> you could simply use the “protected port” feature. How so? He would have to configure all the other ports AND the uplink in that vlan as protected as well, breaking connectivity for all hosts. If only the AP port is configured as protected, the switch won't do anything different than without "switchport protected" config. Lukas