topic Re: C9800 - P2P blocking: allow-private-group on a I-PSK based SSID. H in Wireless

C9800 - P2P blocking: allow-private-group on a I-PSK based SSID. HowTo

ciscoprolin — Tue, 24 Sep 2024 10:59:35 GMT

Dear All,

we have P2P blocking enabled on our Identity-PSK based SSID on our C9800 running Rel. 17.12.4 but now there is the need for some wifi clients to see each other while the clients still should be P2P blocked. There is a new feature called "P2P - allow private group".
As we don't have an ISE server running we're wondering how we can still create private groups or IPSK-tags directly on the WLC and how we can assign client MAC addresses to these groups/tags to make sure they will be able to see each other.
We didn't find any guide for this and would be glad to find out how this can be accomplished.
Thanks very much in advance

Re: C9800 - P2P blocking: allow-private-group on a I-PSK based SSID. H

Haydn Andrews — Wed, 25 Sep 2024 02:09:21 GMT

How are you doing iPSK without RADIUS?

iPSK requires a radius server as uses MAB.

Are you using Multi PSK? if so there is no option other than allow all or none.

Re: C9800 - P2P blocking: allow-private-group on a I-PSK based SSID. H

ciscoprolin — Thu, 26 Sep 2024 13:27:55 GMT

Hi, yes we're using iPSK with FreeRadius (not with ISE) but for this private group feature for P2P blocking exceptions we'd like to start testing it without RADIUS by just manually creating a private group on the WLC and assigning MAC addresses to it which should be able to see each other. In the 2nd phase we plan to implement the feature on our FreeRadius. As the WLC will get the RADIUS attributes from the RADIUS Server we're assuming there must be a way to manually create such private groups or IPSK tags. Thanks very much.

Re: C9800 - P2P blocking: allow-private-group on a I-PSK based SSID. H

ciscoprolin — Mon, 30 Sep 2024 07:58:54 GMT

it looks like the solution to this simply is assigning the identical IPSK to all clients which should be able to see each other. Just F Y I. We tested this out successfully (with P2P Blocking Action: Allow Private Group).

Re: C9800 - P2P blocking: allow-private-group on a I-PSK based SSID. H

charles — Fri, 30 May 2025 06:18:38 GMT

Thanks for the solution Very neat way of doing it with and without ISE.