22-6
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
OL-9639-07
Chapter 22 Configuring Port-Based Traffic Control
Configuring Protected Ports
This example shows how to enable the small-frame arrival-rate feature, configure the port recovery time,
and configure the threshold for error disabling a port:
Switch# configure terminal
Switch# errdisable detect cause small-frame
Switch# errdisable recovery cause small-frame
Switch(config)# interface fastethernet0/1
Switch(config-if)# small-frame violation rate 10000
Switch(config-if)# end
Configuring Protected Ports
Some applications require that no traffic be forwarded at Layer 2 between ports on the same switch so
that one neighbor does not see the traffic generated by another neighbor. In such an environment, the use
of protected ports ensures that there is no exchange of unicast, broadcast, or multicast traffic between
these ports on the switch.
Note NNIs default to non-protected ports. Since UNIs and ENIs s provide port isolation, protected port is not
available on UNI and ENI ports. For more information about port types, see the
“UNI, NNI, and ENI
Port Types” section on page 9-2.
Protected ports have these features:
• A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that
is also a protected port. Data traffic cannot be forwarded between protected ports at Layer 2; only
control traffic, such as PIM packets, is forwarded because these packets are processed by the CPU
and forwarded in software. All data traffic passing between protected ports must be forwarded
through a Layer 3 device.
• Forwarding behavior between a protected port and a nonprotected port proceeds as usual.
These sections contain this configuration information:
• Default Protected Port Configuration, page 22-6
• Protected Port Configuration Guidelines, page 22-6
• Configuring a Protected Port, page 22-7
Default Protected Port Configuration
The default is to have no protected ports defined.
Protected Port Configuration Guidelines
You can configure protected ports on a physical interface that is configured as an NNI (for example,
Gigabit Ethernet port 1) or an EtherChannel group (for example, port-channel 5). When you enable
protected ports for a port channel, it is enabled for all ports in the port-channel group.
Do not configure a private-VLAN port as a protected port. Do not configure a protected port as a
private-VLAN port. A private-VLAN isolated port does not forward traffic to other isolated ports or
community ports. For more information about private VLANs, see
Chapter 12, “Configuring Private
VLANs.”
To Next Page
Loading...
Need help?
General
