@daq Only the main router can isolate guests from the network, an access point is only able to isolate one guest from another guest.

An access point belongs to the main router's network, all clients, guests or not, belong to the same network, and main router provides IP and default gateway by DHCP without even knowing if it's a "guest" or not.

Plus, access point mode, as you pointed out, disables routing features and behaves essentially like a switch.

I figured as much, but wanted to confirm.

I ended up replacing my router with an actual AP and setting up a separate VLAN for guest network. I was just hoping to squeeze some useful function out of my C5400 after it started failing as a router, but i guess it worked for 3 years without issues so that's good enough.

I do wish $300 devices lasted a bit longer though. $100/year to rent a router seems steep.

BTW, I don't think there's any difference in segregating client from client and segregating client from local network. Maybe I misunderstood what you said. Either way this point is tangential to this discussion.