iPSK anchor/Foreign east west traffic & P2P

[craiglebutt]

we have a requirement to allow non corporate devices straight out to the internet, this is to do with ISO27001.

So have started  to create iPSKs from internal to DMZ no problem, just time consuming creating DNS,DHCP, Zones ect on Firewall and then replicating to secondary links.

So plan is to have a generic iPSK instead of creating /29.

Issue is the east west traffic, even though it is not the company's data we still have to make secure till it gets to the internet.

With this in mind was looking at enabling P2P, If I've got this right should block the devices seeing each other on a /25 subnet if on the same WLC.  Is this the case with Anchor/Foreign WLCs as well?

[Scott Fella · Accepted solution]

Make sure you understand the risk or what can happen. If you upgrade for example and the config changes and disabled p2p or there is a bug that the feature doesn’t block 100%, are you okay with that? If so, then test and validate that p2p blocking is working in your environment using multiple aps. What happens when you add another controller? You now have a risk of an ap moving to the other controller which p2p will not block. It seems like you are designing a workaround solution using a single ssid and that is okay, just understand the risk and or understand if there is a better way like a new ssid just for that.

[craiglebutt]

Cheers for that