Layer 3 traffic is isolated.
Prerequisites
The working mode of the interface has been switched to Layer 3 using the undo portswitch command.
port-isolate mode
Function
The port-isolate mode command sets the port isolation mode.
The undo port-isolate mode command restores the default port isolation mode.
By default, ports are isolated at Layer 2 but can communicate at Layer 3.
This command is supported only on the S6730-H-V2 and S5732-H-V2.
Parameters
| Parameter | Description | Value |
|---|---|---|
| l2 |
Indicates Layer 2 isolation. |
- |
| all |
Indicates Layer 2 and Layer 3 isolation. |
- |
Usage Guidelines
To implement Layer 2 isolation between ports, you can add different ports to different VLANs. This wastes VLAN resources. Use port isolation to isolate ports in the same VLAN. That is, you only need to add ports to a port isolation group to implement Layer 2 isolation between these ports. Port isolation provides secure and flexible networking schemes for customers.
You can configure the port isolation mode to all to implement Layer 2 and Layer 3 isolation between ports in a port isolation group.