Layer 2 isolation on wireless controller from USG Flex 500

Niels2021

Normally we set up our Access points (NWA210AX) in standalone mode. Most of our clients have maximum 5 AP's, so that's perfect. We often offer then a extra SSID on a separate VLAN with also Layer 2 Isolation enabled, so that clients can only access the internet.

For a big client now, we need minimum 25 AP's, so we decided to work with Wireless controller on Flex 500 in combination with WAX610D AP's. But I cannot find Layer 2 isolation in AP Profile on the Flex? It's in the firewall, but only available on LAN1/LAN2/Reserve/DMZ interface. I cannot select a VLAN. How can I be able to do this? We don't want to use Nebula(also because then the WAX610D would be overkill)

Zyxel_Stanley

Hi @Niels2021  

If AP is controlled by ZyWALL series, then there are many different scenarios in L2/L3 communication. So L2 isolation function removed from AP profile.

As your requirement: Wi-Fi client can only access to Internet but is unable to communicate in layer 2 network.

 

You can configure it to realize your scenario:

(1) Enable Intra-BSS Traffic blocking in AP profile

->Prevents peeping from associated Wi-Fi clients those connected using the same AP and SSID.

(2) Enable L2 isolation on your switch ports those connected to APs.

->Prevent switch replies client MAC address to others AP. So enable L2 isolation on AP connected ports.

Niels2021

Zyxel_Stanley said:

Hi @Niels2021  

If AP is controlled by ZyWALL series, then there are many different scenarios in L2/L3 communication. So L2 isolation function removed from AP profile.

As your requirement: Wi-Fi client can only access to Internet but is unable to communicate in layer 2 network.

 

You can configure it to realize your scenario:

(1) Enable Intra-BSS Traffic blocking in AP profile

->Prevents peeping from associated Wi-Fi clients those connected using the same AP and SSID.

(2) Enable L2 isolation on your switch ports those connected to APs.

->Prevent switch replies client MAC address to others AP. So enable L2 isolation on AP connected ports.

Hello,

Thank you for your response.

Intra-BSS Traffic blocking is a begin, but not enough because everyone on another Access Point will still be able to access the client on a different Access Point.

Preventing switch replies to other AP's is also not a solution, because the AP's also have an internal SSID where clients are free to communicate with other wireless clients.(for example a mobile phone screencasting over wifi to a laptop)

Zyxel_Stanley

Hi @Niels2021  

You still can achieve your requirement by configure different devices.

(1) On FLEX500, create multiple VLANs for different SSIDs.  (e.g. VLAN10/20 are isolate/ VLAN30 non-isolate)

(2) On FLEX500, Enable Intra-BSS Traffic blocking in AP profile those you would like to isolate. (e.g. VLAN10/20)

(3) Enable VLAN isolation those you would like to limit VLAN ID. (some switches support it. e.g. GS1920) Then unlimited VLAN(SSID) clients are free to communicate with other wireless clients.