Client-Isolation across Accesspoints?

Hello,

i have the same problem.

I use the AP in Bridge to LAN Modus.

Is there a solution to fix the problem?

Thanks a lot.

Markus said:

Hello,

i have the same problem.

I use the AP in Bridge to LAN Modus.

Is there a solution to fix the problem?

Thanks a lot.

Hey there, 

for us the issue was, that clients that connect through different APs (and different Bands, i.e. 2.4 and 5 GhZ) can't see each other. (Even if we have disabled client isolation at all)
If both are on different Accesspoints, but the SAME band, everthing is fine. (i.e. 2.4 to 2.4 and 5 to 5 is fine)

this suggestion over here however seems to describe the problem the other way round: 
https://ideas.sophos.com/forums/17359-sg-utm/suggestions/34011193-client-isolation-between-clients-connected-to-same

They have client isolation NOT working between different bands, only works on the same band. 

So, guess there is at least something strange with how that feature is supposed to work and how it really works. 

hey,

I switch the band to 2,4Ghz but still the same problem.

no connection to the other clients. :-(

Hallo Markus and welcome to the UTM Community!

Are you certain that you don't have 'Client isolation' enabled in the 'Advanced' section of the Wireless Network definition?

Cheers - Bob

Hello Bob,

Thank you for the welcome.

Yes, i do Double Check.

Is disabled.

It works if I connected with my phone on the same AP as the client. Ping and all are fine.

If I connect to a different AP nothing work.

Other client is not pingeble.

Best regards

Markus

Hey,

It’s me again.

I set the client isolation to enable -> save.

Than back to disable-> save.

Now it seems to work.

Client connected to different AP are possible to ping.

I will observe the next Day an we will see.

This feels like a bug, Markus.  Have your reseller open a case with Sophos Support and let us know what they say.

Cheers - Bob

It works for the first time.

If I connect again to the same AP and when back to a different it’s doesn’t work.

Enable -> disable client isolation it works again.

I run at home the home license. So I don’t have a reseller to connect.

Any other way to make a case by Sophos?

Hello Markus,

Thank you for contacting the Sophos Community.

I can try to replicate the issue and get GES to investigate, I just to make sure I am on the same page as you!

Could you please tell me how are you testing connectivity between the clients is this trough Ping or https://x.x.x.x or a different method?

Are the SSID in a Separate Zone or bridge to LAN?

Does your Firewall is only configured for Gues Network >> Service = Any >> Destination = Any IPv4?

Regards,

Hello,

I noticed the problem at my sonos speakers.

So if I connected to a different AP no control from with the iPhone App are possible.
After that I us a ping tool iNetTool to ping the speaker. No ping possible.

If I connected to the same AP as the speaker ping and control are possible.

If I connected to a different AP I switch Client isolation to enable -> Save. Then I switch Client isolation Disable -> Save. Then it works from different AP.

SSID in the are the Same I have just one WLAN = SSID running. So I use “bridged to AP LAN”

So ware I would say no firewall rules are necessary.

Thanks a lot

Markus

Hello,

did you here something new?

Best regards

Markus

Hello Markus,

Thank you for the follow-up.

Sorry, I forget to respond.

It seems like this is a limitation on the AP. It looks like the documentation needs to be updated. 

Regards,

Hello Markus,

Thank you for the follow-up.

Sorry, I forget to respond.

It seems like this is a limitation on the AP. It looks like the documentation needs to be updated. 

Regards,

Really....

I think that is a bug in the AP - Software.

Because, if you switch client isolation on -> off it works fine up to you lose the connection to the AP for example - out of range.

If you in range again. No connection to the client that connect to a different AP.

client isolation on -> off it workS fine again.

So I think problem I the software.

Best regards

Markus

Hello Markus,

Let me bring these comments to GES and let you know what they say next week!

Regards,

Hello,

do you have some good new now?

Best regards

Markus

Hello Markus,

Thank you for the follow-up.

I brought this to GES, but they said this is expected. 

However, if you could open a Case ID and send it to me via PM and enable the Support Access. 

I could try to gather what they have asked to see if DEV can confirm the behaviour, as of now they are saying this is a limitation.

Regards,