Understanding Port Isolation

What is Port Isolation?

Port isolation restricts communication between specific ports on the same switch. When port isolation is enabled, devices connected to isolated ports are unable to communicate with each other. They can still communicate with non-isolated ports.

When to Use Port Isolation or VLAN

VLANs are configured to restrict switch port traffic flow. However, in scenarios where wired clients belonging to the same VLAN should not be able to exchange traffic with one another, port isolation is used. For example, a hotel might configure VLANs to separate different guest access from the internal network and port isolation to prevent guests from exchanging traffic between each other.

VLAN use cases:

• Segmentation: Separate different types of traffic (e.g., guest vs. corporate) within the same physical network.

• Security: Isolate sensitive data and reduce the attack surface by limiting the spread of broadcast and multicast traffic.

• Traffic Management: Manage and prioritize traffic differently across various departments or services.

Port Isolation use cases:

• Enhanced Security: Add an additional layer of security within the same VLAN to prevent direct communication between devices, which can be useful in public or shared spaces like apartment complexes, hotels and multi-tenant environments.

• Simplification: Deploy a simple and quick way to restrict communication between certain devices without changing VLAN configurations.

VLAN and Port Isolation:

VLANs and port isolation are complementary tools that can be combined to provide robust network segmentation and security tailored to specific needs.

Example use case: Apartment complex

In apartment complexes, multiple residences often share the same Switch infrastructure. By enabling port isolation, one can effectively erect barriers between individual homes, preventing any unauthorized access to private wired devices like printers, NAS (Network Attached Storage), etc.

Implementation and Best Practices

Isolated ports can exchange traffic to non-isolated ports, but not to other isolated ports. Isolated ports are marked with an icon consisting of two arrows inside a bracket. The graphic below shows two clients each wired to an isolated switch port. This configuration can be used to block inter-client communication, while still allowing Internet access:

Never isolate the uplink port

The uplink port should be able to communicate with all other ports. An isolated uplink cannot exchange traffic with clients connected via other isolated ports, effectively disconnecting these clients from the Internet. For this reason, The Plasma Console prevents enabling port isolation on the uplink port. 

Port Isolation in inter-switch communication

Port isolation operates within a single switch and does not inherently extend its restrictions to neighboring switches. However, with proper configuration, traffic isolation can be maintained across a chain of switches. The graphic below shows an example. The uplink port of Switch B leads to an isolated destination port on Switch A (highlighted by green circle).

Traffic from isolated ports on Switch B can travel through the uplink to Switch A, without reaching other isolated ports in switch A. This configuration ensures that isolated ports in both Switches remain segregated, preventing undesired traffic forwarding between neighboring switches.

Isolating Link Aggregation Groups

Port isolation can also be applied to Link Aggregation Groups. The benefits and configuration steps of Link Aggregation are explained in this article. In the graphic below, Switch B's uplink LAG (unisolated) is linked to the blue-framed LAG in Switch A (isolated). This configuration ensures that isolated ports in both Switch A and B remain segregated, preventing undesired traffic forwarding between neighboring switches.