Anyone still using Peer to Peer Blocking on WLAN

[trapasso]

Hello,

I work at a University and I have always had P2P blocking set to Drop.  With all the students it was piece of mind.  I have just been asked if it is relevant.  I personally still think P2P blocking is relevant and maintains a nice security posture but I am curious what other think.  

Do people still set P2P blocking or do you just disable it?

[Rasika Nayanajith]

The P2P blocking feature only works for clients connected to the same AP. In that sense, it is not very useful for controlling P2P traffic between users across multiple APs.

Therefore I would suggest to disable it

HTH
Rasika
*** Pls rate all useful responses ***

[Rich R · Accepted solution]

That's not strictly true @Rasika Nayanajith - what you're saying applies to local switching WLAN.

For centrally switched WLAN P2P blocking is enforced at the WLC level so applies to all clients on the WLAN regardless of which AP they're connected to.

> Do people still set P2P blocking?
YES - our business is primarily public guest hotspots and it is an absolute security requirement of the service.  Clients must be able to connect to the internet but not anything else connected to the WLAN.  Failure to enforce that blocking can lead to disastrous consequences when you can't control who connects to the WLAN - for example users screen casting objectionable material to an unsecured TV connected to the same WLAN, or attempting to hack other users' devices.

[eglinsky2012]

@Rich R - thanks for clarifying that. Does P2P blocking work across the same WLAN across different WLCs if they are in a mobility group? I assume it would not work if they are not in a mobility group.

[MHM Cisco World]

Believe me using ACL to deny wifi client to connect to other wifi subnet is more more better than use p2p

P2p as I mention have many types and there are many restrictions.

Disable it that my recommend

MHM

[Rich R]

@MHM Cisco World how would you configure an ACL to prevent p2p connection between clients on the same WLAN on the same subnet and at layer 2?  While technically possible with very complex MAC and IP ACLs (where supported) this solution would not be very effective or scalable (for example multicast packets used by Bonjour are often not covered by MAC ACLs).

When Meraki first came out it did not support p2p blocking and it was necessary to use ACLs on the APs to achieve some level of p2p blocking - been there, done that - and it's not a neat solution.  The feature was added because numerous customers (like us) needed the p2p blocking feature.  You might not need it in your networks but it is mandatory in some networks.

p2p is not even relevant or an option when clients are in different subnets - because they're not peers.  In that case ACL to control layer 3 traffic between subnets is the appropriate solution but would not be called p2p blocking in the context of WiFi.

[Rich R]

I would expect not @eglinsky2012 but it would also depend on what mobility is in play because with a layer 3 roam the client connection could still be to the other WLC via the mobility tunnel.

[MHM Cisco World]

from cisco doc. 
there are many restrictions as I mention before, you can use it If it mandatory but if you not I recommend keep default (disble) 

Restrictions

• Peer-to-peer blocking does not apply to multicast traffic.

• Peer-to-peer blocking is not enabled by default.

• In FlexConnect, peer-to-peer blocking configuration cannot be applied only to a particular FlexConnect AP or a subset of APs. It is applied to all the FlexConnect APs that broadcast the SSID.

• FlexConnect central switching clients supports peer-to-peer upstream-forward. However, this is not supported in the FlexConnect local switching. This is treated as peer-to-peer drop and client packets are dropped.

  FlexConnect central switching clients supports peer-to-peer blocking for clients associated with different APs. However, for FlexConnect local switching, this solution targets only clients connected to the same AP. FlexConnect ACLs can be used as a workaround for this limitation.

[Rich R]

I made very clear in my first reply that I was referring to the CENTRAL SWITCHING use case.
Yes, with local switching there are many caveats and the decision to use p2p blocking will depend on the use case and taking those caveats into consideration - I've never disagreed with that.

My point is that p2p blocking works really well for most peer to peer traffic on a centrally switched WLAN and for certain use cases it is essential/required as a fundamental security measure.  That doesn't mean we don't also use other security measures (like ACLs) which are still required, but those ACLs are much simpler and generic when p2p blocking blocks most of the possible p2p connections as early as possible.

[MHM Cisco World]

Totally true.

MHM

[Rasika Nayanajith]

Thank you for the detail explanation and correction Rich, yes my response was not 100% accurate and mostly applicable for Flex Local switch scenario.

[MHM Cisco World]

P2P have many types 

And many engineers disable it.

MHM

[Flavio Miranda]

@trapasso 

  I believe it is nice to have if segmentation is importante on your environment. P2P blocking will avoid devices talk each other under the same WLAN, that´s why it is enable on per WLAN fashion.

 For traffic between wlan you  can use ACL on the layer 3 device. 

[alicemorgan3303]

P2P blocking is still relevant, especially in a university environment where security risks can be higher due to the large number of users and devices. It helps prevent unauthorized file sharing and potential malware spread. While some may argue it's less necessary now, maintaining P2P blocking is a good practice for ensuring a strong security posture. It's wise to review current needs and risks, but keeping it enabled generally provides peace of mind.

[trapasso]

Hi everyone,

I want to thank everyone for their posts.

To Rick R, I agree with you about the differentiation between local and central switching.  in my case we are centrally switched and you are correct.

To alicemorgan3303, thanks for your comments. 

we currently have p2p enabled but we are discussing if it is still relevant, on our guest network most definitely.  I wanted to do a sanity check by asking this group the question