Unticking 'Enable Inter-Station Traffic' while using services such as Apple TVs or Chromecasts

[mcollins]

I'm looking at blocking inter-station traffic, by unticking 'Enable Inter-Station Traffic' but I'm also looking at using Apple TVs and Chromecasts on the WiFi. Just wondering if anyone has come up with a way to still allow access to services like Apple TVs or Chromecasts without the need to cable them in?

[systemscsn]

Maybe im missing something, but disabling inter-station traffic doesnt stop anyone connecting to an Apple TV.  I disabled that setting which helped speed up our wifi network tremendously. 

As for the Apple TV's, and Bonjour, as long as you configure Bonjour within the XIQ properly, you wont have any issues.  I have dozens of Vlans, with the Apple TV's on one Vlan, faculty on another, and students on yet another Vlan, and all can stream to the Apple TV, can print to Bonjour enabled printers.  no problem at all.  Enabling Bonjour, you will see it inject itself into your DHCP server and in each of the Vlans...

So, i dont get why anyone is saying disabling that setting would stop a Macbook from connecting to an Apple TV.....  of course Bonjour is the WORST protocol EVER, and should be at end of life (years ago)..... i remember apple looking at "Wide Area Bonjour" and worked on it until it fell apart and they realized it wasnt worth it to them... and i believe work stopped back in 2009.......  I just wish they should scrap bonjour and use any other protocol out there for their **** devices..... anyway, the above is my experience on disabling that setting.

Jason.

[mcollins]

@Brian Powers​ I've done some more testing today, I think I must have only tested scenario 2.

The following is how I had it setup:

Scenario 1:

• SSID 1 on VLAN10 - Enabled Inter-station traffic
• SSID 2 on VLAN20 - Disabled Inter-station traffic

Clients on SSID 2 couldn't communicate with each other but can communicate with clients on SSID 1.

Scenario 2:

• SSID 1 on VLAN20 - Enabled Inter-station traffic
• SSID 2 on VLAN20 - Disabled Inter-station traffic

Clients on SSID 2 can't communicate with each other and SSID 1, and SSID 1 can't communicate with each other and SSID 2.

I also tried the above with Firewall rules but they didn't seem to have an effect on the mDNS traffic either way.

Sorry for any confusion!

[AnonymousM]

@Carsten Buchenau​ It sounds like it may not anymore. Seems as if @Hammertime​ is seeing differing results now. I've not testing it in quite some time, so a version of HiveOS could have altered the behavior.

[AnonymousM]

@Brian Powers​ Good point, I didn't realize this setup would work  Which is, actually, another argument that "1 SSID" is not always the best implementation. We changed a large school from 4 (students, faculty, private devices + guests) to 1 SSID using PPSK, and we see 3 main issues now:

• Multicast traffic is flooded into all networks, even if user groups are on different VLANS, as this is wireless broadcast on the BSSID -> mDNS traffic is killing us
• Not being able to disable inter-station-traffic for some groups (e.g. students and guests), which would help with the Multicast issue -> but we cannot, for reasons discussed here (AppleTV, Chromecast, ...)
• PPSK device limit is set per SSID, not per PPSK user group (long-term feature request...), which limits us in enforcing different rules for different groups.

As mentioned in my first answer, Aerohive confirmed that they are working on a better way to handle Multicast traffic, which might solve most of these issues, we will see.

Until then we are discussing with the school to go back to 2 or even 3 SSIDs...