Cluster network traffic is no longer presented to every switch port

The isolated network the servers use to talk to each other was reaching every port on every switch — including the ports used by a printer, a TV tuner and other ordinary devices.

Isolation by address was real; isolation at the network layer was not. The cause was the built-in port profile every port used: it carries every network that exists, and it does so automatically, so the isolated network was added to every port the moment it was created — and any future network would have been too.

What changed. Three of the five switches now use explicit profiles instead: ordinary ports carry only the normal network, and the links between cabinets carry the isolated network deliberately rather than by default. The new profiles are static, so a network added next year will not silently appear everywhere.

No downtime. The change was applied one switch at a time and watched — first overnight, then for two hours — with no interruption to anything. Two switches remain, including the one carrying the servers' own cluster links; those are being done with more care.

Status: three of five switches complete.