14
Votes

Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
 
14
Votes

Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)
Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)
2023-05-07 11:51:44 - last edited 2024-03-04 02:26:25
Model: ER7212PC  
Hardware Version:
Firmware Version:

Dear tp-link!

I'd like to ask to support ACL configuration for ER7212PC as it's done for Omada Switches.

In fact ER7212PC manages networks, and it's strange that I can't create an ACL rule to prevent communication from one network to another.

 

Thanks!

#1
Options
2 Accepted Solutions
Re:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)-Solution
2024-02-04 02:34:11 - last edited 2024-02-04 02:34:47

Hi @folfix @marcle 

Thanks for posting in our business forum.

ER7212PC is considered a gateway instead of a switch and it uses GW ACL and it can support LAN to LAN ACL. SW ACL will stay the same and require an additional Omada switch.

GW ACL on ER7212PC would suffice the inter-VLAN blocking.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
#5
Options
Re:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)-Solution
2024-02-10 02:39:59 - last edited 2024-02-10 02:40:03

Hi @mimi234 

mimi234 wrote

  @Clive_A 

You (TP-Link) advertise it as a 3-in-1 device, incl a quote: "With a single compact box, users can replace their router, hardware controller, and PoE+ switch setup."

I've bought it as I wanted a 3 in one device, so please make it a 'switch' with all the switch functionality. If I wanted a gateway, I would have bought a gateway and unfortunately that you (TP-Link) see the device as a gateway is of no interest to me.

I think you have a serious misunderstanding of the networking products.

Yes, of course it is replacing three devices and make them into a single one as integration. But it does not change it essence of being a router.

 

Second, you can return it becuase it is not a switch in our eyes. And you should really know that if a device with multiple ports, except for a WAN and a LAN port for upstream and downstream, the rest of ports as LAN can be regarded as the switching ports. Is that making a device a switch? Not really. The port is for switching but the system does not function like a switch.

 

It is NOT switching based on the MAC address table instead of on the layer 3 switching.
So, what makes you think it is a switch then? (We commonly distinguish them by the OSI model. We have not released any fully capable layer 3 switch until not long ago.)

 

Third, if it is of no interest to you, get a classic setup, router+switch+controller. Or return it timely.

 

P.S. The model was classified as a gateway from the moment it was released on the official website and do some research yourself and see how it is classified. I think I have explained enough here.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
#8
Options
8 Reply
RE:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)
2023-05-12 22:44:19
Agree this 3 in 1 device needs to offer the same features as a switch. This includes port assignment and port profile management
#2
Options
RE:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)
2023-11-08 11:53:03 - last edited 2023-11-08 12:28:50

+1.
I need proper switch capability in ER7212PC to create network for guests where clients connected to the AP are isolated BUT they have access to some other LAN devices outside AP (e.g. different subnet or even same subnet, but wired connection directly to the ER7212PC).

 

But this use case is pretty broad, some examples:

- Office/Guest networks with access to printer or internal website, but isolation between wifi clients connected to the same SSID and the same AP.

- Smart house with WiFi IoT devices (need to isolate them between each other, but still having access to the main smart home server.

 

This feature was available some time ago, it was named "SSID Isolation" but it was unfortunately replaced with "Guest network", which isolates too much. With "SSID Isolation" it was possible to achieve the same functionality as "Guest network" with proper ACLs. It doesn't work the other way around though, which is bad and limiting. These 2 things could co-exist if needed for backward compatibility.

 

And no, this FAQ does NOT solve the issue: https://www.tp-link.com/pl/support/faq/1060/

 

More details in this post: https://community.tp-link.com/en/business/forum/topic/639208.

I explain there in details that there is no such way to achieve that currently with ER7212PC and EAP.

 

I made a decision to buy Omada because it looked like "SSID Isolation" is still available (plenty old threads advertising that), while it is not. This is critical feature for me and many people in in the tp-link community (smart homes, hotels, offices, etc..) - some examples with different flavours of this problem:

 

1. https://community.tp-link.com/en/business/forum/topic/175382

2. https://community.tp-link.com/en/business/forum/topic/159499

3. https://community.tp-link.com/en/business/forum/topic/519046

4. https://community.tp-link.com/en/business/forum/topic/506332?replyId=1026014

and few more.

 

Similar: https://community.tp-link.com/en/business/forum/topic/594680

#3
Options
RE:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)
2024-01-31 09:13:30
This feature is missing and makes ACL configuration complicated
#4
Options
Re:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)-Solution
2024-02-04 02:34:11 - last edited 2024-02-04 02:34:47

Hi @folfix @marcle 

Thanks for posting in our business forum.

ER7212PC is considered a gateway instead of a switch and it uses GW ACL and it can support LAN to LAN ACL. SW ACL will stay the same and require an additional Omada switch.

GW ACL on ER7212PC would suffice the inter-VLAN blocking.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
#5
Options
Re:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)
2024-02-06 12:47:21

  @Clive_A 

You (TP-Link) advertise it as a 3-in-1 device, incl a quote: "With a single compact box, users can replace their router, hardware controller, and PoE+ switch setup."

I've bought it as I wanted a 3 in one device, so please make it a 'switch' with all the switch functionality. If I wanted a gateway, I would have bought a gateway and unfortunately that you (TP-Link) see the device as a gateway is of no interest to me.

#6
Options
Re:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)
2024-02-06 12:59:20 - last edited 2024-02-06 13:01:24

Clive_A wrote

(...) SW ACL will stay the same and require an additional Omada switch. (...)

 

So I bought the omada switch TL-SG2210P and I still fail to create a setup, where I can have wifi network for guests where clients connected to the EAP610 are isolated between each other BUT they have access to some other LAN devices outside this Access Points (e.g. different subnet or even same subnet, but wired connection directly to the ER7212PC, e.g. printer, but I provided more usecases in my another post in this thread).

 

My EAP610 is connected to the omada switch TL-SG2210P which is then connected to ER7212PC. I tried several setups and I failed, but you're saying it should be possible?

 


 

#7
Options
Re:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)-Solution
2024-02-10 02:39:59 - last edited 2024-02-10 02:40:03

Hi @mimi234 

mimi234 wrote

  @Clive_A 

You (TP-Link) advertise it as a 3-in-1 device, incl a quote: "With a single compact box, users can replace their router, hardware controller, and PoE+ switch setup."

I've bought it as I wanted a 3 in one device, so please make it a 'switch' with all the switch functionality. If I wanted a gateway, I would have bought a gateway and unfortunately that you (TP-Link) see the device as a gateway is of no interest to me.

I think you have a serious misunderstanding of the networking products.

Yes, of course it is replacing three devices and make them into a single one as integration. But it does not change it essence of being a router.

 

Second, you can return it becuase it is not a switch in our eyes. And you should really know that if a device with multiple ports, except for a WAN and a LAN port for upstream and downstream, the rest of ports as LAN can be regarded as the switching ports. Is that making a device a switch? Not really. The port is for switching but the system does not function like a switch.

 

It is NOT switching based on the MAC address table instead of on the layer 3 switching.
So, what makes you think it is a switch then? (We commonly distinguish them by the OSI model. We have not released any fully capable layer 3 switch until not long ago.)

 

Third, if it is of no interest to you, get a classic setup, router+switch+controller. Or return it timely.

 

P.S. The model was classified as a gateway from the moment it was released on the official website and do some research yourself and see how it is classified. I think I have explained enough here.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
#8
Options
Re:Treat ER7212PC as a Switch in ACL (ability to deny communication from one network to another)
2024-02-10 02:46:08

  @wosiu 

wosiu wrote

Clive_A wrote

(...) SW ACL will stay the same and require an additional Omada switch. (...)

 

So I bought the omada switch TL-SG2210P and I still fail to create a setup, where I can have wifi network for guests where clients connected to the EAP610 are isolated between each other BUT they have access to some other LAN devices outside this Access Points (e.g. different subnet or even same subnet, but wired connection directly to the ER7212PC, e.g. printer, but I provided more usecases in my another post in this thread).

 

My EAP610 is connected to the omada switch TL-SG2210P which is then connected to ER7212PC. I tried several setups and I failed, but you're saying it should be possible?

 


 

Got several questions for you.

1. Have you ever read the FAQ about the multi-nets setup like what you are doing now? If you say that you have followed the guide, I don't think you should/could ask a question like this.

2. Have you set up the GW ACL and LAN to LAN to block the guest VLAN interface to others?

3. Guest network is only blocking the clients that are connected to the SSID, but it does not block this VLAN interface. As the literal meaning of the description in SSID creation. Do you have any time to read the description in that?

4. Get a clear conception and understanding of VLAN interface and SSID - Guest Network by reading either the User Guide or calling the technical support and have a conversation with the support. See if you can get them understood?

 

We can continue this with your config screenshots and other details. Try not to have this conversation with your plain words.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
#9
Options