NWA50AX Layer 2 Isolation

JJANP

Dear Support,

Recently Enabled Intra-BSS Traffic blocking for ssids on Radio 1 2.4G

Currently i am facing issues with client connected via Radio 1 with enabled Layer-2 Isolation Profile cannot communicate 11b/g (within same SSID)

when clients connect via Radio 2 5G on the same SSID can communicate,

Thanks

Julian

Zyxel_Kay

Hi @JJANP

 

Enabling Intra-BSS traffic blocking may result in the blocking of traffic within the same SSID and same AP. However, Layer-2 isolation offers another level of security by preventing WiFi clients from communicating with other WiFi clients, APs, computers or routers on the network. It's important to note that Intra-BSS traffic blocking and Layer-2 isolation function aren’t related to Wi-fi standards (802.11 a/b/g/n/ac/ax).

For more information on this topic, you may refer to the following article:
How to set up Guest access to the network on Standalone mode — Zyxel Community 

 

If you are experiencing any issues with the functionality of Intra-BSS traffic blocking on your site, please share with us the symptom in detail and provide us with the following information so that we can assist you better: 

1. What is the firmware version of your NWA50AX? It’s recommend to update your AP to the latest firmware V6.29(ABYW.1)C0. 
2. Please collect your AP diagnostic file and config file (startup-config.conf) and send them to us. This will allow us to investigate the issue more efficiently. 

 

Kay 

JJANP

Kay thanks a lot for your quick response.

Would like to clear how i configured.

Enabling Intra-BSS traffic prevents WiFi clients from communicating with other WiFi clients within the same SSID (once i have enable clients within that SSID was not able to communicate each other)

Then i configured Layer-2 Isolation Profile: Allow devices with these MAC addresses:

Specified the MAC address of the devices that can communicate each other.

Client-A: Connected to Radio-1 2.4 Was not able to connect to the printer

Client-B: Connected to Radio-2 5G can communicate with the printer

Printer: Connected to Radio-1 2.4

Then moved the client B to Radio-1 2.4

Client-B: Connected to Radio-2 5G (client was not able to connect to the printer)

V6.29(1) / 2022-11-04 15:20:39

This was really strange problem i faced.

i will send you startup-config file

Thanks

Julian

Zyxel_Kay

Hi @JJANP

Based on your description, it seems that you have enabled Layer-2 Isolation on Radio 1 (2.4GHz), which is why the client connected to that radio was unable to communicate with other clients in the same 2.4GHz SSID, except for the ones in the Layer-2 Isolation Profile's allow list.  

Then moved the client B to Radio-1 2.4

Client-B: Connected to Radio-2 5G (client was not able to connect to the printer)

Regarding your statement, could you please clarify if you meant that you moved Client B to Radio 1 or if it's still connected to Radio 2? If Client B is connected to Radio 1, it won't be able to communicate with other clients in the same 2.4GHz SSID. 

Kay

JJANP

Kay thanks a lot for your quick response.

Would like to clear how i configured.

Enabling Intra-BSS traffic prevents WiFi clients from communicating with other WiFi clients within the same SSID (once i have enable clients within that SSID was not able to communicate each other)

Then i configured Layer-2 Isolation Profile: Allow devices with these MAC addresses:

Specified the MAC address of the devices that can communicate each other.

Client-A: Connected to Radio-1 2.4 Was not able to connect to the printer

Client-B: Connected to Radio-2 5G can communicate with the printer

Printer: Connected to Radio-1 2.4

Then moved the client B to Radio-1 2.4

Client-B: Connected to Radio-2 5G (client was not able to connect to the printer)

V6.29(1) / 2022-11-04 15:20:39

This was really strange problem i faced.

i will send you startup-config file

Thanks

Julian

JJANP

Hi Kray,

Client B is connected to Radio 1 2.4GHz and cannot communicate.

Is there any possibility to allow certain clients in 2.4GHz to communicate each other.

In my use case all clients in 2.4GHz & 5GHz need to access the Printer that is connected to 2.4GHz Radio 2

Thanks

Julian

Zyxel_Kay

Hi @JJANP, 

 

To address your need for allowing your 2.4GHz and 5GHz clients to access the printer, you may create a separate 2.4GHz SSID exclusively for the printer and leave all your clients to connect to the default 2.4GHz printer. For example:  

Radio1: 

1. SSID_24GHz (Disable Layer-2 isolation, enable Intra-BSS Traffic blocking) 
2. SSID_for_Printer  

Radio 2: 

1. SSID_5G 

This way, your clients will be able to access the printer without any issues while still maintaining the security provided by Intra-BSS Traffic Blocking. 

Hope this solution works for you. 

 

Kay