Protected Ports

A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that is also a protected port. Data traffic cannot be forwarded between protected ports at Layer 2; only control traffic, such as PIM packets, is forwarded because these packets are processed by the CPU and forwarded in software. All data traffic passing between protected ports must be forwarded through a Layer 3 device.

From the quote above, a protected port:

• Does not forward traffic to protected port.
• will still forward traffic to non-protected port.
• forward only packets that are processed by the CPU and forwarded in software.
• forward packets through a Layer 3 device.

Port Blocking

By default, the switch floods packets with unknown destination MAC addresses out of all ports… To prevent unknown unicast or multicast traffic from being forwarded from one port to another, you can block a port (protected or nonprotected) from flooding unknown unicast or multicast packets to other ports.

Whilst Protected ports will still forward traffic to non-protected port, blocking a port can be used to block a port from flooding unknown packets to other ports.

Source

Catalyst 3750-E and 3560-E Switch Software Configuration Guide, 12.2(50)SE