Layer 2 isolation prevents wireless clients from communicating with other devices under same SSID or the same VLAN. When enabled, clients can only access gateway of the network to get internet access and but any attempt of communication directly between devices will be blocked. This is an easy security function especially for guest networks that difficult to manage client behaviors.

L2 isolation is available for SSIDs in Bridge mode but is disabled by default. When an SSID operates in Bridge mode, clients are bridged through the Access Point, possibly onto a specific VLAN. Upon connecting to the AP, clients can issue a DHCP request on their assigned VLAN. After DHCP completes, the MAC address of the default gateway is tracked for that client.

This MAC address is then allowed through a Layer 2 firewall, which blocks all other traffic to and from the wireless client. Since this feature depends on DHCP, clients with static IPs connected to an SSID with L2 isolation enabled won't be able to transmit meaningful traffic.

Wireless clients and wired clients can communicate with each other.

With L2 isolation enabled, clients can only communicate with the default gateway and are blocked from communicating with other devices on the same VLAN or broadcast domain. For a wireless client to reach another device, communication must go through the upstream gateway (e.g., using inter-VLAN routing or ACLs). Any traffic destined for an address on the same VLAN as an isolated client will be denied, while traffic to other VLANs will be forwarded and routed as usual.

NAT mode supports basic L2 isolation, where wireless clients cannot communicate with each other but can still communicate with the AP uplink.

When L2 isolation is enabled, it blocks wireless clients from communicating with any devices on the network, except for the gateway.

Navigate to Configure > Access Point > SSID List > Wireless > Advanced Settings

This configuration option is disabled by default but can be enabled on a per SSID basis.