Showing results for 
Search instead for 
Did you mean: 

Client isolation on vSZ

New Contributor II
i configured client isolation on vSZ. Its working from Wifi client to wifi client. But i can reach hosts connected with ethernet cable in the same subnet.
ok... so i tryed to place a L2 Access list, to allow only traffic to Gateway, dhcp and broadcast. but it seems, that this ACL uses the MAC adresses as source MAC and not destination. ... so i have to add all wifi clients, and this is not possible...
Is there another way to place a L2 or L3 ACL? How can i setup a isolation with cabled hosts in the net?

Thank you very much!

Contributor II
When Client Isolation = Yes, it should result in WiFi clients not being able to communicate with each other but they should be able to communicate with the Default Gateway (which is learned via DHCP traffic).

Do you have a DHCP server running on this SSID?
Are you trying to communicate with an IP which is not listed in the DHCP Response?

New Contributor II
Yes there is a DHCP Server in place.
What do you mean with, not listed in the dhcp response?
The IP which i tried to ping was de domain controller in this network, and because its a guest wlan this access should not be able... as far i remember the IPs which i could ping was fix configured IPs, at least the Server was fix for shure.

But i have to test again with focus on dynamic configured IPs next week.
It is the only way to block theese access with a L2 access List and block mac addresse from the Server?

Contributor II
Take a look at to understand how CI works.

In simple terms, to make CI work correctly, you need to design your network to have nothing but a default gateway and DHCP server on your guest VLAN. 

Contributor III
You could create an ACL on your network to prevent wireless cleints seeing your internal cabled network:

Good luck