MFF network model
As shown in Figure 173, hosts are connected to Switch C through Switch A and Switch B, which are called Ethernet access nodes (EANs). The MFF-enabled EANs forward packets from hosts to the gateway for further forwarding. The hosts are isolated at Layer 2, but they can communicate at Layer 3.
Figure 173: Network diagram for MFF
MFF works with any of the following features to implement traffic filtering and Layer 2 isolation on the EANs:
ARP snooping (see Layer 3—IP Services Configuration Guide).
IP source guard (see "Configuring IP source guard").
ARP detection (see "Configuring ARP attack protection").
VLAN mapping (see Layer 2—LAN Switching Configuration Guide).