Orbi Pro 6 - IOT Client Isolation

Frank,

---

Frank-NYC wrote:

But I have not been able to find out if this can this be disabled the isolation to allow IoT devices (like Sonos, TVs, Streaming devices, Video server, etc) to interact with each other within the Wireless 3 network. 

What sounds interesting and is often propagated will often not work without loosing many features. Assuming it would be a plain IPv4 router, you can't use any Multicast based discovery (like Bonjour or UPnP SSDP) beyond of each network. Do you intend to change the wireless network if you intend to play music or a movie to a media player?

This wonderful security theory is workable only for IoT requiring no control from e.g. a mobile App on the same network, or where everything is handled and controlled over the Cloud.

I admit, I'm not up to speed on the current Orbi Pro firmware implementation. While there might be a control to enable/disable wireless isolation (over the complete SSID) for this network, there is certainly no simple firewall user firewall matrix config with three source and three destination networks where a user could allow or deny. 

As well, I doubt there is any multicast routing between the three IP subnetworks, too.

I don't understand why the very basic controls and mandatory features are not available on these and many similar routers and mesh systems in this market segment.

-Kurt

To question #1, the short answer is yes.  It is possible within each SSID to toggle device isolation on/off and allow within that LAN devices to discover and interact with one another.  I haven't played enough with the network isolation to determine if it operates one way to two way.  Certainly when toggled on, devices on that particular LAN cannot access devices connected on the other LANs.  Don't know (but suspect it the case) that being on also prevents devices on other LANs discovering devices on the LAN in question.  Will have to check that.

Frank,

Hope the below helps.

Everything on SSID 1 (admin) can see and (via app) talk to those on SSID3 (IoT).  But not the other way around.  So with SSID iphone, I can tell a irobot on SSID 3 to vacuum via the app on the phone.  I can monitor and change my IoT Thermostat, etc.  This is done via an iphone app where I have entered the IP address for each device, or physically on the IoT device where I can setup a fixed the IP address (Nexia Thermstat), or the decvice website that contains the same fixed IP address.    All of these IoT devices have fixed addresses that I use from my reserved pool, i.e., below the starting point for the DCHP addressing.  DCHP addressing normally starts at __.___.__.02. I start at 51 or 101 to allow me to assign 50 or 100 devices that will always have th esame iP address.

(Normally) Alexa Echo DOT etc (SSID IoT) cannot see an external speaker on SSID1 or broadcast to it.  If on same SSID, speakers can be connected to various sats or the main router and play normally.  A phone on SSID 1 can make changes to an Echo DOT on SSID IoT, but again that is because you ise an app that knows the IP address of the Echo DOT.  I say (Normally) because I have not tried to look for app settings that would allow me to specify a IoT IP address.  That probably wll not work, but have not tried - something to attempt in spare time.

Hardwire connections to devices and switches are all SSID1 by default.  My TV, roku, sat receiver, AV receiver etc are all hard wired.  My Echo DOT cannot see or communicate with them but my SSID wifi phones etc can stream or airPlat to any of them regardless which Orbi SAT or Router phone is connected to.  My AV receiver has wifi, but terrible location so use wired that has been there for years.  That locks all related wifi speakers to SSID1, or they will not be seen.  but I do not want Alexa Echo DOTS etc anywhere near SSID1, so Echos ater IoT SSID.  All mics and cameras on SSID1 off by default.