I have deployed an Omada hardware based wifi into a development environment that does a lot of IoT development. I have an OC200, and a handful of EAP670s. Since this is replacing and older Ubiquiti network, I am recreating existing SSID's and network configurations. We have 6 wifi SSID's, each pinned to a VLAN on our Juniper switches. The gateway for each subnet is a leg on our Palo Alto firewall (a PA220 that is short for this world). Where I can not achieve parity seems to be with AP isolation. I need 2 of these networks to do AP isolation for the clients attached to them but they still have to be able to hit resources on the other side of the firewall interface such as our internal DNS servers, NTP servers, MQTT server, etc. There is the "Guest" option which kind of achieves this but then also seems to block the clients from reaching ANY rfc1918 address. And it seems to block a system reaching to a client (like ssh) on those networks. That won't work for us. Is the correct AP isolation option hidden somewhere and I'm just not seeing it? Or a command via CLI? 

Thanks for the help.