在某些特殊需求下，需要禁止同台交换机上相同VLAN 的主机之间通信，但又不能将这些不能通信的主机划到不同VLAN，因为还需要和VLAN中的其它主机通信，只是不能和部分主机通信。这个特性可以实现这种需求.

成都创新互联公司专业为企业提供宝塔网站建设、宝塔做网站、宝塔网站设计、宝塔网站制作等企业网站建设、网页设计与制作、宝塔企业网站模板建站服务，10余年宝塔做网站经验，不只是建网站，更提供有价值的思路和整体网络服务。

Protected ports have these features:

  A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that is also a protected port. Data traffic cannot be forwarded between protected ports at Layer 2; only control traffic, such as PIM packets, is forwarded because these packets are processed by the CPU and forwarded in software. All data traffic passing between protected ports must be forwarded through a Layer 3 device.

  Forwarding behavior between a protected port and a nonprotected port proceeds as usual.

You can configure protected ports on a physical interface (for example, Gigabit Ethernet port 1) or an EtherChannel group (for example, port-channel 5). When you enable protected ports for a port channel, it is enabled for all ports in the port-channel group.

Do not configure a private-VLAN port as a protected port. Do not configure a protected port as a private-VLAN port. A private-VLAN isolated port does not forward traffic to other isolated ports or community ports. For more information about private VLANs

注：这个feature只在单台交换机上有效. 

sw1(config-if)#switchport protected    配置了这个特性的端口不能互访.但能与其他端口访问.