Client Isolation - Cisco Catalyst 9800-CL Wireless Controller

[smounche]

Greetings,

I am seeking assistance with configuring Client Isolation on a single SSID on a Cisco Catalyst 9800-CL Wireless Controller.
Basically, Users within the same VLAN must not be able to communicate with each other.

I have been informed that this can be achieved by connecting to the controller/AP via CLI and configuring an ACL.

I would greatly appreciate receiving detailed instructions on how to perform this configuration

Thank you.

[MHM Cisco World]

Try under wlan 

P2P block 

MHM

[smounche]

I did it.
doesn't work. clients still able to see/communicate with each other 

[marce1000]

 - Ref : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-1/config-guide/b_wl_17_11_cg/wlans.html
  >...Configuring Advanced WLAN Properties (GUI)
  >...From the P2P Blocking Action drop-down list, choose the required value.
                                                                                               (set to block)

  Also check this thread : https://community.cisco.com/t5/wireless/how-to-disable-wireless-client-communication-from-ap-flexconnect/td-p/4606630

 M.

[balaji.bandi]

check below guide :Peer-to-peer blocking

https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html

[smounche]

Thanks, everybody. @balaji.bandi @MHM Cisco World @marce1000 

but it seems that "Peer-to-peer blocking" not working fully 

Quote;

Note:     In Flex mode with local switching, as traffic is not going through the controller, P2P blocking is applied only to traffic from clients connected to the same AP. It will not apply to inter-AP traffic. Similarly, in SD-Access mode, this setting really has no effect, as the client traffic is always sent to the fabric edge switch for policy to be applied.

And here is another Quote;

• Cisco controller with central switching clients supports peer-to-peer blocking for clients associated with different APs. However, this solution targets only clients connected to the same AP.

FlexConnect ACLs can be used as a workaround for this limitation.

- so the question is how do I set ACL 

[balaji.bandi]

If that is your deployment sd-access look at the below document :

Native peer to peer blocking is NOT supported on the SDA-wireless.
An administrator would have to use the Cisco Trustsec policy to achieve the desired output.

https://www.cisco.com/c/dam/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/deploy-guide/cisco-dna-center-sd-access-wl-dg.pdf

[smounche]

I think my deployment is 
Flex AP (local switching)