Port isolation on the ZyXEL MES-3528 switch

On the test, I isolate the ports from each other, allowing traffic to go only to uplink (the port from which the Internet comes), I have it 25.

Let’s connect to the switch and see the current configuration:

show running-config

Now go into the configuration mode:


Isolate the necessary ports, except the uplink port:

interface port-channel 1-24,26-28
vlan1q port-isolation

Save the configuration:

write memory

The ports on which the vlan1q port-isolation command is written do not see other ports with the same command, but see the ports without it and the switch CPU. Ports without the command vlan1q port-isolation see the ports with it and without it.

See also:
Port isolation on Huawei switches
Configuring Protected Ports on Cisco

Port isolation on Huawei switches

On the test I’ll take the Huawei Quidway S2326TP-EI and Huawei Quidway S3928P-EI switches, in which the uplink Gigabit Ethernet port 0/0/1 (the Internet comes to it), all other ports are in the same VLAN and you need to prevent them from seeing each other. To do this, execute the port-isolate enable command for each interface (port), except uplink GigabitEthernet 0/0/1.

We connect to the switch through the console or telnet and switch to the mode of elevated privileges:


We execute the command for interfaces:

interface Ethernet 0/0/1
port-isolate enable
interface Ethernet 0/0/2
port-isolate enable
interface Ethernet 0/0/3
port-isolate enable
interface Ethernet 0/0/24
port-isolate enable
interface GigabitEthernet 0/0/2
port-isolate enable

For Huawei Quidway S3928P-EI there will be other commands:

interface Ethernet1/0/1
port isolate
interface Ethernet1/0/2
port isolate
interface GigabitEthernet 1/1/2
port isolate
interface GigabitEthernet 1/1/3
port isolate
interface GigabitEthernet 1/1/4
port isolate

Leave the interface setup mode:


Let’s leave the regime of elevated privileges:


Save the configuration:


Now the ports on which the port-isolate enable command is written do not see the other ports on which this command is also registered, they see only the ports where it is not registered, that is, in our case uplink port GigabitEthernet 0/0/1, and it, as on It does not have this command, it sees all the ports with the command and without.

See also:
Configuring the Huawei Quidway Switch S2326TP-EI
Configuring Port isolation on Cisco
Port isolation on the ZyXEL switch

How to view the configuration of MikroTik

Recently I configured the next MikroTik and I had to share the configuration, so, to see it in the terminal, execute the command:

/export compact

To save the configuration to a file, execute the command:

/export compact file=config

After saving the file will be in the device’s memory, you can see it and download it from the Files menu via the web interface or winbox, ftp, smb, sftp.

Configuring the VPN IPSec / L2TP server on Mikrotik

Here is an example of setting up a VPN IPSec / L2TP server on Mikrotik so that you can connect to it from Windows, MacBook, iPhone, etc.

1) Add a range of IP addresses for DHCP by opening “IP” – “Pool” and indicating:
Name: vpn_pool
Next pool: none
From the terminal like this:

ip pool add name=vpn_pool ranges=

2) Add a profile to “PPP” – “Profiles
Name: l2tp_profile
Local address: vpn_pool (you can specify default
Remote address: vpn_pool
Change TCP MSS: yes
The rest is not touched and left in default
From the terminal like this:

ppp profile add change-tcp-mss=yes local-address=vpn_pool name=l2tp_profile remote-address=vpn_pool

3) Add a user to “PPP” – “Secrets
Password: PASSWORD
Service: l2tp
Profile: l2tp_profile
From the terminal like this:

ppp secret add name=LOGIN password=PASSWORD profile=l2tp_profile service=l2tp

4) Enable the server in “PPP” – “Interface” – “L2TP Server
Enabled: yes
MTU/MRU: 1450
Keepalive Timeout: 30
Default profile: l2tp_profile
Authentication: mschap2
Use IPSec: yes
IPSec Secret: ENCRYPTION_KEY (also indicated in the clients)
From the terminal like this:

interface l2tp-server server set authentication=mschap2 default-profile=l2tp_profile enabled=yes ipsec-secret=KEY use-ipsec=yes

5)IP” – “IPSec” – “Peers
Port: 500
Auth method: pre shared key
Exchange mode: main l2tp
Passive: yes (set)
Secret: ENCRYPTION_KEY (also indicated in the clients)
Policy template group: default
Send Initial Contact: yes
NAT Traversal: yes
My ID Type: auto
Generate policy: port override
Lifitime: 1d 00:00:00
DPD Interval: 120
DPD Maximum failures: 5
Proposal check: obey
Hash algorithm: sha1
Encryption Algorithm: 3des aes-128 aes-256
DH Group: modp 1024
From the terminal like this:

ip ipsec peer add address= enc-algorithm=aes-256,aes-128,3des exchange-mode=main-l2tp generate-policy=port-override passive=yes secret=KEY

6)IP” – “IPSec” – “Proposals”
Name: default
Auth algorithms: sha1
Enrc. algorithms: 3des, aes-256 cbc, aes-256 ctr
Life time: 00:30:00
PFS Group: mod 1024
From the terminal like this:

ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-256-ctr,3des

7)Firewall” – “Add New
Let’s add the first rule allowing incoming VPN connections:
Chain: Input
Protocol: udp
Any. Port: 1701,500,4500
Action: Accept
And the second:
Chain: Input
Protocol: ipsec-esp
Action: Accept
From the terminal like this:

ip firewall filter add chain=input action=accept protocol=udp port=1701,500,4500
ip firewall filter add chain=input action=accept protocol=ipsec-esp

The rules should be at the top of the list.

This completes the configuration, you can connect.

See also:
Configuring Remote Access in Mikrotik Router

Blocking social networks on Cisco

On the test I use the Cisco Catalyst 6509-E switch.
Suppose we need to block access to users to a certain site, a network node, or for example a social network VKontakte.

First, we know the range of IP addresses on which the site is located, for example, we search VKontakte on bgp.he.net, here is for example the list of subnets for one of the AS belonging to VKontakte “http://bgp.he.net/AS47541#_prefixes”.

And create an extended ACL for example with the name BLOCKSOCIAL:

ip access-list extended BLOCKSOCIAL
deny ip any
deny ip any
deny ip any
deny ip any
deny ip any
deny ip any
deny ip any
permit ip any any

The rule above indicates that you want to block traffic to the specified networks coming from all (any) sources.
You can specify as a source a specific network or for example one address to deny access to another address:

deny ip host host

The line “permit ip any any” should be necessary at the end.

Instead of a subnet mask, you need to specify the Wildcard, for example, for the mask /24, specify, for /22 –, etc., you can look at and count on any IP calculator.
/17 –
/18 –
/19 –
/20 –
/21 –
/22 –
/23 –
/24 –

If you want to block more sites, we’ll add the addresses to the same ACL, since only one can be applied to the ACL interface.

Apply the created ACL to the port looking towards the clients:

interface GigabitEthernet1/1
ip access-group BLOCKSOCIAL in

Or, to write less only to the server’s server port on the Internet, if there is one:

interface TenGigabitEthernet3/2
ip access-group BLOCKSOCIAL in

You can cancel the ACL interface as follows:

no ip access-group BLOCKSOCIAL in

Delete the ACL like this:

no ip access-list extended BLOCKSOCIAL

If you block sites on the port from the server to the clients, then in the ACL rule we will change the addresses in the following places:

ip access-list extended BLOCKSOCIAL
deny ip any
deny ip any
deny ip any
deny ip any
deny ip any
deny ip any
deny ip any
deny ip host any
permit ip any any

See also my articles:
Blocking social networks on Mikrotik routers
Blocking social networks using iptables

Backup configuration of TP-Link switches

I wrote a script for backup configuration of TP-Link switches.
The script runs on Linux where the TFTP server is running, it is connected via telnet to the switch and the configuration command is sent to the specified TFTP, when the telnet connection is closed, the file is moved to the desired directory, and the last command deletes files longer than 30 days, as more of them I do not need to store.
You can also make a copy of all the files in the cloud every month.
As you can see, before entering a password in the script, you can not pause.

echo "PASSWORD";
echo "enable";
echo "PASSWORD";
echo "copy startup-config tftp ip-address filename tplink";
sleep 2;
echo "exit";
sleep 1;
echo "exit";
} | telnet

mv /srv/tftp/tplink.cfg /backups/devices/tplink/`date +%Y-%m-%d`_tplink.cfg
find /backups/devices/tplink/ -type f -mtime +30 -exec rm {} \;