Recently I took control of the commercial satellite service some of my colleagues and I use for personal Internet access out here in Iraq. There are about a dozen of us using the service, and the previous owner used a 16-port Linksys switch to provide access to the Ethernet side of the satellite modem. Wanting better visibility and security, I opted (like a good Cisco tool) to upgrade to a Catalyst switch.

I was able to acquire a 3550 for a decent price. Unfortunately, the 3550 does not support private VLANs*, which I had considered using to better isolate users from one another. Luckily my search for an alternate method of securing host connections yielded an ideal solution: protected switchports.

Protected switchports can be thought of as a very basic implementation of the private VLAN concept, available even on older low-end switches. No layer two traffic can be sent between any two protected switchports, only between a protected switchport and a non-protected switchport. This means the modem-facing port can be left unprotected while all user-facing ports are protected. All hosts can communicate with the modem, but not directly with each other.

Protecting a switchport is hardly a complex configuration:

Switch(config)# interface f0/1
Switch(config-if)# switchport protected

Verification of protected operation:

Switch# show interface f0/1 switchport | inc Protected
Protected: true

* Edit: Raven over on Networking Forum pointed out that Cisco's feature navigator shows private VLANs available on the 3550 under IOS 12.2(44) and certain 12.1 releases. I'll have to check if this is accurate (seems to be) when I get my 3550.