Isolate IP connecting through WLAN

[Fares7]

We are having a WLC with access points that is providing WLAN access for users and assigning IPs in the range 192.168.5.0/24.

We need to isolate 192.168.5.10 from communicating with other IPs in the same subnet. 

I know it will be layer 2 communication. so is there a way to isolate this IP without creating another SSID for this user ?

[Kasun Bandara]

check if pear-to-pear blocking is matching for your requirement. 

https://www.kareemccie.com/2018/06/what-is-peer-2-peer-blocking-in-cisco.html

https://community.cisco.com/t5/wireless/private-vlan-in-wireless/td-p/1405388

[Flavio Miranda]

Hi,

  Under the same SSID what you can do is isolated clients preventing them to communicate with another, but. this will be true for any client under that SSID.  This mean, there will be no communication between clients on that SSID. You can do it by enabling P2P blocking  on the WLAN. As I said, this solution may not help you if you want to isolate only one IP (client).

For WLC AIROS based I dont believe you can solve that.

 For newer WLC like 9800 you have client profiling which could give you more flexibility and ultimately if you have DNAC then you are able to apply micro segmentation at client levels in conjunction with ISE.

[ammahend]

192.168.5.0/24 users are limited to wireless only or extends to wired network also ?

[Scott Fella]

With not really knowing your setup.  One way you can do this is to use radius like ISE and place that device, mac auth or another type of auth in a different subnet and be done with it.  Create an isolated subnets where you want to place or maybe add future devices to. So depending on how the device authenticates, you can use mab or even 802.1x to place device(s) into another vlan.  If you have DNAc and ISE, you can use SG tagging like @Flavio Miranda mentioned.  Just optiones to think about.

[S Leigh]

Hi,
You could always put an access list on the vlan blocking that address as an idea