Hands-On Lab: Configuring PVLAN Edge (Protected Ports)

Lab Objective

Configure two access ports on the same switch and VLAN as protected ports, verify they can no longer communicate directly with each other, and confirm both retain normal connectivity through a shared uplink port.

Lab Purpose

Creating a separate VLAN for every pair of devices that should not communicate with each other, discussed earlier in this series regarding VLAN design, is often unnecessary overhead when only simple host isolation is needed — such as guest devices on a hotel or hotspot network that should reach the internet but never each other. PVLAN Edge provides this isolation with a single per-port command, no VLAN or trunking changes required.

Lab Topology

Switch1 (all ports in VLAN 50)
  Gi1/0/1 ---- Guest-PC-A
  Gi1/0/2 ---- Guest-PC-B
  Gi1/0/24 ---- uplink to router (not protected)

Task 1: Verify Normal Connectivity Before Protection

Confirm Guest-PC-A and Guest-PC-B can currently ping each other, since they share the same VLAN.

Task 2: Configure Both Ports as Protected

Enable the protected port feature on Gi1/0/1 and Gi1/0/2.

Task 3: Verify Protected Ports Cannot Communicate

Confirm Guest-PC-A can no longer ping Guest-PC-B.

Task 4: Verify Both Ports Still Reach the Uplink

Confirm both PCs can still reach a device through the non-protected uplink port, such as the default gateway.

Solution and Verification

Guest-PC-A> ping 192.168.50.11

Reply from 192.168.50.11: bytes=32 time=1ms
-- Normal connectivity confirmed before
-- protection is applied

Switch1(config)# interface gigabitethernet1/0/1
Switch1(config-if)# switchport protected
Switch1(config-if)# exit
Switch1(config)# interface gigabitethernet1/0/2
Switch1(config-if)# switchport protected

Guest-PC-A> ping 192.168.50.11

Request timed out.
Request timed out.
Success rate is 0 percent (0/5)
-- Two protected ports cannot exchange
-- traffic directly at Layer 2, regardless
-- of being in the same VLAN

Guest-PC-A> ping 192.168.50.1

Reply from 192.168.50.1: bytes=32 time=1ms
-- The default gateway, reached through the
-- non-protected uplink port, remains fully
-- reachable

Switch1# show interfaces gigabitethernet1/0/1 switchport | include Protected

Protected: true

Key Takeaway

The protected port rule applies specifically to traffic between two protected ports on the same switch — a protected port always retains normal connectivity to any non-protected port, which is exactly what allows guest devices isolated from each other to still reach a shared, non-protected gateway or server without any VLAN redesign.