I've read the new documentation and I'm afraid I'm still a bit clueless 
Can somebody explain these two forwarding settings on CAPsMAN classic/ac. This is a guest network and I want to prevent devices connected via Wi-Fi from communicating with each other. Typically called "client isolation" on other systems.
I notice that on new wifi, that this has changed to just "client isolation".
client-to-client-forwarding - specifies whether to allow forwarding data received from this client to other clients connected to the same interface
controls if client-to-client forwarding between wireless clients connected to interface should be allowed, in local forwarding mode this function is performed by CAP, otherwise it is performed by CAPsMAN
local-forwarding -- controls forwarding mode
Controls forwarding mode. If disabled, all L2 and L3 data will be forwarded to CAPsMAN, and further forwarding decisions will be made only then.
Note, if disabled, make sure that each CAP interface MAC Address that participates in the same broadcast domain is unique (including local MAC's, like Bridge-MAC).
Source:
Thanks for the quick reply. It's coming back to me - I recall once turning on local forwarding on a system using a RB2011UiAS where throughput via CAPsMAN on the private network was slow (i.e. Wi-Fi couldn't run at full speed). Local forwarding bypassed CAPsMAN I think. So not really anything do with client isolation.
So if client-to-client forwarding is enabled, the cAP ac will send packets to directly to other devices on same access point, bypassing CAPsMAN and the router. If disabled, the the router/firewall will handle what other devices can be reached on the guest network?
To be exact: if client-to-client-forwarding is enabled, then the entity in control of traffic will pass packets between its WiFi clients managed by same entity. And if client-to-client-forwarding is disabled, then the same entity will block passing packets between its WiFi clients.
In case "local forwarding" is enabled, then it'll be each individual AP which will either pass or block passing packets. So the effect of disabling "client-to-client-forwarding" will be limited to clients connected to same AP ... while traffic between WiFi clients attached to different APs will be allowed.
In case "local forwarding" is disabled, then it's CAPsMAN which will either pass or block passing packets. And in this case, the policy will be enforced "globally" even between WiFi clients attached to different APs (controlled by same CAPsMAN).
Thanks for the clarification. I think I need to go on-site for this one and do some testing.
