I would because I have configured it with other wireless equipment (specifically Ubiquiti). I put this in the other thread, but here's the scoop on how it works with Sophos gear (directly from UTM support):
"When using Bridge-to-LAN/Bridge-to-VLAN client isolation will not be able to block traffic between two stations connected to different APs on the same LAN segment."
This means that if you implement it, and are able to then restrict communication between APs, you can acheive full L3 isolation. I did this by adding IP ACLs on the AP switchports.
The Ubiquity gear uses IP ACLs on the APs so clients can only communicate with the gateway IP address. Sophos gear must use MAC blacklisting based on the MAC addresses of locally connected clients; that's my best guess anyway based on this behavior. So it is possible to get full client isolation, but it wold be nice to see more customer-facing documentation about this feature, since you can enable it using bridge mode. If I hadn't verified that is was working, I'd be oblivious to a wide-open attack vector in the network.
I would because I have configured it with other wireless equipment (specifically Ubiquiti). I put this in the other thread, but here's the scoop on how it works with Sophos gear (directly from UTM support):
"When using Bridge-to-LAN/Bridge-to-VLAN client isolation will not be able to block traffic between two stations connected to different APs on the same LAN segment."
This means that if you implement it, and are able to then restrict communication between APs, you can acheive full L3 isolation. I did this by adding IP ACLs on the AP switchports.
The Ubiquity gear uses IP ACLs on the APs so clients can only communicate with the gateway IP address. Sophos gear must use MAC blacklisting based on the MAC addresses of locally connected clients; that's my best guess anyway based on this behavior. So it is possible to get full client isolation, but it wold be nice to see more customer-facing documentation about this feature, since you can enable it using bridge mode. If I hadn't verified that is was working, I'd be oblivious to a wide-open attack vector in the network.
