Sometimes we want to isolate two interfaces from each other, so that the devices which connected to these interfaces can not access each other.
Some people may configure these two PCs into different networks and yes, that may work. But if these two PC are on the same network, how could we achieve that goal? Here we list of a few ways to do this.
1. VLAN
As the most common and widely used way, VLAN may be the first way we think out when we are appointed this task.
As known, the interfaces in the different VLANs can not access each other through the layer 2. But there is a problem, which is the number of the VLAN. As the VLAN tag described, VLAN tag only contains 12 bits, which means that the maximum number of VLAN is 4096, in fact, there are a few VLANs that are reserved, so the usable VLANs are less than 4096.
So, the way to configure the VLAN to isolate the interface is not the best way.
2. MUX VLAN
MUX VLAN, which is called private VLAN in Cisco, can also be used to isolate the interfaces.
In MUX VLAN, there is a concept of separating the VLAN. In the separate VLAN, the interfaces are independent from each other, so we can add the interfaces which should isolate from each other into the separate VLAN.
Unlike the way of configuring the VLAN, the MUX VLAN will comsume more VLANs, because we have to configure the main VLAN and group VLAN. But if more than two interfaces exist (such as N interfaces) and both of them should be configured as isolation from each other, the way of configuring the VLAN will consume N VLANs. However, in MUX VLAN, only three VLANs are needed.
So, if more than two interfaces need to be configured to be isolated from each other, the MUX VLAN is a better way than VLAN.
3. Port isolation
Layer 2 port isolation can isolate interfaces on the same VLAN. That is, you only need to add interfaces to a port isolation group to implement Layer 2 isolation between these interfaces.
Unlike the VLAN and MUX VLAN, port isolation doesn't waste VLANs. The configuration of the port isolation does not consume extra VLANs, making it the best way to do this.
The port isolation only needs to add the interfaces which should be isolated from each other into the same group. In this group, the interfaces can not access each other, just like the separate VLAN in MUX VLAN.
