As the question says:

How can I bridge multiple interfaces to a single one on a Cisco ISR C891F, but making each one able to communicate only to the destination interface?

Let's say I have GigabitEthernet0 to GigabitEthernet7.

How can I bridge the range GE1-GE7 to GE0 and make each interface only able to communicate with GE0 and not between each other?

Cisco IOS Software, C800 Software (C800-UNIVERSALK9-M), Version 15.3(3)M6, RELEASE SOFTWARE (fc1)

1 Answer 1


Those interfaces are bridged (communicating at layer-2) because they are part of the switch module in the router. It sounds like you want to use a Private VLAN. Cisco has documents that describe this. For example, Catalyst 3560 Software Configuration Guide, Release 12.2(52)SE:

Private VLANs provide Layer 2 isolation between ports within the same private VLAN. Private-VLAN ports are access ports that are one of these types:

  • Promiscuous—A promiscuous port belongs to the primary VLAN and can communicate with all interfaces, including the community and isolated host ports that belong to the secondary VLANs associated with the
    primary VLAN.
  • Isolated—An isolated port is a host port that belongs to an isolated secondary VLAN. It has complete Layer 2 separation from other ports within the same private VLAN, except for the promiscuous ports. Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic received from an isolated port is forwarded only to promiscuous ports.
  • Community—A community port is a host port that belongs to a community secondary VLAN. Community ports communicate with other ports in the same community VLAN and with promiscuous ports. These interfaces are isolated at Layer 2 from all other interfaces in other communities and from isolated ports within their private VLAN.

Configure a private VLAN with all the interfaces as Isolated, except GigabitEthernet0 that you will configure as Promiscuous.

The problem may be that your switch module in a router may not support private VLANs. The switch modules in routers don't always support all the features of a stand-alone switch.

  • Just tested it and I'm afraid "switchport mode private-vlan" is not available on my router, do you know another possible solution?
    – user34559
    May 24, 2017 at 16:41
  • Unfortunately, that is the Cisco solution. Did you create the private VLAN first? You must set up the VLANs before you can assign the interfaces.
    – Ron Maupin
    May 24, 2017 at 16:43
  • Yes, I currently have two VLANs.
    – user34559
    May 24, 2017 at 16:44
  • @GamerJota, also be sure to read the limitations. For example, you will need to disable VTP, DTP, etc.. Did you create the VLANs as private VLANs, e.g. private-vlan isolated?
    – Ron Maupin
    May 24, 2017 at 16:46
  • Apparently private-vlan is not supported as it says Invalid input detected :(
    – user34559
    May 24, 2017 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.