I have for testing pair of T2600G-28TS from sale department of local TP-Link Company.

But in testing I can' find solution how can I isolate ports inside one VLAN by my diagram.

PC can't see other PC, WIFI can't see other WIFI; Printers can't see other Printers, only GATEWAY can know what do with PC, WIFI and PRINTERS.

Task that at GATEWAY port should be VLAN 100... 600 tagged packets. And inside of every VLANs ports can't see other ports.

Solution 1:

L2 FEATURES > VLAN > Private VLAN.

If apply Private VLAN feature then Primary VLAN should hide Secondary VLAN (VLAN 100... 600), and GATEWAY PORT can't see members (VLAN 100... 600).

As I see solution is creating temporary VLAN 101, add every PORT that need bee in VLAN 100 as HOST port to secondary vlan101. Then set Primary VLAN 100, and Secondary VLAN 101. Set LAGS (Trunk) ports as promiscuous Port.

But in this case I can't add other Primary VLAN 200,300,400,500,600 to this same LAGS Trunk since one The PVID can be assigned.

Solution 2:

Next solution use L2 FEATURES > Switching > Port > Port Isolation.

Where in lower switch (8) all ports in Port Isolation List, exception is Trunk port (LAGS), LAGS add to Forwarding Port List.

In next upper switch (16) incoming Trunk port (LAGS) add to Port Isolation List with other ports, exception is Trunk port (LAGS) to upper (24), Trunk port (LAGS) to upper (24) to to Forwarding Port List.

What right way for this ordinary task of isolation port?

Solution2:

(https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Restricting_Traffic_with_Isolated_Switch_Ports)