Vlan – Prevent network auto-discovery between members of VLAN

broadcastvlan

At our ISP's we use Huawei s5300 switches, and we want to upgrade our setup to accomplish the following:

  1. Place a number of different customers/users under same VLAN.
  2. Assign one static-public IP address per client/customer and prevent them
    use another IP address from the same subnet.
  3. Isolate each client/interface in the same VLAN, effectively having them as if
    they are part of different VLAN. The goal is to prevent
    broadcast-based network auto-discovery protocols that can locate all
    hosts under the same broadcast domain.

The idea is to: a) save on IP addresses since if we put each client in a separate VLAN we "lose" at least 3 IPs, and b) avoid using MUX VLAN (Private VLAN in Cisco terms) due to configuration complexity.

We are stuck at point 3. If customers terminate the public IP on a server, then for instance Customer A can see the server of Customer B,C,D in Windows network folder. Here is a sample configuration for clients connected to interface 0/0/3 and 0/0/4. As we learned from the net the command "port-isolate enable group 1" may do the trick but for us it had no effect – we need isolation to work across multiple switches.

[Huawei Router]
interface Vlanif2 (The subnet is based on public IP addresses)
ip address X.X.X.X 255.255.255.0
........
[Huawei Switch 1]
user-bind static ip-address X.X.X.19 interface GigabitEthernet0/0/3
interface GigabitEthernet0/0/3
  port link-type access
  port default vlan 2
  port-isolate enable group 1
  arp anti-attack check user-  bind enable
[Huawei Switch 2]
user-bind static ip-address X.X.X.20 interface GigabitEthernet0/0/4
interface GigabitEthernet0/0/4
  port link-type access
  port default vlan 2
  port-isolate enable group 1
  arp anti-attack check user-bind enable
</code>

Thanks in advance.

[EDIT] 1. Code snippet changed – commands segmented into more devices. 2. Added information that port isolation should work across multiple switches.

Best Answer

"port-isolate enable group 1" command drops communication between the member ports and only communicate with non member ports. Configuration done by you is correct but you can implement this in your network if you have only one switch or else it not going to be useful for you. Normally this should drop the communication between A and B. If you are using only one switch in your network try to ping A to B and B to A if you are able to ping each other even after implementing port isolate then contact TAC it could be a bug in IOS.

IF you have mutliple switches then it will work differently, please look at below for better idea. Scenario:

  1. A, B are in switch1 on vlan 10 and port isolated
  2. C, D are in swtich2 on vlan 10 and port isolated
  3. A IP x.x.x.10
  4. B IP x.x.x.11
  5. C IP x.x.x.12
  6. D IP x.x.x.13

Here A can communicate with C and D but not B. C can communicate with A and B but not D.

Related Topic