topic Re: Client Isolation - Cisco Catalyst 9800-CL Wireless Controller in Wireless

Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

smounche — Mon, 01 Apr 2024 08:29:48 GMT

Greetings,

I am seeking assistance with configuring Client Isolation on a single SSID on a Cisco Catalyst 9800-CL Wireless Controller.
Basically, Users within the same VLAN must not be able to communicate with each other.

I have been informed that this can be achieved by connecting to the controller/AP via CLI and configuring an ACL.

I would greatly appreciate receiving detailed instructions on how to perform this configuration

Thank you.

Re: Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

MHM Cisco World — Mon, 01 Apr 2024 08:37:23 GMT

Try under wlan

P2P block

MHM

Re: Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

Mark Elsen — Mon, 01 Apr 2024 09:07:38 GMT

- Ref : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-1/config-guide/b_wl_17_11_cg/wlans.html
>...Configuring Advanced WLAN Properties (GUI)
>...From the P2P Blocking Action drop-down list, choose the required value.
(set to block)

Also check this thread : https://community.cisco.com/t5/wireless/how-to-disable-wireless-client-communication-from-ap-flexconnect/td-p/4606630

Re: Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

balaji.bandi — Mon, 01 Apr 2024 09:08:16 GMT

check below guide :Peer-to-peer blocking

https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html

Re: Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

smounche — Mon, 01 Apr 2024 11:37:52 GMT

I did it.
doesn't work. clients still able to see/communicate with each other

Re: Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

smounche — Mon, 01 Apr 2024 11:49:31 GMT

Thanks, everybody. @balaji.bandi @MHM Cisco World @Mark Elsen

but it seems that "Peer-to-peer blocking" not working fully

Quote;

Note: In Flex mode with local switching, as traffic is not going through the controller, P2P blocking is applied only to traffic from clients connected to the same AP. It will not apply to inter-AP traffic. Similarly, in SD-Access mode, this setting really has no effect, as the client traffic is always sent to the fabric edge switch for policy to be applied.

And here is another Quote;

• Cisco controller with central switching clients supports peer-to-peer blocking for clients associated with different APs. However, this solution targets only clients connected to the same AP.

FlexConnect ACLs can be used as a workaround for this limitation.

- so the question is how do I set ACL

Re: Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

balaji.bandi — Mon, 01 Apr 2024 13:57:21 GMT

If that is your deployment sd-access look at the below document :

Native peer to peer blocking is NOT supported on the SDA-wireless.
An administrator would have to use the Cisco Trustsec policy to achieve the desired output.

https://www.cisco.com/c/dam/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/deploy-guide/cisco-dna-center-sd-access-wl-dg.pdf

Re: Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

smounche — Tue, 02 Apr 2024 07:58:12 GMT

I think my deployment is
Flex AP (local switching)