A node isolation method, a switching device, and an Ethernet storage system implement node isolation between zones in the Ethernet storage system. A first switching device in the Ethernet storage system determines a first access control list ACL rule between a first node and a second node, where the first switching device is an access device of the first node, the first node and the second node are located in the Ethernet storage system, and the first node and the second node correspond to a first zone; and if a packet whose source is the first node or a packet whose destination is the first node matches the first ACL rule, forwards the packet.