topic Re: RE: Client Isolation - Extreme Wireless controller in ExtremeWireless (Identifi)

Client Isolation - Extreme Wireless controller

Boopaa — Thu, 12 Jan 2017 08:07:00 GMT

Hi Team,
Does anybody have any ideas of how client isolation can be achieved for users on the same SSID and in the same vlan in Controller. I know other manufacturers have a simple Client isolation feature that will achieve this but I can't find it in Extreme Controller.
My ultimate goal is "Users have to communicate only gateway not others".
Any ideas welcome..!!!

RE: Client Isolation - Extreme Wireless controller

Nathiya_M — Thu, 12 Jan 2017 11:11:00 GMT

Hi Boopathy,

Please find the steps below to block wireless client to client traffic on a WLAN.

From the Controller/Appliance GUI
Select WLAN Menu
Select desired WLAN to block MU to MU traffic
Click Advanced button
Check the box in the CLient Behavior Window Block MU to MU traffic (not supported on Bridged at AP topologies)
Click the Apply Button
Click Save Button

Reference article below,

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-block-wireless-client-to-client-tra...

Regards,
Nathiya M

RE: Client Isolation - Extreme Wireless controller

Boopaa — Thu, 12 Jan 2017 11:11:00 GMT

Thank you for the quick response and I will confirm soon..!!

RE: Client Isolation - Extreme Wireless controller

Nathiya_M — Thu, 12 Jan 2017 11:13:00 GMT

Hi Boopathy,

Please confirm, is it B@EWC or B@AP topology?

Regards,
Nathiya M

RE: Client Isolation - Extreme Wireless controller

Zdeněk_Pala — Thu, 12 Jan 2017 12:49:00 GMT

In the B@AP the "block MU to MU" does not work. You can create rule in Policy Role and allow only traffic destined to your gateway MAC and Broadcasts all other can be blocked.

RE: Client Isolation - Extreme Wireless controller

Nathiya_M — Thu, 12 Jan 2017 13:09:00 GMT

Please check the policy rule configuration for B@AP setup,

https://gtacknowledge.extremenetworks.com/articles/Solution/Block-MU-to-MU-enabled-but-users-can-sti...

Regards,
Nathiya M

RE: Client Isolation - Extreme Wireless controller

Umut_Aydin — Thu, 12 Jan 2017 20:45:00 GMT

MU to MU also doesn't work if the client are connected on the same AP.

RE: Client Isolation - Extreme Wireless controller

Craig_Guilmette — Thu, 12 Jan 2017 22:36:00 GMT

https://gtacknowledge.extremenetworks.com/articles/Solution/Block-MU-to-MU-enabled-but-users-can-sti...

RE: Client Isolation - Extreme Wireless controller

VDaniel — Wed, 26 Jun 2019 15:30:00 GMT

Helllo I have the same problem . I implemented -

From the Controller/Appliance GUI
Select WLAN Menu
Select desired WLAN to block MU to MU traffic
Click Advanced button
Check the box in the CLient Behavior Window Block MU to MU traffic (not supported on Bridged at AP topologies)
Click the Apply Button
Click Save Button

and Applyed the Rulles .

The problem is solved only 1/2 . If 2 users are connected on the same ap everything is fine but if 1 ap is associated to wlc 1 and other ap-s is associated to second wlc 2 and 1 user is connected to 1 ap from wlc 1 and other users is connected to the ap from wlc 2 they can still comunicate

PLease if you have other option let me know

Thank you

RE: Client Isolation - Extreme Wireless controller

Craig_Guilmette — Wed, 26 Jun 2019 19:34:00 GMT

https://gtacknowledge.extremenetworks.com/articles/Solution/Block-MU-to-MU-enabled-but-users-can-still-communicate

Have you read the above document? This is the way to block the users from talking to anybody except their default gateway.

RE: Client Isolation - Extreme Wireless controller

VDaniel — Wed, 26 Jun 2019 19:41:00 GMT

Hello Craig
I did , the problem ist that the VNS is B@EWC NOT B@AP - IS a Guest VNS

RE: Client Isolation - Extreme Wireless controller

Craig_Guilmette — Wed, 26 Jun 2019 19:47:00 GMT

It doesn't matter how the topology is forwarded..These ACL/Filter rules are applied to the guests role preventing the users from communicating with anybody on its subnet except the default gateway. Call our GTAC if you still need help after looking at the document again.

Re: RE: Client Isolation - Extreme Wireless controller

Rey_Juan_Carlos — Fri, 17 Oct 2025 09:12:22 GMT

Hi to all.

We have a large problem with this solution, in our scenario, we have multiple vlans for every user collective (with Radius Filter-Id) with B@AP topologies, but if we have to make 1 rule to permit every Gateway and one rule to deny every network, we fill the capacity rules on the aps.

¿Somebody have better solution?

Thanks a lot

Re: RE: Client Isolation - Extreme Wireless controller

Rey_Juan_Carlos — Thu, 13 Nov 2025 11:53:48 GMT

Hi to all, we have to:

Permit only traffic destined to our gateway (MAC_Source/Mac_Dest)

Permit Broadcast (Mac_Dest ff:ff:ff:ff:ff:ff)

Deny all

With this all works fine.