Flexconnect + Local switching peer to peer isolation

[Zaku1987]

Greetings, I am looking for some guidance regarding peer to peer isolation using multiple aps with local switching.
I am using a EWC with four APs and am looking to implement some form of peer isolation. I understand that it will work as is for devices on the same AP but not different APs.
Documentation suggests using Flexconnect ACLs, my question is what would such an acl and it's ace look like?

I have tried a couple variations of something like the following below without success;

Extended IP access list P2P_Blocking

1 permit ip host 10.1.2.1 any log

2 permit ip any host 10.1.2.1 log

3 deny ip 10.1.2.0 0.0.0.255 10.1.2.0 0.0.0.255 log

[Flavio Miranda]

@Zaku1987 

 Peer to peer blocking will work for all user under the same WLAN, not AP. If all your user is under the same WLAN, P2P block will work for you.

If you have more than one WLAN you can add the WLC to the Layer3 device that routes your traffic.

[Zaku1987]

The document does not suggest that?
Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE Cupertino 17.9.x - Peer-to-Peer Client Support [Cisco Catalyst 9800 Series Wireless Controllers] - Cisco
"FlexConnect central switching clients supports peer-to-peer blocking for clients associated with different APs. However, for FlexConnect local switching, this solution targets only clients connected to the same AP"

[Flavio Miranda]

@Zaku1987 

 You are  right.  What I said applies only for Central switching, not local switching, sorry for that.

[Flavio Miranda]

Extended IP access list P2P_Blocking

1 permit ip host 10.1.2.1 any log

2 permit ip any host 10.1.2.1 log

3 deny ip 10.1.2.0 0.0.0.255 10.1.2.0 0.0.0.255 log

Who is 10.1.2.1? Is it one client?

[Haydn Andrews]

I went through this with Cisco
Following were recommendations on how to achieve this
SDA (No thanks)
MAC ACLs on the switch (No thanks)
Flex ACLs
I believe you ACL is correct if .1 is the default gateway
I believe you may need a permit any any following the deny statement to allow the users to access other resources (subnets)
Also if DHCP/ DNS are in the same VLAN allow them

Suggest testing it in a lab though

[RxTx]

Did you try to enable P2P Blocking Action available for every wifi-SSID config ?

 

[ammahend]

is 10.1.2.1 your gateway ?

did you apply the ACL ?

1. Log in to the Cisco Wireless LAN Controller (WLC).
2. Navigate to WLANs > Select the SSID to configure.
3. Go to the Advanced tab.
4. Under FlexConnect ACL, select the appropriate ACL
5. Apply the changes.

[Rich R]

You can also achieve the same effect by combining P2P blocking with "switchport protected" on the AP switch ports such that no AP port can talk to any other AP port, only to the uplink or router port.  If and how this is configured depends on your switch topology and connectivity requirements, so can get complicated but worth considering too.
Plenty of guides and videos on how to use this feature if you search.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960l/software/15-2_7_e/configuration_guide/sec/b_1527e_security_2960l_cg/protected_ports.html

https://networklessons.com/switching/protected-port-cisco-catalyst-switch