XGS4600 - Port isolation issue
Hi,
We have noticed an issue that seems to happen quite regularly where the configuration "vlan1q port-isolation" on our ports ceases to take effect.
This persists even through reboot. The only way to 'reactivate' the port isolation is to remove it from all affected ports and reapply the config once more.
Is this known about or a fix planned?
We have noticed an issue that seems to happen quite regularly where the configuration "vlan1q port-isolation" on our ports ceases to take effect.
This persists even through reboot. The only way to 'reactivate' the port isolation is to remove it from all affected ports and reapply the config once more.
Is this known about or a fix planned?
0
All Replies
-
Hi @Bash
The port isolation, in a simple explanation, is to block traffic the between the ports of which the feature is enable. For example, after enabling port isolation on port 1 & 2, they can not communicate with each other anymore, but port 1 can still communicate with any other ports (except port 2) on the switch.
We don't quite get your idea about "ports ceases to take effect". In case of enabling port isolation on all the ports of switch, leads to every ports not communicating with each other. Is this the situation you have?
If no, please describe the scenario and symptom more in specific and detail, and also provide the topology / firmware version if possible.
Look forward to your feedback.
Zyxel_Lucious0 -
Hi @Zyxel_Lucious
Thankyou for the quick reply.
To give context, we have customers connected on ports of which we have enabled port isolation as shown below;interface port-channel 1/1pvid 199frame-type untaggedvlan1q port-isolationexitinterface port-channel 1/2pvid 199frame-type untaggedvlan1q port-isolationexitinterface port-channel 1/3pvid 199frame-type untaggedvlan1q port-isolationexitinterface port-channel 1/4pvid 199frame-type untaggedvlan1q port-isolationexitinterface port-channel 1/5pvid 199frame-type untaggedvlan1q port-isolation
The issue we are seeing is that, after a period of time, upon logging into one of these customers e.g. customer connected to port 1/3. He can see and communicate with other the other customers on 1/1,1/2,1/3 and 1/5 even though port-isolation is enabled.
The only fix we have found is to run the following commands;
stack# configure
stack(config)# interface port-channel 1/1-1/5
stack(config-interface)# no vlan1q port-isolation
stack(config-interface)# vlan1q port-isolation
stack(config-interface)# exit
Our firmware for reference;stack# show versionCurrent ZyNOS version : V4.50(ABBI.1) | 09/11/20170 -
Hi @Bash
We get the picture and have some test in our local LAB, unfortunately we cannot replicate the symptom based on the given configuration.
1. "after a period of time" as you mentioned, exactly how long did it take?
2. We may need some further info from you to figure out the cause.
We'll PM you for the further info.
Zyxel_Lucious0
Categories
- All Categories
- 415 Beta Program
- 2.4K Nebula
- 149 Nebula Ideas
- 96 Nebula Status and Incidents
- 5.7K Security
- 263 USG FLEX H Series
- 271 Security Ideas
- 1.4K Switch
- 74 Switch Ideas
- 1.1K Wireless
- 40 Wireless Ideas
- 6.4K Consumer Product
- 249 Service & License
- 387 News and Release
- 84 Security Advisories
- 29 Education Center
- 10 [Campaign] Zyxel Network Detective
- 3.5K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 85 About Community
- 73 Security Highlight