AP, Cisco layer 3 switch & PFSense: How to isolate wireless devices?.

[BobFlemming]

OThe problem: ensure wireless devices cannot speak to each other but can print.

The kit: GL Net access point, Cisco layer 3 switch & a PFSense firewall.

So, initially I intended to put the GL Net box into AP mode (instead of router) and use Cisco’s private vlan tech to isolate the devices from the switch. Then create firewall rules to allow printing on PFSense.

This seems to be a mistake as the AP is not Cisco and the private vlan tech is proprietary.

A) Is this a mistake?

B) What would you do with the above kit to achieve this goal?

The switch is a SF350 device.

……………,

[pieterh]

the private vlan config is created on the Cisco switch, and is only active inside the Cisco switch
for all connected ports, the port can be considered as an access port independent of vlan (packets are untagged)
the non-cisco devices do not need to know anything about the private vlan's

the switch isolates the individual ports from each other, but allow traffic to an uplink port for printing
it does this by using an vlan pair (different vlan upstream c.q. downstream to the same access port)