LogoفارسیFA

Hands-On Lab: Configuring PVLAN Edge (Protected Ports)

This hands-on lab configures PVLAN Edge (protected ports) on two access ports within the same VLAN, isolating them from each other at Layer 2 while both retain normal connectivity to an uplink port, demonstrating a lightweight isolation feature that requires no separate VLAN.

PVLAN Edge ConfigurationProtected PortSwitchport Isolation

~3 min read · Updated Sep 23, 2026

Lab Objective

Configure two access ports on the same switch and VLAN as protected ports, verify they can no longer communicate directly with each other, and confirm both retain normal connectivity through a shared uplink port.

Lab Purpose

Creating a separate VLAN for every pair of devices that should not communicate with each other, discussed earlier in this series regarding VLAN design, is often unnecessary overhead when only simple host isolation is needed — such as guest devices on a hotel or hotspot network that should reach the internet but never each other. PVLAN Edge provides this isolation with a single per-port command, no VLAN or trunking changes required.

Lab Topology

Switch1 (all ports in VLAN 50)
  Gi1/0/1 ---- Guest-PC-A
  Gi1/0/2 ---- Guest-PC-B
  Gi1/0/24 ---- uplink to router (not protected)

Task 1: Verify Normal Connectivity Before Protection

Confirm Guest-PC-A and Guest-PC-B can currently ping each other, since they share the same VLAN.

Task 2: Configure Both Ports as Protected

Enable the protected port feature on Gi1/0/1 and Gi1/0/2.

Task 3: Verify Protected Ports Cannot Communicate

Confirm Guest-PC-A can no longer ping Guest-PC-B.

Task 4: Verify Both Ports Still Reach the Uplink

Confirm both PCs can still reach a device through the non-protected uplink port, such as the default gateway.

Solution and Verification

Guest-PC-A> ping 192.168.50.11

Reply from 192.168.50.11: bytes=32 time=1ms
-- Normal connectivity confirmed before
-- protection is applied

Switch1(config)# interface gigabitethernet1/0/1
Switch1(config-if)# switchport protected
Switch1(config-if)# exit
Switch1(config)# interface gigabitethernet1/0/2
Switch1(config-if)# switchport protected

Guest-PC-A> ping 192.168.50.11

Request timed out.
Request timed out.
Success rate is 0 percent (0/5)
-- Two protected ports cannot exchange
-- traffic directly at Layer 2, regardless
-- of being in the same VLAN

Guest-PC-A> ping 192.168.50.1

Reply from 192.168.50.1: bytes=32 time=1ms
-- The default gateway, reached through the
-- non-protected uplink port, remains fully
-- reachable

Switch1# show interfaces gigabitethernet1/0/1 switchport | include Protected

Protected: true

Key Takeaway

The protected port rule applies specifically to traffic between two protected ports on the same switch — a protected port always retains normal connectivity to any non-protected port, which is exactly what allows guest devices isolated from each other to still reach a shared, non-protected gateway or server without any VLAN redesign.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring HSRP for IPv6

This hands-on lab configures HSRP for IPv6 between two routers, demonstrating the option to use an automatically generated link-local virtual address rather than manually assigning one, and verifies failover behavior mirrors the IPv4 HSRP lab covered earlier in this series.

Continue

Hands-On Lab: Configuring SVI Autostate Exclude

This hands-on lab configures SVI autostate exclude on a monitoring port within a VLAN, preventing that single inactive port from incorrectly bringing down the SVI for an entire VLAN that still has other active member ports.

Continue

Hands-On Lab: Configuring Private VLANs (PVLANs)

This hands-on lab configures a full Private VLAN structure with a primary VLAN and both isolated and community secondary VLANs, demonstrating fine-grained Layer 2 isolation within a single IP subnet beyond what the simple protected-port feature from an earlier lab can achieve.

Continue

Hands-On Lab: Configuring VLAN Access Control Lists (VACLs)

This hands-on lab configures a VLAN Access Control List using a VLAN access-map to filter traffic within a single VLAN at Layer 2, something a standard router-applied ACL cannot achieve since traffic never leaves the VLAN to reach a routed interface.

Continue

Hands-On Lab: Configuring Storm Control

This hands-on lab configures storm control thresholds on a switch port to limit broadcast and multicast traffic, simulating a broadcast storm and verifying the switch suppresses excess traffic before it can overwhelm the network.

Continue

Hands-On Lab: Configuring Flex Links

This hands-on lab configures Flex Links between two uplinks on an access switch, providing sub-second failover without relying on Spanning Tree at all, and verifies traffic automatically shifts to the backup link when the primary fails.

Continue
Previous ArticleNext Article