Port Isolation · Topic 2 of 2
Switch Port Isolation
Compare ways to isolate ports on a MikroTik switch: separate VLANs, bridge horizon, chip forwarding limits and switch rules, and choose the right one.
- 4 min
- Port isolation limits which switch ports may exchange frames.
- Chip level isolation runs at wire speed, without the CPU.
- Bridge horizon is a simple method and may be offloaded on newer chips.
What it is
Switch port isolation restricts which ports on a switch may exchange frames with each other.
The aim is the same as bridge horizon, but the work is done in the switch chip, so the traffic stays at wire speed. A typical design leaves each client able to reach the uplink and nothing else.
Several methods exist, and which one you can use depends on the chip family.
How it works
You choose between VLANs, horizon, chip level isolation and switch rules.
Methods compared
| Method | Where it works | Notes |
|---|---|---|
| One VLAN per port | Chip and bridge | Works everywhere, but needs many VLANs |
| Bridge horizon | Bridge, offloaded on some chips | Simple, one subnet |
| Chip forwarding restriction | Switch chip menus on some families | Limits the ports a port may send to |
| Switch rules | Switch chip rule table | Flexible, matches on addresses and ports |
Chip level isolation
Some switch chips can limit the egress ports of each ingress port.
On such chips, each client port is told to forward only to the uplink port. The chip then drops anything else in hardware, without involving the CPU. The names of these settings differ between chip families, so check the documentation for the device in use.
The result is the same as horizon: clients reach the uplink, and not each other. The difference is that it is a property of the chip port, and it does not depend on the bridge.
Horizon on switch hardware
On many devices the simplest way is still the horizon value.
/interface bridge port set [find interface=ether2] horizon=1
/interface bridge port set [find interface=ether3] horizon=1Newer switch chips can apply it in hardware. After configuring, look at the offload flag on each port in /interface bridge port print. If the flag is missing, the CPU is switching those frames, and the speed drops.
Isolation with VLANs
A separate VLAN for each client gives the strongest separation.
Each client port is an untagged member of its own VLAN, and the uplink carries all VLANs tagged. The router has an interface in each VLAN. This uses more addresses and more configuration, but each client has its own broadcast domain.
Isolation with switch rules
Switch rules match traffic and decide what to do with it.
/interface ethernet switch rule add ports=ether2 dst-mac-address=00:11:22:33:44:55/FF:FF:FF:FF:FF:FF new-dst-ports=""An empty new-dst-ports means the matched frames are dropped. Rules like this can block known destinations from a port. They are best for exceptions, because one rule per host does not scale.
Planning an isolation design
Follow these steps.
- List the ports and decide which ones are clients, and which are uplinks.
- Choose the method that your chip supports at wire speed.
- Apply it to the client ports and leave the uplink open.
- Test client to client and client to gateway.
- Check the offload flags and look for CPU load.
Always test both a ping between two isolated clients, which should fail, and a ping from each client to the gateway, which should work.
Limits
Isolation at Layer 2 does not stop Layer 3 forwarding.
A router can pass traffic between isolated clients if it holds routes to both. Use firewall rules on the router to block that. Also remember that broadcast based services, such as discovery, do not work between isolated ports.
What to remember for the exam
Six facts cover most questions on this topic.
- Port isolation limits which switch ports may exchange frames.
- Chip level isolation runs at wire speed, without the CPU.
- Bridge horizon is a simple method and may be offloaded on newer chips.
- One VLAN per port is the strongest and most work.
- An empty
new-dst-portsin a switch rule drops the matched frames. - A router can bypass Layer 2 isolation unless firewall rules stop it.
If the isolated ports lose their offload flag, the CPU handles their traffic, and a busy switch can slow down.
Common mistakes
These four mistakes appear often.
Isolating the uplink too. Clients then cannot reach the router.
Assuming isolation blocks routed traffic. Layer 3 paths remain open.
Using one rule per host. The rule table is small, so use group methods.
Ignoring the offload flag. The port may be switched in software without anyone noticing.
Check yourself
Work through these three questions.
What is the goal of switch port isolation?
To stop client ports from exchanging frames with each other, while each can still reach the uplink.
What does an empty
new-dst-portsdo in a switch rule?It drops the frames that match the rule.
Why check the offload flag after configuring horizon?
If the flag is missing, the CPU switches the traffic, which slows the switch.
Topic 2 of 2 in Port Isolation
Test yourself on Port Isolation
The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.