Isolate Wi-Fi clients

Client isolation prevents wireless clients connected to the EX15W device from communicating with other clients. There are two mechanisms for client isolation configuration:

This section provides instructions for both mechanisms.

Isolate clients connected to the same access point

 

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Network > WiFi > Access points.
  4. Create a new access point or modify an existing access point. See Configure an open Wi-Fi access point, Configure a Wi-Fi access point with personal security, or Configure a Wi-Fi access point with enterprise security.
  5. Check to ensure that Isolate clients is enabled. This setting is enabled by default.
  6. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Create a new access point or modify an existing access point. See Configure an open Wi-Fi access point, Configure a Wi-Fi access point with personal security, or Configure a Wi-Fi access point with enterprise security.
  4. (Optional) Set the client isolation to true, if it is not already set. This is enabled by default.s
    (config)> network wifi ap digi_ap isolate_client true
(config)>
  5. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  6. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.

Isolate clients connected to different access points

Isolating clients that are on different access points involves the following steps:

  1. Create new access points.
  2. Assign the access points to separate LAN interfaces.
  3. Assign those LAN interfaces to separate firewall zones.
  4. Create firewall filters to prevent traffic between the two firewall zones.

 

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Create a new access point.

    By default, the EX15W comes with one preconfigured access point, named Digi AP. In these instructions, we will use the existing Digi AP access point and create another new access point, named new_AP.

    1. Click Network > WiFi > Access points.
    2. For Add WiFi access point:, type a name for the access point and click .

    3. For SSID, type the SSID. Up to 32 characters are allowed.
    4. Select the appropriate type of Encryption and complete the encryption-related fields as appropriate. See Configure an open Wi-Fi access point, Configure a Wi-Fi access point with personal security, or Configure a Wi-Fi access point with enterprise security for details.
  4. Configure the firewall:
    1. Click Firewall > Zones.
    2. In Add Zone, enter LAN2_isolation_zone for the name of the zone and click .

      Note We will be creating LAN2 later in the procedure.

    3. Create a firewall filter to provide internet access for the LAN2_isolation_zone:
      1. For Add packet filter, click .
      2. For Label, type Allow LAN2_isolation_zone to External.
      3. For Source zone, select LAN2_isolation_zone.
      4. For Destination zone, select External.

    4. Create a firewall filter to drop traffic from the Internal zone (used by the LAN1 interface) to the LAN2_isolation_zone:
      1. Click Firewall > Packet filtering.
      2. For Add packet filter, click .
      3. For Label, type Drop traffic from Internal to LAN2_isolation_zone.
      4. For Action, select Drop.
      5. For Source zone, select Internal.
      6. For Destination zone, select LAN2_isolation_zone.

    5. Rearrange the firewall filters.

      Firewall filters are applied in the order that they are listed. As a result, in order to drop traffic from the Internal zone to the LAN2_isolation_zone, this filter must be listed prior to the Allow all outgoing traffic filter, which allows the Internal zone to have access to any zone.

      To move the Drop traffic from Internal to LAN2_isolation_zone filter to the top of the list:

      1. Click the filter title.
      2. Drag-and-drop the filter to the top of the list.

  5. Create a new LAN:

    By default, the EX15W device comes with one preconfigured LAN, which includes the default access point. We will use that LAN for the default access point, and create a new LAN for the second access point.

    1. Click Configuration > Network > Interfaces.
    2. For Add interface, type a name for the LAN and click .

    3. For Zone, select LAN2_isolation_zone.
    4. For Device, select the new Wi-Fi access point.
    5. Click to expand IPv4.
    6. For Address, type an IP address and subnet for the LAN.
    7. Click to expand DHCP server.
    8. Enable the DHCP server.
  6. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Configure a new access point:
    1. Create a new access point:
      (config)> add network wifi ap new_AP
(config network wifi ap new_AP)>

      New access points are enabled by default.

    2. Set the SSID for the Wi-Fi access point. Up to 32 characters are allowed.
      (config network wifi ap new_AP)> ssid my_SSID
(config network wifi ap new_AP)>
    3. Set the security for the access point:
      (config network wifi ap new_AP)> encryption type value
(config network wifi ap new_AP)>

      where value is one of:

      • none
      • psk
      • psk2
      • wpa2:
    4. Complete other encryption-related fields as appropriate based on the type of encryption. See Configure an open Wi-Fi access point, Configure a Wi-Fi access point with personal security, or Configure a Wi-Fi access point with enterprise security for details.
  4. Configure the firewall:
    1. Return to the root config prompt by typing three periods (...):
      (config network wifi ap new_AP)> ...
(config)>
    2. Add a new firewall zone named LAN2_isolation_zone. We will be creating LAN2 later in the procedure.
      (config)> add firewall zone LAN2_isolation_zone
(config firewall zone LAN2_isolation_zone)>
    3. Create a firewall filter to provide internet access for the LAN2_isolation_zone.
      1. Return to the root config prompt by typing three periods (...):
        (config firewall zone LAN2_isolation_zone)> ...
(config)>
      2. Add the new packet filter:
        (config)> add firewall filter end
(config firewall filter 2)>
      3. Set the label for the filter:
        (config firewall filter 2)> label "Allow LAN2_isolation_zone to External"
(config firewall filter 2)>
      4. Set the source zone to LAN2_isolation_zone:
        (config firewall filter 2)> src_zone LAN2_isolation_zone
(config firewall filter 2)>
      5. Set the destination zone to external:
        (config firewall filter 2)> dst_zone external
(config firewall filter 2)>
    4. Create a firewall filter to drop traffic from the Internal zone (used by the LAN1 interface) to the LAN2_isolation_zone:

      Firewall filters are applied in the order that they are listed. As a result, in order to drop traffic from the Internal zone to the LAN2_isolation_zone, this filter must be added before the Allow all outgoing traffic filter, which allows the Internal zone to have access to any zone. In this example, we will add the new to the first position in the list (index position 0).

      1. Add the new packet filter:
        (config firewall filter 2)> add .. 0
(config firewall filter 0)>
      2. Set the label for the filter:
        (config firewall filter 0)> label "Drop traffic from Internal to LAN2_isolation_zone"
(config firewall filter 0>
      3. Set the source zone to internal:
        (config firewall filter 0)> src_zone internal
(config firewall filter 0)>
      4. Set the destination zone to LAN2_isolation_zone:
        (config firewall filter 0)> dst_zone LAN2_isolation_zone
(config firewall filter 0)>
      5. Set the filter to drop traffic between the zones:
        (config firewall filter 0)> action drop
(config firewall filter 0)>
  5. Create a new LAN:

    By default, the EX15W device comes with one preconfigured LAN, which includes the default access point. We will use that LAN for the default access point, and create a new LAN for the second access point.

    1. Return to the root config prompt by typing three periods (...):
      (config firewall filter 0)> ...
(config)>
    2. Add the new LAN:
      (config)> add network interface LAN2
(config network interface LAN2)>
    3. Set the device to the new Wi-Fi access point:
      (config network interface LAN2)> device /network/wifi/ap/new_AP
(config network interface LAN2)>
    4. Set the zone to LAN2_isolation_zone:
      (config network interface LAN2)> zone LAN2_isolation_zone
(config network interface LAN2)>
    5. Set the IP address and subnet mask of the LAN:
      (config network interface LAN2)> ipv4 address address/mask
(config network interface LAN2)>
    6. Enable the DHCP server:
      (config network interface LAN2)> ipv4 dhcp_server enable true
(config network interface LAN2)>
  6. Save the configuration and apply the change.
    (config network interface LAN2)> save
Configuration saved.
>
  7. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.