5

I want to configure a Cisco 881W to deliver Corporate wired and wireless connectivity, plus Guest wireless connectivity on a second SSID, connected to the core by a site-site VPN. I was expecting to have to use VRFs to separate the Corporate and Guest traffic into their own routing domains, but that's out of my area of experience when running over a vpn backhaul. However, I have read some things about "protected" ports and believe that data ingressing from one protected port will not egress over another protected port. This could make my config much simpler and easier to maintain if my understanding is right.

Has anyone out there got specific knowledge of the "protected" command, and are my assumptions above anywhere near the mark.

As a corollory, I was looking at "protected" because I wanted to set one port "sticky", but the 881W doesn't have that command....or is it hidden? Do I REALLY have to go the hard way and use ACLs and stuff?

Improve this question
2
  • Could you help us understand a bit more about the traffic you're trying to separate? Is all the traffic in the same vlan? A diagram, which includes addressing and what you're protecting would be beneficial.
    – Mike Pennington
    Dec 6, 2013 at 16:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 18:12

1 Answer 1

Reset to default
5

To answer your only question-

"switchport protected" is kind of like PVLAN-lite. Under the interface configuration of a switchport you can issue the "switchport protected" command. This simply prevents that port from forwarding traffic to another protected switchport. The situation you are describing is common, you can have all of your downlinks configured as protected ports so that traffic from each port can only be forwarded out an uplink interface.

Unfortunately, 881's do no support this configuration because they don't have all the features available on Cisco's dedicated ethernet switches.

Improve this answer
1
  • They are technically switchports, but they don't act like a 2960-S. The switchport and vlan configuration are quite limited. Also, I use an 881 for my internet at home and for IPsec VPNs :D
    – John Kennedy
    Dec 6, 2013 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.