Method and system for isolating ports of virtual local area network

Abstract

The invention relates to port isolation technologies in the field of data communication, and discloses a method for isolating ports of a virtual local area network. The method for isolating the ports of the virtual local area network comprises the steps that (1) keywords are set in inlet processors of exchange chips, wherein each keyword includes a virtual local area network serial number, a chip serial number, a port address and a route-passing-or-not field; (2) assignment is carried out on the keywords of the exchange chips, and the value of each route-passing-or-not field is set to be no route passing; (3) after a message enters a switch, keyword matching is carried out, and corresponding actions are carried out according to the assigned values of the keywords. The invention further discloses a system for isolating the ports of the virtual local area network. The system for isolating the ports of the virtual local area network comprises a keyword setting module, a keyword assignment module and a keyword matching module. According to the method and the system for isolating the ports of the virtual local area network, the effect that isolation ports and isolated ports are flexibly isolated in a certain local area network can be achieved, and the problem that a user who is isolated in one virtual local area network is also isolated in other virtual local area networks is solved.

Description

Technical field [0001] The present invention relates to a port isolation technology in the field of data communication, in particular to a port isolation technology based on VLAN (Virtual Local Area Network, virtual local area network) implemented by adopting IFP (Ingress Content Aware Processor, ingress content processor). Background technique [0002] With the increase in the number of internal network users and the increasing requirements for business diversity, the problem of switch access security has become increasingly prominent. For security reasons, it must be ensured that only legitimate users can access the network system of the data center. [0003] The emergence of early virtual local area networks was to divide a local area network (LAN) into multiple logical local area networks-virtual local area networks. Each virtual local area network is a broadcast domain. The communication between hosts in a virtual local area network is the same as in a local area network, but...

AI Technical Summary

Problems solved by technology

This rough isolation method cannot meet the flexible needs of users, and it will also cause users who do not need to be isolated to be actually isolated.

The egress entry cannot implement VLAN-based port isolation

Images