Restricting access to LAN from WLAN Catalyst 9115 EWC

[Teilo2022]

I have set up two WLANs using four 9115AX AP's. 

I have a Staff WLAN which is accessed via a PSK, on the second WLAN I want to restrict access to the LAN and other clients on the LAN and just gives access to outbound traffic, so people on this WLAN can browse the web but not for example access or see our file share server etc on our LAN.

I'm not sure of the "Cisco" terminology but on old  Access Point it was something like "Client Isolation" ?

[Scott Fella]

Typically if the devices land on different vlans, you would have an access list to do that work or a firewall.  If you want to look at acl's from the wireless point of view, then look at this link.  I'm assuming you are running EWC:

Cisco Embedded Wireless Controller on Catalyst Access Points Configuration Guide, IOS XE Amsterdam 17.2.x - IPv4 ACLs [Cisco Embedded Wireless Controller on Catalyst Access Points] - Cisco

What was there and still is available is peer to peer blocking, but that is not what you want.

[Teilo2022]

Hi Scott - Thanks for that very useful - Yes on EWC 

[Scott Fella]

So your best bet is to use an acl on your L3 switch/router or your firewall.  I tend to not use the acl on the controller unless to restrict access to the controller management.

[Teilo2022]

Is there a specific reason why the ACL shouldn't be done on the controller? I wasn't expecting this to be so complicated when on previous AP's it was a tick in a box.

[Rich R]

Peer to peer blocking is still a tick in a box.

@Scott Fella's point is that you should have those WLANs connected to different VLANs to achieve separation rather than using ACLs.  You still need to use peer to peer blocking on that WLAN to prevent clients "talking" to each other.
Separate VLANs achieves full layer 2 and IP separation of the clients.  Trying to do the same on WLANs when the clients are still in the same VLAN is just messy and imperfect and would never pass a security audit.

[Teilo2022]

Peer to peer as far as I understand works per VLAN as well; even though you configure it on the WLAN both Guest WLAN and The main WLAN which we want to isolate it from are on the same VLAN. We are provided 2 VLANs from a separate organisation we are tenants to one of which is used for Comms and other for Data. 

[Rich R]

Take note of the limitations of peer to peer blocking in the context of flexconnect local switching (which is what you're using with EWC) and also that it is not applied to multicast:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/ewc/17-2/config-guide/ewc_cg_17_2/peer_to_peer_client_support.html