F3215-HP Load Balancing Module Network Management Configuration Guide-6PW101

58
Configuring an isolate-user-VLAN
Isolate-user-VLAN can be configured only at the CLI.
An isolate-user-VLAN uses a two-tier VLAN structure. In this approach, an isolate-user-VLAN and
secondary VLANs are configured on the same device.
The following are characteristics of the isolate-user-VLAN implementation:
• Isolate-user-VLANs are mainly used for upstream data exchange. An isolate-user-VLAN can be
associated with multiple secondary VLANs. Because the upstream device identifies only the
isolate-user-VLAN and not the secondary VLANs, network configuration is simplified and VLAN
resources are saved.
• You can isolate Layer 2 traffic from different users by assigning ports connected to them to different
secondary VLANs. To enable communication between secondary VLANs associated with the same
isolate-user-VLAN, you can enable local proxy ARP on the upstream device (for example, Device A
in Figure 39) to r
eali
ze Layer 3 communication between the secondary VLANs.
As shown in Figure 39, the isolate-user-VLAN function is enabled on Device B. VLAN 10 is the
isol
ate-user-VLAN. VLAN 2, VLAN 5, and VLAN 8 are secondary VLANs associated with VLAN 10 and
are invisible to Device A.
Figure 39 An isolate-user-VLAN example
Configuration task list
To configure an isolate-user-VLAN, complete the following tasks:
1. Configure the isolate-user-VLAN.
2. Configure the secondary VLANs.
3. Configure uplink and downlink ports in the following workflow:
a. Configure the uplink ports, for example, the port connecting Device B to Device A in Figure 39,
to operate in promiscuous mode in the specified VLAN, so that uplink ports can be
automatically added to the specified isolate-user-VLAN and the secondary VLANs associated
with the isolate-user-VLAN.