The
analysis of actual cases CISCO2951-V/K9
A company, because the service requirements, in order to guarantee the high availability of server, the server
uses the NLB cluster technology. Everything isa good thing, because the NLB cluster in the actual environment generally uses the multicast technology, the switch node the
same exit are received
a large number of broadcast, network delay is smaller (such as Internet phone,short message service) users of the network performance will be greatly affected by.
In the face
of this situation, we first thought was to subnet or designated
asVLAN, subnet division after the problem still exists, this time is generally onlyconsider the partition of VLAN, because the IDC server nodes on theequipment with virtually no division of VLAN, because the server's uplink switchis the users themselves, and in
the IDC switch designated VLAN, the switch
configuration VLAN server when needed
for Trunk, not on
the equipment andcommunications, computer network topology due to user environment they are not familiar with, so there is no way to divide the VLAN. Is this
situation can'tsolve?
The answer
is yes, that is the port isolation technology.
Overview of port isolation technology
Port
isolation technology is to implement a client port of sufficient isolation to ensure that a client
will not receive another client traffic technology. Through the port isolation technology, users can be controlled port into
a separategroup, through the port isolation characteristics, the user can will need tocontrol the port into a separate group, the realization of the two layer dataisolation between isolation group in the port, the use of isolation technologyafter the
isolation between ports unicast, broadcast and multicast is not, the virus does not spread in isolation between computers, increase of networksecurity, improve the network performance
The actual application environment
Well, let's take a port
isolation application (H3C switches to S2126-ei as an example)
Cause: a user often send a large number of foreign radio network performance, resulting in serious decline
Prescription: Port Isolation Technology
The three
server is divided into 3 real users, are respectively connected switch
Sys
System View: return to User View with Ctrl+Z.
[H3C]interface Ethernet 1/0/1
[H3C-Ethernet1/0/1]port isolate / / set the port for the isolated port
[H3C-Ethernet1/0/1]quit
[H3C] interface Ethernet 1/0/2
[H3C-Ethernet1/0/2]port isolate / / set the port for the isolated port
[H3C-Ethernet1/0/2]quit
[H3C] interface Ethernet 1/0/3
[H3C-Ethernet1/0/3]port isolate / / set the port for the isolated port
[H3C-Ethernet1/0/3]quit
[H3C]save /
/ save configuration
[H3C]display isolate port / / query port isolate group in the port
[H3C-Ethernet1/0/X]undo port isolate
/ / delete isolated port of the port of
Note: the port isolation is different from VLAN
Other manufacturers brand switch port isolation technology application
HUAWEI
[Quidway]interface Ethernet1/0/1
[Quidway-Ethernet1/0/1] port-isolate enable / / open the port isolation function
CISCO
Switch (config) # interface
port number
Switch (config-if) # switchitchport protected / / open port protection function
Note: Cisco individual model switch using PVLAN port to achieve protection function
D-link
Config traffic_segmentation forward_list [null |] []
Note: said to
specify which ports as isolated port, C2901-VSEC/K9 parameter null indicates nouplink port, parameter represents the uplink port
