Port isolation commands -- community-vlan vlan

Use community-vlan vlan to configure community VLANs in an isolation group.

Use undo community-vlan to restore the default.

Syntax

community-vlan vlan { vlan-id-list | all }

undo community-vlan

Default

An isolation group does not have any community VLANs.

Views

Isolation group view

Predefined user roles

network-admin

mdc-admin

Parameters

vlan-id-list: Specifies a space-separated list of up to 10 VLAN items. Each item specifies a VLAN ID or a range of VLAN IDs in the format of vlan-id1 to vlan-id2. The value range for VLAN IDs is 1 to 4094. The ID for vlan-id2 must be equal to or greater than the ID for vlan-id1.

all: Specifies all VLANs in the isolation group.

Usage guidelines

This command is available when the device is operating in standalone mode or IRF mode with the enhanced IRF feature disabled.

To modify the community VLANs for an isolation group, execute the undo community-vlan vlan command to remove the existing community VLANs, and then execute the community-vlan vlan command.

Examples

# Configure VLAN 3 as a community VLAN in isolation group 1.

<Sysname> system-view

[Sysname] port-isolate group 1

[Sysname-port-isolate-group1] community-vlan vlan 3

Related commands

display port-isolate group

Port isolation commands -- display port-isolate group

Use display port-isolate group to display port isolation group information.

Syntax

Devices that support only one isolation group:

display port-isolate group

Devices that support multiple isolation groups:

display port-isolate group [ group-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

group-id: Specifies an isolation group by its ID. The value range varies by device model. (Applicable to devices that support multiple isolation groups.)

Examples

# Display port isolation group information. (Applicable to devices that support only one isolation group.)

<Sysname> display port-isolate group

Port isolation group information:

Group ID: 1

Group members:

GigabitEthernet1/0/2

Community VLAN ID: 3

# Display all isolation groups. (Applicable to devices that support multiple isolation groups.)

<Sysname> display port-isolate group

Port isolation group information:

Group ID: 1

Group members:

GigabitEthernet1/0/1

Group ID: 5

Group members:

GigabitEthernet1/0/2 GigabitEthernet1/0/4

Community VLAN ID: 3

# Display information about isolation group 1. (Applicable to devices that support multiple isolation groups.)

<Sysname> display port-isolate group 1

Port isolation group information:

Group ID: 1

Group members:

GigabitEthernet1/0/1

Community VLAN ID: 1(default), 2

Table 1 Command output

Field | Description
Group ID | ID of the isolation group.
Group members | Isolated ports in the isolation group. No ports indicates that the isolation group contains no isolated ports.
Community VLAN ID | IDs of the community VLANs in the isolation group. The (default) attribute indicates that the VLAN is the default VLAN. None indicates that the isolation group contains no community VLANs.

Related commands

port-isolate enable

Port isolation commands -- port-isolate enable

Use port-isolate enable to assign a port to an isolation group.

Use undo port-isolate enable to remove a port from an isolation group.

Syntax

Devices that support only one isolation group:

port-isolate enable

undo port-isolate enable

Devices that support multiple isolation groups:

port-isolate enable group group-id

undo port-isolate enable

Default

The port is not assigned to any isolation group.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

group group-id: Specifies an isolation group by its ID. The value range varies by device model.

Usage guidelines

The configuration in Layer 2 Ethernet interface view applies only to the interface.

The configuration in Layer 2 aggregate interface view applies to the Layer 2 aggregate interface and its aggregation member ports. If the device fails to apply the configuration to the aggregate interface, it does not assign any aggregation member port to the isolation group. If the failure occurs on an aggregation member port, the device skips the port and continues to assign other aggregation member ports to the isolation group.

You cannot assign the member ports of a service loopback group to an isolation group, and vice versa.

This command assigns a port to the default isolation group (isolation group 1). (Applicable to devices that support only one isolation group.)

To assign ports to an isolation group, make sure the isolation group already exists. (Applicable to devices that support multiple isolation groups.)

One port can be assigned to only one isolation group. (Applicable to devices that support multiple isolation groups.)

Examples

# Assign GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to the default isolation group. (Applicable to devices that support only one isolation group.)

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] port-isolate enable

[Sysname-GigabitEthernet1/0/1] quit

[Sysname] interface gigabitethernet 1/0/2

[Sysname-GigabitEthernet1/0/2] port-isolate enable

# Assign Layer 2 aggregate interface Bridge-Aggregation 1 to the default isolation group. (Applicable to devices that support only one isolation group.)

<Sysname> system-view

[Sysname] interface bridge-aggregation 1

[Sysname-Bridge-Aggregation1] quit

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] port link-aggregation group 1

[Sysname-GigabitEthernet1/0/1] quit

[Sysname] interface gigabitethernet 1/0/2

[Sysname-GigabitEthernet1/0/2] port link-aggregation group 1

[Sysname-GigabitEthernet1/0/2] quit

[Sysname] interface bridge-aggregation 1

[Sysname-Bridge-Aggregation1] port-isolate enable

# Assign GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to isolation group 1. (Applicable to devices that support multiple isolation groups.)

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] port-isolate enable group 1

[Sysname-GigabitEthernet1/0/1] quit

[Sysname] interface gigabitethernet 1/0/2

[Sysname-GigabitEthernet1/0/2] port-isolate enable group 1

Related commands

display port-isolate group

Port isolation commands -- port-isolate group

| NOTE: This command is available on devices that support multiple isolation groups.

‌

Use port-isolate group to create an isolation group.

Use undo port-isolate group to delete isolation groups.

Syntax

port-isolate group group-id

undo port-isolate group { group-id | all }

Default

No isolation groups exist.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

group-id: Specifies an isolation group by its ID. The value range varies by device model.

all: Deletes all isolation groups.

Examples

# Create isolation group 1.

<Sysname> system-view

[Sysname] port-isolate group 1