Port isolation for restricting traffic flow on layer 2 switches

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for isolating a plurality of ports sharing a single virtual local area network (VLAN) on a layer 2 switch, wherein the single VLAN is a group of devices within a local area network, at least one device in the group not belonging to any other VLAN, said method comprising:

• configuring each of said plurality of ports by a user on said layer 2 switch as a protected port or a non-protected port;
• matching a destination address on a data packet with a physical address on said layer 2 switch, said data packet received by an ingress port;
• generating a forwarding map for said data packet based upon said destination address on said data packet, wherein the generating further includes allowing said packet to be forwarded to another of said protected ports;
• and
• sending said data packet to said plurality of ports pursuant to said forwarding map.

An apparatus for isolating a plurality of ports sharing a single virtual local area network (VLAN) on a layer 2 switch, wherein the single VLAN is a group of devices within a local area network, at least one device in the group not belonging to any other VLAN, the apparatus comprising:

• a port configurer to configure said plurality of ports as a protected port or a non-protected port;
• an address table memory storing an address table, said address table having a destination address and port number pair;
• a forwarding map generator generating a forwarding map;
• and
• said forwarding map responsive to a destination address of a data packet so that the data packet is forwarded either to a port number paired with the destination address in said forwarding table, or if not so paired, said data packet is forwarded to each of said non-protected ports on said switch and said data packet is prevented from forwarded to a protected port if an ingress port is protected or if said ingress port is non-protected, said data packet is forwarded to all of said plurality of ports.

An apparatus for isolating a plurality of ports sharing a single virtual local area network (VLAN) on a layer 2 switch, wherein the single VLAN is a group of devices within a local area network, at least one device in the group not belonging to any other VLAN, the apparatus comprising:

• means to configure each of said plurality of ports on said layer 2 switch as a protected or non-protected port;
• means to match a destination address on a data packet with a physical address on said layer 2 switch, said data packet received on an ingress port;
• means to generate a forwarding map for said data packet based upon said destination address on said data packet, wherein the generating further includes allowing said data packet to be forwarded from a protected port to a non-protected port while preventing said data packet from being forwarded to another of said protected ports;
• and
• means to send said data packet to said plurality of ports pursuant to said forwarding map.

A method for isolating a plurality of ports sharing a single virtual local area network (VLAN) on a layer 2 switch, wherein the single VLAN is a group of devices within a local area network, at least one device in the group not belonging to any other VLAN, the method comprising:

• maintaining a state for each of said plurality of ports on said layer 2 switch as a protected port or a non-protected port;
• matching a destination address on a data packet with a physical address on said layer 2 switch, said data packet received by an ingress port;
• generating a forwarding map for said data packet based upon said destination address on said data packet, wherein the generating further includes allowing said data packet to be forwarded from a protected port to a non-protected port while preventing said data packet from being forwarded to another of said protected ports;
• and
• sending said data packet to said plurality of ports pursuant to said forwarding map.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for isolating a plurality of ports sharing a single virtual local area network (VLAN) on a layer 2 switch, wherein the single VLAN is a group of devices within a local area network, at least one device in the group not belonging to any other VLAN, said method comprising:

• maintaining a state for each of said plurality of ports on said layer 2 switch as a protected port or a non-protected port;
• matching a destination address on a data packet with a physical address on said layer 2 switch, said data packet received by an ingress port;
• generating a forwarding map for said data packet based upon said destination address on said data packet, wherein the generating further includes allowing said data packet to be forwarded from a protected port to a non-protected port while preventing said data packet from being forwarded to another of said protected ports;
• and
• sending said data packet to said plurality of ports pursuant to said forwarding map.

An apparatus for isolating a plurality of ports sharing a single virtual local area network (VLAN) on a layer 2 switch, wherein the single VLAN is a group of devices within a local area network, at least one device in the group not belonging to any other VLAN, the method comprising:

• means for maintaining a state for each of said plurality of ports on said layer 2 switch as a protected port or a non-protected port;
• means for matching a destination address on a data packet with a physical address on said layer 2 switch, said data packet received by an ingress port;
• means for generating a forwarding map for said data packet based upon said destination address on said data packet, wherein the generating further includes allowing said data packet to from being forwarded to another of said protected ports;
• and
• means for sending said data packet to said plurality of ports pursuant to said forwarding map.

An apparatus for isolating a plurality of ports sharing a single virtual local area network (VLAN) on a layer 2 switch, wherein the single VLAN is a group of devices within a local area network, at least one device in the group not belonging to any other VLAN, the apparatus comprising:

• a state maintenance module configured to maintain a state for each of said plurality of ports on said layer 2 switch as a protected port or a non-protected port;
• a destination address matching module coupled to said state maintenance module and configured to match a destination address on a data packet with a physical address on said layer 2 switch, said data packet received by an ingress port;
• a forwarding map generator coupled to said destination address matching module;
• and
• a data packet sending module coupled to said forwarding map generator and configured to send said data packet to said plurality of ports pursuant to said forwarding map while preventing said data packet from being forwarded from an ingress protected port to another of said protected ports.