diff --git a/docs/resources/wlan.md b/docs/resources/wlan.md
index e1ea71d..f010527 100644
--- a/docs/resources/wlan.md
+++ b/docs/resources/wlan.md
@@ -59,6 +59,7 @@ resource "unifi_wlan" "wifi" {
 - **ap_group_ids** (Set of String) IDs of the AP groups to use for this network.
 - **hide_ssid** (Boolean) Indicates whether or not to hide the SSID from broadcast.
 - **is_guest** (Boolean) Indicates that this is a guest WLAN and should use guest behaviors.
+- **l2_isolation** (Boolean) Isolates stations on layer 2 (ethernet) level Defaults to `false`.
 - **mac_filter_enabled** (Boolean) Indicates whether or not the MAC filter is turned of for the network.
 - **mac_filter_list** (Set of String) List of MAC addresses to filter (only valid if `mac_filter_enabled` is `true`).
 - **mac_filter_policy** (String) MAC address filter policy (only valid if `mac_filter_enabled` is `true`). Defaults to `deny`.
diff --git a/internal/provider/resource_wlan.go b/internal/provider/resource_wlan.go
index 283aace..661f476 100644
--- a/internal/provider/resource_wlan.go
+++ b/internal/provider/resource_wlan.go
@@ -137,6 +137,12 @@ func resourceWLAN() *schema.Resource {
 				Optional:    true,
 				Default:     true,
 			},
+			"l2_isolation": {
+				Description: "Isolates stations on layer 2 (ethernet) level",
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+			},
 
 			// controller v6 fields
 			// TODO: this could be defaulted to "both" once v5 controller support is dropped
@@ -269,6 +275,7 @@ func resourceWLANGetResourceData(d *schema.ResourceData, meta interface{}) (*uni
 		GroupRekey:               3600,
 		DTIMMode:                 "default",
 		No2GhzOui:                d.Get("no2ghz_oui").(bool),
+		L2Isolation:              d.Get("l2_isolation").(bool),
 		MinrateNgCckRatesEnabled: true,
 	}, nil
 }
@@ -342,6 +349,7 @@ func resourceWLANSetResourceData(resp *unifi.WLAN, d *schema.ResourceData, meta
 	d.Set("schedule", schedule)
 	d.Set("wlan_band", resp.WLANBand)
 	d.Set("no2ghz_oui", resp.No2GhzOui)
+	d.Set("l2_isolation", resp.L2Isolation)
 
 	// switch v := c.ControllerVersion(); {
 	// case v.GreaterThanOrEqual(controllerV6):