topic Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts in Aerohive Migrated Content

Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

mcollins — Wed, 16 May 2018 07:08:52 GMT

I'm looking at blocking inter-station traffic, by unticking 'Enable Inter-Station Traffic' but I'm also looking at using Apple TVs and Chromecasts on the WiFi. Just wondering if anyone has come up with a way to still allow access to services like Apple TVs or Chromecasts without the need to cable them in?

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

AnonymousM — Wed, 16 May 2018 16:03:15 GMT

That does not work - if you disable inter-station traffic, your Apple TVs and Chromecasts will not work anymore (unless your Apple TV is cabled).

I know exactly what you are trying to do. We have a similar situation, and we mainly want to get rid of the huge amount of mDNS traffic flooded into the network.

We have added Firewall rules to disallow IP traffic between clients inside the same VLAN, but that does not block Broadcasts nor Multicast. We tried to block mDNS traffic explicitly, but does does not work for the discovery traffic - so you still have mDNS flooding, but Chromecast does not work anymore...

I got told that this is a known issue, and that Aerohive is working on a fix to better handle Multicast traffic (and to be able to block it properly). I do not know what the current release status is, but I will try to remember to post here once I find out .

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

mcollins — Wed, 16 May 2018 16:33:48 GMT

It's good to know someone else feels our pain! 😛

I've also been testing the Firewall rules and experienced the same behaviour as you did. Which is interesting since this article (https://thehivecommunity.aerohive.com/s/article/Chromebooks-and-WiFi) implies that using Firewall rules should block mDNS traffic.

How long ago did you hear that they're working a feature to better handle Multicast traffic?

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

AnonymousM — Wed, 16 May 2018 19:22:52 GMT

3 weeks ago. I was told the capabilities would be inside HiveOS 8.3r2, and we already have 8.3r4 (and I could not find anything related in the Release Notes). But I guess this also needs a Hivemanager Update, and it was not clear if this will only get into NG, or Classic as well...

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

jose_gonzalez — Wed, 16 May 2018 21:21:36 GMT

We do peer to peer blocking as well, large organization. Currently we do not support Chromecast or Apple TVs. We officially support NovaPro / Recordex panels - and they MUST be wired into the network, yes I know big cost difference - SOHO versus Enterprise.

We are in the future looking into supporting Chromecast and Apple TVs. We are looking into enabling mDNS routing on our switches between VLANs. The Chromecast or AppleTV would have to be wired on the network. mDNS "Bonjour routing" on the APs is out of the question for us, due to read about performance issues.

This isn't a Aerohive issue, is a mDNS issue, it was built SOHO and no consideration for enterprise scaling. It has been left up to the vendors to figure out how to deal with it.

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

mcollins — Thu, 17 May 2018 07:01:09 GMT

@Jose Gonzalez What performance issues have you read about? I've personally used Aerohive's Bonjour gateway at many schools, with 1000+ students on BYOD, and it's generally worked well. The only once we had an issue where it had trouble learning all the Apple TVs. Aerohive ended up giving us an on-prem HM VM with a license for just running Bonjour Gateway - it worked fine after that.

What switches are you planning on using for the mDNS routing?

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

mcollins — Thu, 17 May 2018 07:02:50 GMT

@Carsten Buchenau Thanks for that. I certainly look forward to the release!

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

jose_gonzalez — Thu, 17 May 2018 22:07:21 GMT

@Hammertime Right in the HiveOS release notes. HOS-11138 Enabling Bonjour Gateway on an AP150W, AP122 or AP122X can cause those devices to report excessively high CPU loads. Workaround: Because Bonjour Gateway is a legacy feature than is generally unnecessary, you can either disable Bonjour Gateway, or relocate Bonjour Gateways to a higher-powered access point such as an AP550.

http://docs.aerohive.com/330000/docs/help/english/documentation/8.2r1a_HiveOS_ReleaseNotes.pdf

HP Procurve switches running 16.02.22m code.

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

AnonymousM — Fri, 18 May 2018 01:04:01 GMT

Inter-station traffic is specific to SSIDs. Meaning that two devices both connected to the same SSID would and same AP would not be able to communicate.

You should be able to have one device on one SSID and another device on another and even though inter-station traffic is disabled on both SSIDs, the devices should be able to communicate with each other.

There was a thread regarding this on the old forums from years ago. I can't find the thread though. So this could act differently now, but based on where the traffic filter is applied, it should still work.

It's not pretty, but I ended up doing this to enable inter-station traffic blocking on a student SSID while still allowing the teachers iOS devices to monitor the students devices via Apple Classroom app.

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

AnonymousM — Fri, 18 May 2018 01:06:39 GMT

Thread I referred to in prior post since I can't edit it...

https://community.aerohive.com/aerohive/topics/ipads-suddenly-cannot-detect-apple-tvs-for-airplay-on-entire-network

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

jose_gonzalez — Fri, 18 May 2018 01:27:18 GMT

@Brian Powers

I'm not a Apple person... but don't you need to setup mDNS "Bonjour routing" in addition multi SSID setup in order for it to work? Or can you just input a IP address on another subnet on the iPad to reach the Apple TV like any other normal device?

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

AnonymousM — Fri, 18 May 2018 01:30:36 GMT

That depends a lot on the version of the AppleTVs. The 3rd generation and newer (I think) actually use low power bluetooth for pairing to the iOS device to do the screen share. Meaning they don't even have to be connected to a WLAN to work.

The older ones use the WLAN for all communications.

https://help.apple.com/deployment/ios/#/apd8fc751f59

Bonjour would be needed to traverse VLANs, not SSIDs specifically (unless the SSIDs were attached to different VLANs).

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

jose_gonzalez — Fri, 18 May 2018 01:39:19 GMT

@Brian Powers Thanks! I think your answer is best to the original question. 

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

mcollins — Fri, 18 May 2018 04:56:12 GMT

@Brian Powers I would have expected inter-station traffic to just be for each SSID, as it's set per SSID, however, from my testing when one SSID has it applied, all traffic is blocked regardless of SSIDs. I've been testing with AP230s and AP250s on NG.

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

mcollins — Fri, 18 May 2018 05:35:58 GMT

@Jose Gonzalez The listed models are only the entry level APs, I've personally used AP230s on networks with around 1000 MacBooks and over 10 VLANs - it worked fine for me. I have read Aruba switches now support mDNS routing/relaying but I've never tested it myself.

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

mcollins — Fri, 18 May 2018 05:39:33 GMT

@Jose Gonzalez and @Brian Powers Regarding the Apple TVs, if you want to connect via WiFi or cable and your clients are on a different VLAN then yes you need some kind of a gateway to route or relay the advertisements across the VLANs.

The 3rd Generation Apple TVs do support Bluetooth pairing but a lot of environments don't like this. I personally haven't played around to confirm this behaviour but my understanding is that the Apple TVs will create an ad-hoc network between the device on channel 149 with a width of 40MHz for 11n and 80MHz for 11ac.

Obviously, the rest of your networks infrastructure would need to avoid these channels, which is an issue for high density environments.

Also, as your Apple TV and client are now in an ad-hoc network, you wouldn't be able to stream content which isn't saved locally to the client, unless you have 3G enabled on the client.

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

AnonymousM — Fri, 18 May 2018 12:11:57 GMT

@Brian Powers Good point, I didn't realize this setup would work  Which is, actually, another argument that "1 SSID" is not always the best implementation. We changed a large school from 4 (students, faculty, private devices + guests) to 1 SSID using PPSK, and we see 3 main issues now:

Multicast traffic is flooded into all networks, even if user groups are on different VLANS, as this is wireless broadcast on the BSSID -> mDNS traffic is killing us
Not being able to disable inter-station-traffic for some groups (e.g. students and guests), which would help with the Multicast issue -> but we cannot, for reasons discussed here (AppleTV, Chromecast, ...)
PPSK device limit is set per SSID, not per PPSK user group (long-term feature request...), which limits us in enforcing different rules for different groups.

As mentioned in my first answer, Aerohive confirmed that they are working on a better way to handle Multicast traffic, which might solve most of these issues, we will see.

Until then we are discussing with the school to go back to 2 or even 3 SSIDs...

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

AnonymousM — Fri, 18 May 2018 20:24:17 GMT

@Carsten Buchenau It sounds like it may not anymore. Seems as if @Hammertime is seeing differing results now. I've not testing it in quite some time, so a version of HiveOS could have altered the behavior.

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

mcollins — Mon, 21 May 2018 13:52:10 GMT

@Brian Powers I've done some more testing today, I think I must have only tested scenario 2.

The following is how I had it setup:

Scenario 1:

SSID 1 on VLAN10 - Enabled Inter-station traffic
SSID 2 on VLAN20 - Disabled Inter-station traffic

Clients on SSID 2 couldn't communicate with each other but can communicate with clients on SSID 1.

Scenario 2:

SSID 1 on VLAN20 - Enabled Inter-station traffic
SSID 2 on VLAN20 - Disabled Inter-station traffic

Clients on SSID 2 can't communicate with each other and SSID 1, and SSID 1 can't communicate with each other and SSID 2.

I also tried the above with Firewall rules but they didn't seem to have an effect on the mDNS traffic either way.

Sorry for any confusion!

Re: Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

DeVoID — Thu, 03 Nov 2022 13:46:57 GMT

Maybe im missing something, but disabling inter-station traffic doesnt stop anyone connecting to an Apple TV. I disabled that setting which helped speed up our wifi network tremendously.

As for the Apple TV's, and Bonjour, as long as you configure Bonjour within the XIQ properly, you wont have any issues. I have dozens of Vlans, with the Apple TV's on one Vlan, faculty on another, and students on yet another Vlan, and all can stream to the Apple TV, can print to Bonjour enabled printers. no problem at all. Enabling Bonjour, you will see it inject itself into your DHCP server and in each of the Vlans...

So, i dont get why anyone is saying disabling that setting would stop a Macbook from connecting to an Apple TV..... of course Bonjour is the WORST protocol EVER, and should be at end of life (years ago)..... i remember apple looking at "Wide Area Bonjour" and worked on it until it fell apart and they realized it wasnt worth it to them... and i believe work stopped back in 2009....... I just wish they should scrap bonjour and use any other protocol out there for their **** devices..... anyway, the above is my experience on disabling that setting.

Jason.