P2P Printing While P2P Blocking Using Flexconnect

[proddy1]

I am working on a WLAN solution on a Flexconnect 7510 WLC using local switching. This WLAN has the P2P Blocking action set to "Drop" due to company policy. There is a need to allow printing between two devices on the same WLAN. With the current P2P configuration, printing is failing as expected. The company will not allow P2P; therefore, I am looking for an ACL solution that would allow printing to occur without allowing P2P on the WLAN.

The WLC User Guide notes:

"Cisco controller with central switching clients supports peer-to-peer blocking for clients associated with
different APs. However, this solution targets only clients connected to the same AP. FlexConnect ACLs
can be used as a workaround for this limitation."

So my question: Is it possible to continue having the policy configured to "drop", and exclude the two devices so that only the two devices can print? If so, will you provide a useful link that I can reference, or an example of what the ACL would look like? There are other devices on the WLAN.

[Rich R · Accepted solution]

Central switching - WLC blocks all p2p even between clients on different APs
Flex local switching - AP only blocks p2p between clients on the same AP.  It cannot block p2p between clients on different APs so that must be done with ACL or on the switch network.  That's literally the opposite of what you're wanting to do.  So the limitation is inability to block between APs, the workaround is to use an ACL instead to do the blocking.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/wlan_security.html#peer-to-peer-blocking
If you connect the printer to the LAN then the wireless clients won't be blocked from talking to the printer at all - they can still talk to the printer because that is not wireless p2p.

[proddy1]

Thank you for the response. The feedback has been helpful. After considering the available options, we decided to move the wireless printer to a separate SSID, which I thought might create the same effect as placing it on the LAN, however, that didn't work and after viewing the document, I understood why.

[proddy1]

As a follow up to my original question, can I create a specific VLAN and/or SSID that allows peer-to-peer connectivity and ensure it won't change other SSID/VLAN security controls?