Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
For example let's take a University's wireless network for the students or a Wifi in a Hotel: There are many wirelss devices that are causing broadcast traffic.
In theory: Is there any way to minimize that traffic? AP-Isolation is working well on one AP, but there are still other APs where the broadcast-traffic is going through...
First, have you analyzed your network traffic to know just how much broadcast (and multicast) traffic you have now? There needs to be some broadcast traffic on a network for content delivery and network discovery. You need to know how much you have now, and what type of broadcast traffic you have. That will also give you a baseline to measure your control method and its effectiveness.
Then, have you analyzed the APs where isolation is not working? What's different (brand, model, connected devices, type of traffic, is there traffic difference with isolation enabled and disabled?) I'd look there first. Secondly, go up the network from there, any difference in switch or router type or configuration? Compare your answers with the AP that is performing isolation and discover the differences.
As for methods: yes, port isolation works -- on APs and any access switch ports going to your APs. On any services switch do not enable isolation. The exact steps will vary depending on vendor, but the admin console should give you an enable isolation option. Isolation does not prevent broadcast traffic, but it does stop those frames from going to the athX interface and then being transmitted. (see: https://help.ubnt.com/hc/en-us/articles/115001529267-UniFi-Managing-Broadcast-Traffic for details -- it has a good description of broadcast traffic.)
You can listen on the switch's wireless interface and broadcast traffic will not be received by computers connected to an AP. Future network analysis down to the device level (although do not use tcpdump, you won't see the blocked traffic as blocked) should show a decrease in broadcast traffic reaching end users.
One thing you can do is create smaller L2 domains (VLANs). Since broadcasts don't cross VLAN boundaries, this can be an effective method. There can be many caveats, of course, depending on your particular network and applications.
Large sites like universities or hotels use "wireless controllers". These implement broadcast isolation to individual machines whilst ensuring that required broadcasts (such as ARP for the router's MAC address and DHCP) are permitted. These networks operate with the AP handling established traffic and punting before-unseen flows (such as client broadcasts) to the controller.
If you have a large enough wireless network for the level of broadcasts to cause a noticeable loss of performance then you are in the market for a controller-based wireless system. You usually purchase the controller and access points as a coordinated system from a single vendor.
Do take some care as this area of networking has all the downsides of modern networking equipment vendors: poor vendors, good vendors who charge far too much, outrageous lockin-by-protocol to inhibit competition, bandwidth-sizing lies (although the claims of firewall vendors are deeper lies), discontinued products due to acquisitions.
