topic RE: Block MU to MU traffic AP filter rule in Network Architecture & Design

Block MU to MU traffic AP filter rule

Frank11 — Fri, 20 Jun 2014 05:17:00 GMT

I know you can Block MU to MU traffic if you route wireless traffic through the controller.

If you use the "Bridge @ AP" topology can you Block MU to MU traffic via Access Point filter rules?

RE: Block MU to MU traffic AP filter rule

John_Kaftan — Fri, 20 Jun 2014 06:58:00 GMT

Even if you are doing B@HWC you can only block mu to mu traffic for end systems on the same controller. We have multiple controllers and end systems can talk to other end systems on the other controller if block mu to mu is on. To accomplish what you are trying to do you can create a rule that denys traffic to the subnet the end systems are on. This will work, I've tried it. They wont be able to ping their gateway but they will be able to traverse the gateway because the gateway is never the destination. These days end systems dont really have to talk to each other directly. If that is true for your network you'll be fine. If not you can make exceptions.

RE: Block MU to MU traffic AP filter rule

Frank11 — Fri, 20 Jun 2014 07:47:00 GMT

We only have one controller (C4110). Currently we do have a student vlan which is B@HWC and the option "Block MU to MU traffic" ticked, but would like to have it set at B@AP and use AP filtering rules to achieve the same effect if that is possible.

RE: Block MU to MU traffic AP filter rule

hsachse — Fri, 20 Jun 2014 14:27:00 GMT

Hello Frank,

refering to the 8.32.x/9.x user guide for my understanding the "Block MU to MU traffic" applied in the advanced configuration option of the wlan service is useable for both B@HWC and B@AP. The blocking mechanismen based on a layer 2 (mac address table of wireless client successfully authenticated on the same SSID, client traffic between clients on the same SSID is blocked).

Policies typically applied at layer 3 level (controller support l2, too). "User Guide, V9.01" page 5-7 include a example for l3 policies/rules to limit client communication applied at B@HWC level. I think its still possible to apply the same rule at ap level. In the user guide on page 5-9 you can explanation of "AP rules/AP filtering" and its limitations.

I agree with John, there a limitations if in multiple controller setups, but this seems not relevant to your user case.

Best regards
Hartmut

RE: Block MU to MU traffic AP filter rule

Renato_Lopes — Fri, 20 Jun 2014 14:27:00 GMT

Hartmut Sachse, can you send me yours users guide?

RE: Block MU to MU traffic AP filter rule

Gareth_Mitchell — Fri, 20 Jun 2014 14:27:00 GMT

Hi Renato

Product documentation is available for download here http://www.extremenetworks.com/support/documentation

You will need an extranet account to download the documentation.

Regards

-Gareth

RE: Block MU to MU traffic AP filter rule

Renato_Lopes — Fri, 20 Jun 2014 14:27:00 GMT

I managed to apply rules for traffic entering the network (in the AP through the wifi), based on the destination MAC. However could not apply the rules for traffic leaving the AP, analyzing source MAC. It can apply rules in the AP based on mac source for the traffic coming out of AP? Thank you for attention renato lopes

RE: Block MU to MU traffic AP filter rule

Gareth_Mitchell — Fri, 20 Jun 2014 14:27:00 GMT

Hi Renato

Regarding the direction option in the rule; "in" refers to traffic from a wireless client to the AP, "out" refers to traffic destined to the wireless client from the AP.

You can set the mac address as a source or destination according to your requirements within the direction pull-down.

-Gareth