@terziyski 

Thanks for the links to the story and the post.  I hadn’t read the story.  Some of the comments in the post are mine and I feel that I now have a good understanding of how device isolation is working in the AX55.

For others that may be reading this thread, please allow me to add a few comments:

1.  In the AX55, the main, guest, and IoT networks are not really separate networks as they all access the same LAN.  They are simply different SSIDs for accessing the router’s LAN.

2.  Devices connecting with the guest SSID(s) are routed directly to the internet and router options are available to allow these devices to see each other and to access the LAN.

3.  Devices connecting with the main and IoT SSIDs, along with wired devices, can all communicate with each other unless they are placed in the router’s device isolation list.  Devices placed in the list can communicate with all other isolated devices.  It makes no difference if they are main network or IoT devices.

4.  The AX55, when operating in AP mode, does not have an option for device isolation.  Therefore all devices connected through the AP are not isolated even though these same devices may be isolated in the main router’s list.  The reason for this is that the AP routes the connections directly to each other and does not need to route them through the main router.   Only those devices connected directly to the main router can be isolated.

5.  Placing the AP in satellite router mode and enabling EasyMesh on the main and satellite routers (with ethernet backhaul), changes the way devices are managed.  In AP mode, the AP clients appear as “wired” clients in the main router’s clients list.  In the EasyMesh configuration, the remote clients are shown in the main router’s clients list as though they were directly connected to the router with their proper Wi-Fi icons. Testing shows the device isolation feature of the main router now works for all clients.  This means IoT devices can now be truly isolated from other network devices.

6.  The disadvantage of the EasyMesh configuration is that the guest and IoT SSIDs are not meshed.  IoT devices will need to use the main SSID(s) if they are remotely located from the main router.  The guest network and SSID is only available in the main router.  If there is a need to extend the guest network, additional routers, access points, or range extenders will be needed.

7.  One last comment on device isolation… During testing an isolated PC was able to connect to a non-isolated printer and SIP phone.  The reason turned out to be that the three devices are hardwired through a switch before they get to the router.  In another test, the isolated PC was connected through another satellite AX55 (EasyMesh disabled) and was able to access a non-isolated wired PLC on the main network.  The fix was to put the router (instead of the PC) in the device isolation list.  Bottom line – If you want true isolation, take into account how the devices are actually connected.

  @zEnterHacker 

After reading this thread again, I am not clear on your network topology and have some questions.

1.  Are you using four or five routers?

2.  What do you mean by "Wired Dual Access Point Mode"?

3. Can you share a detailed topology map?

I have four AX55 routers here and would like to test your configuation.  The idea is to have two isolated networks, one for IoT devices and one for everything else.  The way everything is configured now is with one main router after the ISPs "bridged router".  On the LAN side of the main router are the IoT devices along with an additional AX55 AP and one RE700X extender.  This main subnet is not EasyMeshed as the only roaming device is the Roomba vacuum cleaner.

A secondary AX55 is connected to one of the LAN ports of the main router (meaning double NAT) and serves all the home computers, phones, and printer.  It is EasyMeshed to a satellite router and two RE700X extenders.  The devices on this subnet can access everything on the main subnet but the IoT devices can not access the secondary subnet.  This provides security.

My current configuration is working well but I am always looking for a way to improve.