Preventing local bridge traffic from reaching the LAN
The following command can be enabled so that when a client connects to a VAP, and its traffic is not tunneled to the controller, the admin can control whether the client can access the local network.
Note that this entry is only available when local-standalone-nat is set to enable.
Syntax:
config wireless-controller vap
edit <name>
set local-lan {allow | deny}
next
end