Protected Ports Commands

This section describes commands you use to configure and view protected ports on a switch. Protected ports,do not forward traffic to each other, even if they are on the same VLAN. However, protected ports can forward traffic to all unprotected ports in their group. Unprotected ports can forward traffic to both protected and unprotected ports. Ports are unprotected by default.

If an interface is configured as a protected port, and you add that interface to a Port Channel or Link Aggregation Group (LAG), the protected port status becomes operationally disabled on the interface, and the interface follows the configuration of the LAG port. However, the protected port configuration for the interface remains unchanged. Once the interface is no longer a member of a LAG, the current configuration for that interface automatically becomes effective.

switchport protected (Global Config)

Use this command to create a protected port group. The <groupid> parameter identifies the set of protected ports. Use the name <name> pair to assign a name to the protected port group. The name can be up to 32 alphanumeric characters long, including blanks. The default is blank.

NOTE: Port protection occurs within a single switch. Protected port configuration does not affect traffic between ports on two different switches. No traffic forwarding is possible between two protected ports.

• Default: unprotected
• Format: switchport protected groupid name name
• Mode: Global Config

no switchport protected (Global Config)

Use this command to remove a protected port group. The <groupid> parameter identifies the set of protected ports. The name keyword specifies the name to remove from the group.

• Format: no switchport protected <groupid> <name>
• Mode: Global Config

switchport protected (Interface Config)

Use this command to add an interface to a protected port group. The <groupid> parameter identifies the set of protected ports to which this interface is assigned. You can only configure an interface as protected in one group.

NOTE: Port protection occurs within a single switch. Protected port configuration does not affect traffic between ports on two different switches. No traffic forwarding is possible between two protected ports.

• Default: unprotected
• Format: switchport protected <groupid>
• Mode: Interface Config

no switchport protected (Interface Config)

Use this command to configure a port as unprotected. The <groupid> parameter identifies the set of protected ports to which this interface is assigned.

• Format: no switchport protected groupid
• Mode: Interface Config

show switchport protected

This command displays the status of all the interfaces, including protected and unprotected interfaces.

• Format: show switchport protected <groupid>
• Mode:
  • Privileged EXEC
  • User EXEC

The display parameters for above command are:

• Group ID: The number that identifies the protected port group.
• Name: An optional name of the protected port group. The name can be up to 32 alphanumeric characters long, including blanks. The default is blank.
• List of Physical Ports: List of ports, which are configured as protected for the group identified with groupid. If no port is configured as protected for this group, this field is blank.

show interfaces switchport

This command displays the status of the interface (protected/unprotected) under the groupid.

• Format: show interfaces switchport [unit/slot/port <groupid>]
• Mode:
  • Privileged EXEC
  • User EXEC

The display parameters for above command are:

• Name: A string associated with this group as a convenience. It can be up to 32 alphanumeric characters long, including blanks. The default is blank. This field is optional.
• Protected: Indicates whether the interface is protected or not. It shows TRUE or FALSE. If the group is a multiple groups then it shows TRUE in Group <groupid>