Client Isolation on MX67W Guest SSID

[LeopoldN]

Hi everyone,

I was checking out the internal wireless settings on a MX67W and found that the option to use Meraki NAT with isolated 10.0.0.0/8 networks is not available. And since the firewall rules only apply up from layer 3 and not in the layer 2 VLAN I currently have no idea how to isolate clients from each other on a guest SSID.
Is there some way to still achieve that requirement or do I actually need standalone APs for that?

Best Regards

Leopold

[alemabrahao · Accepted solution]

MX does not support this functionality, only Meraki APs.

[Brash]

It's possible that if you apply a group policy to the VLAN with deny rules for RFC 1918 addresses, it may prevent clients from communicating with each-other as they all connect directly to the MX for L2 and L3 communication.

You would need to test to validate as I personally don't manage any networks using the MX wireless.

[LeopoldN]

I had hoped group policy was an option but I didn't try using it since the only option is to overrides the existing L3 firewall rules and I had already tried using a deny rule for the guest network on the firewall tab.
It would surprise me if a group policy firewall rule has a different functionality than configuring firewall rules on the firewall tab.

But thank you for the suggestion.

[IvanJukic]

Hi @LeopoldN ,

You can certainly have isolated clients on a Guest SSID on a MX67W. The way to do it would be to use VLANs. Basically, create a guest VLAN, then Tag that Guest SSID with the new Guest VLAN. See my post below to a thread earlier this year asking a similar isolation question.

https://community.meraki.com/t5/Wireless/Anyway-to-set-firewall-rules-for-specific-SSIDs/m-p/268266#...

If you have further quetions, let me know.

[LeopoldN]

Thank you for the suggestion but I am not trying to isolate the guests from the rest of the network but from each other. I already use a VLAN for the SSID and was just dissapointed to find Meraki NAT (with an isolated 10.0.0.0/8 network for each client), that you can use on APs, is not available for MX.