Nebula joined AP Layer 2 isolation

nielsscheldeman Posts: 33  Freshman Member
First Anniversary 10 Comments Friend Collector
edited November 2023 in Nebula

So here is the implementation I'm doing at my cliënts now: NWA210AX AP's configured in Nebula with extra SSID's in separate VLAN. VLAN configured in firewall so that it can't communicate with LAN1 and also can't communicate with ZyWALL and in Nebula Layer 2 Isolation enabled that cliënts only can communicate with LAN1 interface on Firewall.

Pretty tightened down: Cliënts can't access management interface ZyWALL, cliënts can't access other cliënts connected through wifi and they can't see devices in LAN1.

But what they have access to is the management interface of the Access points (IP in LAN1). It's strange in how this is possible because the security rule in the firewall doesn't allow this(ZyXEL FLEX 200)

All Replies

  • PeterUK
    PeterUK Posts: 2,714  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer

    Not sure if you can do this with Nebula but what I have done is given AP's their own VLAN so on boot they connect by Native get the config then load on set VLAN so you can't access management interface

  • Zyxel_Judy
    Zyxel_Judy Posts: 926  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer

    Hi @nielsscheldeman ,

    Firstly, could you please verify if your NWA210AX is running on the latest firmware version, which is 6.60P1? Also, please check if the Captive Portal (Sign-in method) is enabled for the SSID.

    If the Captive Portal is enabled and the NWA210AX firmware is not up-to-date, you can upgrade it by navigating to Configure > Firmware Management > Device Tab, selecting the device, and clicking on 'Upgrade Now'. This is a known issue that has been resolved.

    Another possible reason could be a misconfiguration in the firewall rules or the VLAN settings. I would suggest double-checking the firewall rules and the VLAN configurations. Make sure that the rules are correctly applied for the VLANs are properly isolated.

    In case the issue still recurs after implementing the recommendation above, please share with us your Org/ site name and enable Zyxel support by going to Help (On the top of right) > Support Request > Zyxel support Access to enable and save. Additionally, please send us the USG FLEX 200 configuration file and diagnostic file via private message. This will allow us to review your specific firewall rules and any other relevant configurations.

    Be a Community MVP: Win a VIP Deal Dash on Your Next Zyxel Purchase!

Nebula Tips & Tricks