Protected Port on Cisco Catalyst Switch

This topic is to discuss the following lesson:

protected port on steroids :slight_smile:

I also enjoyed the term :slight_smile:

Hi Reno,
Very Simple and Great explanation !


lol freedom fighter.

lol protected port on steroids.

LOL! haha

Hello Rene,

Is the Protected option is available in Switch types like 2960 , 3560 ? if yes, i try to applied it on packet tracer which support both switch but it said not supported. Would you please let me know which switch is supported. Thank you

Hi Sinan,

Yes it’s available on the 2960 and 3560. I’m guessing that packet tracer doesn’t support it, it’s a simulator after all.


Hlw Rene,

this is good stuff, thanks. One questions …

Protected port feature will work within SW local port & within Same VALN , right ??


Hi Zaman,

That’s right. It will work for the VLAN that the interface is assigned to.


Hello Rene/ Laz,
I have a question and I am going to use the below topology as a reference for the question.

As you see in the diagram, all the PCs are in VLAN 10. The access switch is hosting other VLANs as well. All the SVIs are located in the Distribution switch as you see in the diagram. The link between access switch and the distribution switch is a Trunk link to carry multiple VLANs.
Now my requirement is to block access for PC3 and PC4 so they can not go out of local network. If PC3 and PC4 can not talk to each other, that is ok. They are only allowed to talk to the devices in the local network(VLAN 10). I am thinking to configure PC3, PC4 and the Trunk port on the access switch as Protected port. I am not quite sure how protected port works on a trunk port. I am expecting that PC3 and PC4 will not able to get to the gateway and therefore, they will not be able to go out of the local network. I am also expecting all other devices to have normal functionality. Please clarify this.

Thank you in advance.


Hello Azm,

If you want to restrict PC3 and PC4 but not PC1 and PC2 then I would probably just create a new VLAN, let’s say VLAN 11. Add PC3 and PC4 to VLAN 11.

You can either create VLAN 11 without an SVI so there is no gateway or create an SVI and add an access-list to define to which other subnets they can go or not.