a network device for interconnecting computer networks , the device including a bridge having a plurality of ports through which network communications pass to and from the bridge , the bridge also including a first interface enabling a user to partition the plurality of bridge ports into a plurality of groups , wherein each group represents a different virtual network , wherein the bridge treats all ports within a given group as part of the virtual network corresponding to that group and the bridge isolates the virtual networks from each other , whereby any communications received at a first port of the bridge are directly sent by the bridge to another bridge port only if the other bridge port and the first bridge port are part of the same group .