Apple Continuity / 6GHz Client Isolation issue with AltaPass (AP7 Pro)

[MapleBaconPoutine]

Running into some issues, so I used AI to help gather information about my environment and thoughts. I wonder if this is expected or if not, would there be a workaround aside from moving those devices back to 5ghz?

Environment:

• Hardware: AP7 Pro, AP6 Pro

• Clients: MacBook Pro (M4), iPhone 17 Pro, older iPad

• Network Settings: AltaPass (using the first password for VLAN 10), IGMP Snooping enabled, mDNS enabled.

Description:

I am trying to use Apple’s feature that allows calling from my Macbook when both the Macbook and iPhone are connected to the same network. This used to work when I was running a pure AP6 Pro environment.

However, when my MacBook and iPhone both connect to the new 6GHz band using my primary AltaPass password, they are completely isolated from each other. They cannot ping each other, and the Apple Continuity call handoff breaks entirely.

The iPhone (on 6GHz) can communicate with the iPad (on 5GHz) perfectly. The isolation only happens when two devices are on the exact same 6GHz radio.

Steps to Reproduce:

1. Set up an AP7 Pro with AltaPass, routing the first password to VLAN 10. Enable mDNS and IGMP Snooping.

2. Connect an iPhone and a Mac to the 6GHz band using that primary AltaPass password.

3. Try to use Apple Continuity to make a cellular call from the Mac, or simply open Terminal on the Mac and try to ping the iPhone’s local IP address.

4. Result: Pings time out. Apple Continuity fails.

5. Control Test: Ping a device on the 5GHz band from the Mac on the 6GHz band. Result: Success.

Additional information:

Because the 6GHz band strictly requires WPA3 security, I know AltaPass forces these 6GHz devices to use the first password on the list. While the devices authenticate and connect to the internet perfectly, the access point’s internal routing seems to drop local traffic (like Apple’s mDNS discovery packets and direct ICMP pings) when trying to pass it between two clients connected to the exact same 6GHz radio.

I rantcpdump in two terminal windows:

• sudo tcpdump -i en0 host 192.168.10.21 on terminal 1

  • Mac broadcasting: 23:41:14.246026 ARP, Request who-has iphone tell mac, length 28

• ping -c 5 192.168.10.21 on terminal 2

  • Ping Result: Request timeout for icmp_seq 0 (100% packet loss)

[Alta-Jeff]

I’m not able to reproduce anything similar here, with two clients that are connected to the same 6 GHz radio on an AP. Are you sure you don’t have any non-Standard Network Types configured for the passwords you are using, in your SSID configuration? Are you sure your devices don’t have some firewall blocking the ICMP traffic?

[MapleBaconPoutine]

Thanks for the reply, Jeff! Appreciate it.

To answer your configuration questions:

1. Network Types: The primary password assigned to VLAN 10 is explicitly set to the Standard network type.
2. Firewalls: There are no firewall rules configured to block ICMP or intra-VLAN traffic on VLAN 10. Aside from the default Route10 firewall rules, I’ve added two rules that only affect VLAN 50. Attached a screenshot. There are more rules, but this just shows the first top 3 rules, with the top 2 being custom, the rest are default.

When I run from my mac (192.168.10.19 - 6ghz):

user@Mac ~ % arp -n 192.168.10.21 (iPhone - 6ghz)

192.168.10.21 (192.168.10.21) -- no entry

user@Mac ~ % arp -n 192.168.10.22 (iPad - 5ghz)

? (192.168.10.22) at [MAC_ADDRESS] on en0 ifscope [ethernet]

[Alta-Jeff]

We have reproduced something that looks very similar to what you are seeing, and are looking into it. Thank you for the report.

[MapleBaconPoutine]

Appreciate it! I know it’s still investigating, but a big shout out to you and the Alta team. Always appreciate the forum interaction!

If you need anything from my environment that might help debug, please let me know and I’m glad to share anything.