topic Hey, in Wireless

P2P Blocking Action behavior

mpitts — Mon, 05 Jul 2021 13:40:21 GMT

Hello!

I am looking to isolate client traffic for a certain WLAN. I want to deny traffic from clients on the same WLAN, across all APs.

Can anyone explain how p2p blocking action works? Are there any considerations? Please let me know if you need more information,

WLC2504 - FW version 7.6.120.0

Thanks!

Hey,

Ric Beeching — Wed, 08 Mar 2017 02:26:42 GMT

Hey,

It is fairly straight forward when using centrally switched WLANs or with APs in local mode on the same WLC. If you apply P2P Blocking action of drop globally on your WLAN this will stop the APs/WLC forwarding packets between clients attached to all APs.

This does not apply to multicast traffic however.

Ric

Thanks Ric!

mpitts — Wed, 08 Mar 2017 02:35:20 GMT

Thanks Ric!

What if I have APs in flexconnect with local switching?

I am hearing conflicting information.

I appreciate you answering my questions!

No probs,

Ric Beeching — Wed, 08 Mar 2017 02:38:04 GMT

No probs,

For your version of software it appears that P2P blocking is supported on locally switched WLANs:

Peer-to-peer blocking is supported for clients that are associated with the local switching WLAN.

http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-6/configuration-guide/b_cg76/b_cg76_chapter_01001100.html

Ric

Sadly the documentation

Freerk Terpstra — Tue, 18 Apr 2017 23:43:49 GMT

Sadly the documentation regarding P2P blocking with local switching (FlexConnect) is incomplete if you ask me.

What really happens when you enable this feature is that "bridge-group x port-protected" is being enabled on the dot11 radio (sub) interfaces. This feature should* prevent traffic between two wireless connected end-points on the same access-point. There is no "distribution system" by which the other access-points are being informed about other guest clients. This means that you need to implement something like private VLANs on the wired side as well.

*: does not seem to work with latest 8.3 AirOS code, even if both clients are connected on the same radio of the access-point.