SJA1105PQRS Technical Support Request: Implementing Port Isolation and Directed Unicast Product Information: Product Model: ATU102 Core device: NXP SJA1105PQRS Topology: PORT0 <--->SoC (Linux 4.14); PORT1-PORT4 <--->external PHY <--->standalone peripheral Current Configuration and Requirements: I. Currently implemented features (based on VLAN configuration): 1. Isolated interworking: PORT1-PORT4 ports are isolated, and PORT0 and PORT1-PORT4 can interwork normally. 2. IP/MAC: The four peripherals connected to PORT1-PORT4 have different MAC addresses (IP example: 192.168.2.8 ~ .11). II. Problems to be solved (core needs): Goal: Enable unicast traffic from the SoC (PORT0) to be received only by peripherals on the destination port. The phenomenon of current problems: When the SoC (PORT0)--->unicasts to a peripheral (e.g., Ping 192.168.2.8 with target at peripheral 1/PORT1). Expected Result: Only target peripheral 1 (PORT1) can receive and respond to this unicast. Phenomenon: Target peripheral 1 receives normally, but peripherals on other ports (peripherals 2/3/4) also "listen" to this unicast event. (Note: "Listening" in this context means that peripherals on non-target ports also see the unicast packet, and we want the unicast not to be forwarded to non-target ports.) III. Questions: What configuration (e.g., VLAN, FDB, filter table, etc.) should be used for SJA1105PQRS to achieve this? Targeted unicast traffic from PORT0 is forwarded only to its destination port (e.g., via FDB/MAC address learning), thus ensuring that the data streams between PORT1-PORT4 do not interfere with each other and that only the target peripheral receives the unicast packet? I look forward to your professional guidance, thank you. Attached cfg_applicationBoard.py Code snippet: 1. DYN_LEARN is alread 1; 2. definition valn id + mac_configuration_table +VLAN Lookup Table ======================== MAC Configuration Table ======================== ...... port_vlan_ids = [0, 1, 2, 3, 4] mac_configuration_table = make_table_by_layout(mac_configuration_table_layout, layoutid_map) c.append(mac_configuration_table) for i in range(NO_ETH_PORTS): mac_configuration_table.append({ "INGMIRRDEI ": 0, "INGMIRRPCP ": 0, "INGMIRRVID ": 0, "MIRRCETAG ": 0, "MIRRCIE ": 0, "INGRESS ": 1, "EGRESS ": 1, "DYN_LEARN ": 1, "DRPNONA664 ": 0, "EGR_MIRR ": 0, "ING_MIRR ": 0, "VLANID ": port_vlan_ids[i], ...... } ======================== VLAN Lookup Table ======================== vlan_lookup_table = make_table_by_layout(vlan_lookup_table_layout, layoutid_map) c.append(vlan_lookup_table) vlan_lookup_table.append({ "VMEMB_PORT ": 0x1F, "VLAN_BC ": 0x1F, "TAG_PORT ": 0x0, "VLANID ": 0 }) for vid, port_bit in [(1,0x03),(2,0x05),(3,0x09),(4,0x11)]: : vlan_lookup_table.append({ "VMEMB_PORT ": port_bit, "VLAN_BC ": port_bit, "TAG_PORT ": 0x0, "VLANID ": vid }) Re: SJA1105PQRS 技术支持请求：实现端口隔离与定向单播 Hello @qingfengzhuo ,
Thank you for the detailed description.
The behavior you're observing is expected given your current configuration. Since PORT0 is assigned to VLAN 0, and VLAN 0 includes all ports (VMEMB_PORT = 0x1F), any untagged unicast from the SoC will be classified into VLAN 0. If the destination MAC is not yet learned in the FDB, the switch floods the frame to all ports in the VLAN, which explains why other devices can “see” the unicast.
To ensure that unicast traffic from PORT0 is only forwarded to the intended destination port, we recommend one of the following approaches:
Option A (Recommended – VLAN-tagged traffic from SoC):
Remove or restrict VLAN 0 to PORT0 only.
Use separate VLANs per device (as you already do with VLANs 1–4).
Configure TAG_PORT so that PORT0 egress is tagged.
On the SoC (Linux), create VLAN sub-interfaces (e.g., eth0.1, eth0.2, etc.) and send traffic via the appropriate VLAN.
This ensures that each unicast is confined to a 2-port VLAN (PORT0 + target port), preventing leakage to other ports.
Option B (Untagged SoC traffic):
Assign PORT0 to a single VLAN (e.g., VLAN 1).
Remove VLAN 0 or limit its scope to PORT0.
Add static FDB entries mapping each device MAC address to its corresponding port and VLAN.
This avoids flooding but limits flexibility, as all SoC traffic is classified into one VLAN.
Best regards,
Pavel
記事全体を表示
