Protected Ports for Host Isolation

Bundle lab

Harden the campus access edge by isolating same-switch hosts using protected ports. You will configure switchport protected on both host-facing access interfaces so PC1 and PC2 cannot communicate at Layer 2, while all endpoints still reach the default gateway R1. This is a deterministic Layer-2 security control that mimics lightweight private-VLAN isolation on a single switch. Focus is on SW1 only; R1 and hosts are pre-provisioned.

Learning objectives

• Explain the purpose and behavior of protected ports on Cisco Catalyst switches.
• Configure protected ports on host-facing access interfaces to prevent direct host-to-host switching.
• Verify port protection status using show commands.
• Validate expected forwarding: hosts cannot talk directly to each other but can reach the default gateway.
• Recognize use cases such as guest/DMZ isolation without full private VLANs.

Troubleshooting focus

• If PC1 can still ping PC2, ensure both Ethernet0/1 and Ethernet0/2 are marked protected.
• If any host cannot reach the gateway, verify VLAN 10 access mode is intact and the port is up/up.
• If the uplink to R1 is accidentally protected, un-protect it; the uplink must remain unprotected.
• Confirm you configured the correct interfaces; do not protect the wrong port.
• Use show interfaces Ethernet0/x switchport to check the Protected flag.