This is for a small network at home, but I was wondering (talking from a wireless perspective only) what's the difference of creating two wireless VLANs vs enabling Wireless Isolation within SSID? (the goal is to isolate users in the network; they should not see each other, nor share any files, or access any configuration sites on the router).

There's no cable connected to the router, so, all ports have been marked as Excluded in the VLAN configuration (I'm only looking to configure WIFI access to all my users at home).

  • What do you mean by "wireless VLANs?" If you mean different SSIDs, then you can place restrictions (firewall, ACL, etc.) between the networks. – Ron Maupin Jul 7 '16 at 3:12
  • I think the nuances are somewhat (or entirely) dependent on how the VLANs are implemented in your routing fabric. But I'm not really a 'networking guy'. – James T Snell Jul 7 '16 at 3:19
  • @Ron Maupin, by wireless VLANs I mean, SSIDs mapped to VLANs previously created. So the main difference would be the creation and modifications of restrictions (firewall, etc.)? – Edenshaw Jul 7 '16 at 3:49
  • For a host on one VLAN to talk to a host on another VLAN, the traffic must pass through a router, and you can place restriction, e.g. ACL(s), which can allow some or none of the traffic through, either or both ways. This can be very granular, for instance, you could allow hosts on one network to only access a DNS server on the other network, but no other traffic could pass. – Ron Maupin Jul 7 '16 at 3:54

Old post but gonna answer it anyhow, so that it has an answer.

In terms of WiFi, VLANs could be configured as such that anyone on the same VLAN will be able to see each other and share files, etc. (assuming that wireless isolation is NOT enabled), but no one on differing VLANs would be able to see each other. Using strictly VLANs for complete isolation, you would have to create a new VLAN for each WiFi client and also make sure each client has their PC tag packets as belonging to their assigned VLAN. It is also possible to assign a different SSID per VLAN (depending on equipment abilities) and give a different SSID per client, as opposed to using tags. Using strictly only VLANs may not be desirable for your goal as it would require more management and would very likely hit a VLAN quantity cap before the max number of clients the device can handle is reached.

Wireless isolation is a function that simply keeps ALL members on any SSID, for which the isolation is activated, from seeing each other or sharing files. However, this function does not necessarily prevent any particular WiFi client from accessing the management interface.

To achieve your goal, it appears that you want to make two VLANs. One VLAN is for device management only, which involves assigning the management interface to respond only to requests on that VLAN. The other VLAN is for clients only and would also have wireless isolation enabled on it. If your device allows the creation of multiple SSIDs (with their own passwords), you could assign each VLAN to its own SSID--that would keep clients out of the management interface. Wireless isolation would keep clients from talking to each other. This solution is possible to achieve with only a single wireless device, which could supply an Internet gateway to all VLANs it controls.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.