@Clive_A the explanation about layer 2 vs layer 3 misses the point entirely. Filtering intra-vlan traffic (layer 2) using IP addresses (layer 3) is a thing that is commonly done. See this...

This makes no sense, gear in the "business networking" category like the EAP650 should really have a way to enable client isolation. As it stands the only way to prevent wireless devices on the same...