Physical Isolation vs Logical Isolation in Fiber Media Converters

 
The need for physically isolated networks

   Recently, private networks of electric power, banks, public security, military, railways, and large enterprises and institutions have required extensive physical isolation for Ethernet access. But what exactly is it?Physically isolated EthernetWoolen cloth? Many manufacturers claim that their products are physically isolated, so how to judge?

 
Physical isolation network concept

The so-called “physical isolation” means that two or more networks have no data interaction with each other.Physical layer/data link layer/IP layer, etc.levels of contact. The purpose of physical isolation is to protect the hardware entities and communication links of each network from natural disasters, man-made sabotage, and wiretapping attacks. For example, physical isolation of the internal network and the public network can truly ensure that the internal information network is not attacked by hackers from the Internet.

There is another isolation method called logical isolation. Let’s take a look at the concept of logical isolation:
What is a logically isolated network?

A logical isolator is also an isolation component between different networks. The isolated ends still exist.physicslayer/data link layerConnect to the data channel, but use technical means to ensure that there is no data channel at both ends of the isolation, that is, logical isolation, which is available on the marketNetwork fiber optic transceiver/switchLogical isolation is generally achieved by dividing VLAN (IEEE802.1Q) groups;

 

VLAN is equivalent toThe second layer of the OSI reference model (data link layer)The broadcast domain can control the broadcast storm within a VLAN. After dividing the VLAN, due to the reduction of the broadcast domain, the isolation of two different VLAN group network ports can be achieved.

As can be seen from the above, the packets on the data link layer of the network isolated by VLAN are communicated with each other and are not completely isolated.

 
Many so-called physically isolated network fiber optic transceivers/switches on the market are now implemented using logical isolation;

The picture above is a schematic diagram of a logically isolated 1-optical 4-electrical fiber optic transceiver: 4 Ethernet channels (100M or Gigabit) similar toThe 4 lanes of the highway enter the tunnel. The tunnel is single lane, and it is 4 lanes after exiting the tunnel., VLAN isolation method, such as 1 optical 4 electrical 100M logically isolated optical fiber transceiver, its optical port is also 100M, so the bandwidth is the same asroadThe incoming 100M electrical ports are the same, only 100M, so the 4-channel 100M incoming network data must be lined up on the 100M fiber channel to enter, and when it comes out, it must be lined up again and go out to its corresponding lane;
Therefore, in this solution, network data is mixed together in Fiber Channel and is not isolated at all;

The picture above is a schematic diagram of a physically isolated 1-optical 4-electrical fiber optic transceiver: 4 Ethernet channels (100M or Gigabit) are similar toThe 4 lanes of the highway enter a tunnel. The tunnel is also 4 lanes. When it comes out of the tunnel, it is 4 lanes again., physically isolated, such as 1 optical and 4 electrical 100M physically isolated optical fiber transceiver, its optical port bandwidth is also 4*100M, so the 4-channel 100M data coming in enters the fiber channel, which is also 4 lanes, isolated from each other, and all in their corresponding lanes;

 
True physical isolation fiber optic transceiver

 
Feichang TechnologyPhysically isolated Ethernet products, each 100M/1000M Ethernet electrical port has its own independent interface physical layer chip and independent 100M/1000M bandwidth. The figure below shows a 4-way 100M/1000M physically isolated network.Multi-service fiber optic multiplexer, each network interface has its own independent physical layer chip;

How to judge whether it is a truly physically isolated network fiber optic transceiver

The following is a simple judgment method:

 

   Method 1: Two pairs of 1 optical and 4 electrically physically isolated fiber optic switches are connected with optical fiber, add electricity, and use the 4th port on both sides as the business interface, ping packet,

After the ping is successful, connect the 1-2 network ports of a device with the same network cable. If there is no impact for a long time and can work normally, it is very likely that the device is physically isolated;

Reason: After a single-layer VLAN isolation switch chip is short-circuited with a network cable, a broadcast storm will occur within 3 minutes (mac address aging time), and the switch will crash.

 
Method 2:Connect the above methods, ping a large packet on the 4th port (ping x.x.x.x -t -l 65500), remember the ms value of the delay, and then use another computer to ping a large packet on the 1st port. Pay attention to whether the ms value of the ping delay on the 4th port has become larger. If it changes, it means that there is data interaction between the channels and it is not a physically isolated port;

 
Method 3:Use a network tester to test 4 ports at the same time to see if each channel can measure independent bandwidth;