Configuring Private Vlans; Using Port Isolation - AMX NXA-ENET8-2POE Operation/Reference Manual

Configuring Private VLANs

Use the Private VLAN Membership Configuration page to assign port members to private VLANs.
FIG. 88 Private VLAN Membership Configuration
Private VLAN Membership Configuration parameters
• PVLAN ID
• Port Members
Private VLANs provide port-based security and isolation between ports within the assigned VLAN. Data
traffic on ports assigned to a private VLAN can only be forwarded to, and from, uplink ports (that is, ports
configured as members of both a standard IEEE 802.1Q VLAN and the private VLAN).
Ports isolated in the private VLAN are designated as downlink ports, and can not communicate with any other
ports on the switch except for the uplink ports. Ports assigned to both a private VLAN and an 802.1Q VLAN
are designated as uplink ports, and can communicate with any downlink ports within the same private VLAN
to which it has been assigned, and to any other ports within the 802.1Q VLANs to which it has been assigned.
One example of how private VLANs can be used is in servicing multi-tenant dwellings. If all of the tenants are
assigned to a private VLAN, then no traffic can pass directly between the tenants on the local switch.
Communication with the outside world is restricted to the uplink ports which may connect to one or more
service providers (such as Internet, IPTV, or VOIP). More than one private VLAN can be configured on the
switch if a different set of service providers is required for other client groups.
1.
Click Configuration, Private VLANs, PVLAN Membership.
2.
Add or delete members of any existing PVLAN, or click Add New Private VLAN and mark the port
members.
3.
Click Save.

Using Port Isolation

Use the Port Isolation Configuration page to prevent communications between customer ports within the same
private VLAN.
FIG. 89 Port Isolation Configuration
NXA-ENET8-2POE Gigabit Ethernet Layer 2 PoE Switch
Private VLAN identifier. (Range: 1-10)
By default, all ports are configured as members of VLAN 1 and PVLAN 1.
Because all of these ports are members of 802.1Q VLAN 1, isolation cannot be
enforced between the members of PVLAN 1. To use PVLAN 1 properly, remove
the ports to be isolated from VLAN 1 (see page 161). Then connect the uplink
ports to the local servers or other service providers to which the members of
PVLAN 1 require access.
Port identifier.
Configuring the NXA-ENET8-2POE
121