I am having an issue where WiFi client on the main SSID can't not communicate with each other if they are wireless. The CAN communicate with LAN resources. Just not Wifi client to Wifi client. I know some router calls this AP Isolation. But I can't find anything like that on the Sonicwall TZ-200.

For example, a laptop client on WIFI can't communicate a WIFI Printer. BUT as soon as the SAME laptop client is wired in via ethernet it can communicate with the WIFI Printer.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 14:38

1 Answer 1


On SonicWALLS, in version 5.x (and 6 too, I imagine) this is known as "Interface Trust". To adjust this setting, go to Network -> Zones and check the box to "Allow Interface Trust" to resolve this issue.

I will caution you however that if you are using the WLAN zone which has interface trust disabled by default, and you are using a SonicPoint with version 5.x you are doing it wrong. The wireless configuration of SonicPoints is extremely arduous and I cannot disrecommend this product enough. If you can return these, do. They are a major headache. I love their firewall, but hate their SonicPoints.

To properly configure them, the SonicPoints should be the only thing in the WLAN zone which should be on an untagged VLAN. You should then create another zone (with interface trust enabled). You then need to go to Network -> Interfaces and click "Add Interface" and create an interface with a VLAN tag other than 1 with a parent interface of whatever the SonicPoint is plugged into and you need to select your newly created zone.

Next, navigate to SonicPoint -> Virtual Access Point and create a Virtual Access Point Group (VAP group) and then create a Virtual Access point. The Virtual Access Point (VAP) needs to be set to the same VLAN tag you used earlier. Then you need to edit the VAP Group and add the VAP to it. Finally, you are ready to go to SonicPoint -> SonicPoints and edit the SonicPoint in the middle section. You then can assign the VAP group to the WAP.

You will also need to ensure that the WAP is either plugged directly into the SonicWALL or that you have a switch that supports VLAN tagging. If you go the switch route, you need to have the untagged VLAN assigned to the port you connect the WAP(s) to and tag or trunk each of the VLANs on the port on the switch using the same VLAN tag/number you used on the SonicWALL - otherwise you will run into issues. If you need to connect more than one WAP directly to the SonicWALL, you can use PortShield groups to have 2 ports on the same WLAN zone.

If you do not do this, you will find weird issues like being unable to talk to the other computers on the network, but getting internet access or getting spotty internet access which will work great for awhile and then drop out all of the sudden inexplicably.

Finally, you should note that you will need to configure firewall rules between the zone you created and the LAN zone in order to talk to your wired printer and other devices on the LAN. You should also note that you will be unable to discover that printer automagically using Windows because the WAP is not on the same zone as the printer (no matter what you do) and that Bonjour (if you use a mac) will not discover properly unless you configure multicasting and adjust some other specialized settings in an advanced configuration page and configure mDNS in IP Helper. You may also need to make some special adjustments for IPv6. You can however specify the IP address manually to print to the printer.

  • Wow that seems a lot of work just to get WIFI client to communicate each other. does this have to do with the SonicPoint? What if I made the WLAN a "guest" using the Guest option to by pass all the login and checks. What are some of the security "risk" by doing that instead of creating new Zones?
    – Johnny
    Jun 25, 2015 at 19:50
  • The problem is that all SSIDs must be tied 1-to-1 to a non-zero VLAN tag in V5 of the SonicOS. Unfortunately, this has many ramifications in the OS design. For example, it means a separate security zone, separate subset, etc, so you wouldn't really be able to work around it that way. If you come up with a better way, let me know. This may have changed in V6 of the SonicOS software (I hope!) - I haven't kicked the tires on that yet. Jun 26, 2015 at 20:54
  • Well, you cannot have multiple SSIDs without VLAN tagging , this is true for every vendor, AFAIK. All of those configuration steps could seems non-sense but is extremely granular and flexible in what it permits
    – RobertoP
    Nov 19, 2015 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.