I disagree that clients on the same SSID will all see the same BC/MC traffic, regardless of the VLAN they’re assigned to. That’s broken. If I assign a client to a particular VLAN they should see link local multicast from only that VLAN. I decided to test iPSK as a substitute for group-policy assigned VLANs applied directly to clients. This feature works correctly. A client connecting with the PSK for VLAN 105 gets traffic from only VLAN 105. A client connecting with the PSK for VLAN 100 gets traffic only from VLAN 100. There’s no leakage of BC/MC traffic when using iPSK. Only when using client-specific group-policy assigned VLAN tags. I thought the multicast to unicast conversion feature might be contributing to this, but it didn’t change the behavior. The MR44 is still leaking link-local multicast across VLANs to clients with VLAN tags assigned via group policy. To confirm I didn’t have something wonky going on that I wasn’t aware of I created a completely new group policy that assigned VLAN 999. VLAN 999 doesn’t exist in my network, anywhere. It’s not trunked on any ports, and there are no devices in that VLAN. Theoretically a client assigned to VLAN 999 using a group policy shouldn’t see any traffic beyond what the client itself generates. In reality though the client still saw all the link local multicast traffic generated in the default VLAN assigned to the SSID. This feature is broken, and it’s especially bad from an IPv6 perspective given how much of the protocol is based on link-local multicast and ICMPv6. Leaking that beyond VLAN boundaries breaks a lot of things.
... View more