WAX620 Client Isolation Broken after Firmware Upgrade

---

Retired_Member wrote:

1.  I would like to get a technical explanation of exactly how the client isolation works.

---

Client Isolation on business APs - by rule of thumb back to 1997 with the intro of 802.11 (yes, since I had installed the first "larger scale" WLAN networks some Lucent/NCR, later became Avaya - sigh, I'm becoming old) - was and is exactly RT*M: 

"By default, client isolation is disabled for a WiFi network (SSID or VAP), allowing communication between WiFi clients that are associated with the same or different WiFi networks on the access point. For additional security, you can enable client isolation so that clients that are associated with the same or different WiFi networks cannot communicate with each other, except for communication over the Internet, which remains possible."

The scope was and is limited to each individual access point, does not span to any wired or wireless backhaul, and does not include the associated VLAN. And Internet means TCP/IP here - not a consumer router. Quote borrowed from the WAX6x0 User Manual.   

---

Retired_Member wrote:

The devices in a client isolated WLAN should only be able to ARP and send packets to the gateway router MAC, and receive packets from the gateway router MAC.

---

What is the source of this fancy idea please? Reads to me like a description from consumer junk router guest network implementation by some odd L2 filtering.

If you need a Wi-Fi network SSID without access to other resources, like printers, SMB servers .... you make it a dedicated network (VLAN of course). Client Isolation does not provide an el-cheepo replacement for this.

Conclude: Nothing broken on the Client Isolation aording to my testing. Cancelling my call to RaghuHR herewith.

Before you jump onto my head, I'm aware Netgear does use different definition for Client Isolation on the Orbi Pro 6 systems:

"Client isolation prevents hosts and clients in the VLAN from reaching ports, hosts, and clients in the same VLAN, thereby increasing security."

Yes, looks like here we face some higher complexity in place on the L2 filtering. The classic definition of client isolation does come to it's limits where wireless backhaul, WDS, or Insight Instant Wi-Fi are coming into the game, and exceptions apply.

In case you don't like the Netgear Insight "is this device already registered?" query, please be also aware that Fast BSS transition aka. 802.11r we need to understand this requires more tech and config, Netgear only offers the config to the (same) mobility domain identifiers on the  a management platform like Netgear Insight which allows to simplify this process to a single on/off control (nicked "Fast Roaming"). The primary advantage of 802.11r is with the 802.1x client authentication so saving a lot of four way handshakes, reducing the roaming delay by pre-authenticating clients with multiple target APs before a client roams to another AP. With 802.11r implementation, clients pre-authenticate with multiple APs. So, if you intend to deploy at least WPA2-Enterprise with seamless roaming, there is no way around Netgear Insight. The same applies to all cloud based managed wireless systems AFAIK.