I am having an issue where WiFi client on the main SSID can't not communicate with each other if they are wireless. The CAN communicate with LAN resources. Just not Wifi client to Wifi client. I know some router calls this AP Isolation. But I can't find anything like that on the Sonicwall TZ-200.
For example, a laptop client on WIFI can't communicate a WIFI Printer. BUT as soon as the SAME laptop client is wired in via ethernet it can communicate with the WIFI Printer.
On SonicWALLS, in version 5.x (and 6 too, I imagine) this is known as "Interface Trust". To adjust this setting, go to Network -> Zones and check the box to "Allow Interface Trust" to resolve this issue.
I will caution you however that if you are using the WLAN zone which has interface trust disabled by default, and you are using a SonicPoint with version 5.x you are doing it wrong. The wireless configuration of SonicPoints is extremely arduous and I cannot disrecommend this product enough. If you can return these, do. They are a major headache. I love their firewall, but hate their SonicPoints.
To properly configure them, the SonicPoints should be the only thing in the WLAN zone which should be on an untagged VLAN. You should then create another zone (with interface trust enabled). You then need to go to Network -> Interfaces and click "Add Interface" and create an interface with a VLAN tag other than 1 with a parent interface of whatever the SonicPoint is plugged into and you need to select your newly created zone.
Next, navigate to SonicPoint -> Virtual Access Point and create a Virtual Access Point Group (VAP group) and then create a Virtual Access point. The Virtual Access Point (VAP) needs to be set to the same VLAN tag you used earlier. Then you need to edit the VAP Group and add the VAP to it. Finally, you are ready to go to SonicPoint -> SonicPoints and edit the SonicPoint in the middle section. You then can assign the VAP group to the WAP.
You will also need to ensure that the WAP is either plugged directly into the SonicWALL or that you have a switch that supports VLAN tagging. If you go the switch route, you need to have the untagged VLAN assigned to the port you connect the WAP(s) to and tag or trunk each of the VLANs on the port on the switch using the same VLAN tag/number you used on the SonicWALL - otherwise you will run into issues. If you need to connect more than one WAP directly to the SonicWALL, you can use PortShield groups to have 2 ports on the same WLAN zone.
If you do not do this, you will find weird issues like being unable to talk to the other computers on the network, but getting internet access or getting spotty internet access which will work great for awhile and then drop out all of the sudden inexplicably.
Finally, you should note that you will need to configure firewall rules between the zone you created and the LAN zone in order to talk to your wired printer and other devices on the LAN. You should also note that you will be unable to discover that printer automagically using Windows because the WAP is not on the same zone as the printer (no matter what you do) and that Bonjour (if you use a mac) will not discover properly unless you configure multicasting and adjust some other specialized settings in an advanced configuration page and configure mDNS in IP Helper. You may also need to make some special adjustments for IPv6. You can however specify the IP address manually to print to the printer.
