Without DAP, you'd need to manually examine network flows and maintain allow rules for *each* of your devices. While it may work initially, it's not practical to keep up to date.

DAP does the hard work for you. Just go to Protect > Device Active Protect and turn it on.

**Commonly asked questions:**

Can DAP isolate my device on the local network?

* Yes, with [Firewalla AP7](https://firewalla.com/collections/firewalla-ap7) and [App 1.68](https://help.firewalla.com/hc/en-us/articles/48561472689811-Firewalla-App-Release-1-68-Smarter-Device-Protect-New-App-Design-Time-Limit-App-Groups-and-more) or later, DAP can automatically enable Device Isolation if it determines that it does not need local communication.

Why are my devices ineligible for DAP?

* Only certain "simple" IoT devices are eligible for DAP. Devices with more complex online activities are NOT eligible, such as smartphones, computers, tablets, etc.
* Even IoT devices that appear simple may not be eligible because of their complex behaviors.
* Over time, DAP may eventually move ineligible devices back into the Learning phase.

For more details on how DAP works: [https://help.firewalla.com/hc/en-us/articles/44061066094867-Device-Active-Protect-Dynamic-Microsegmentation-Block-everything-and-allow-only-what-s-needed](https://help.firewalla.com/hc/en-us/articles/44061066094867-Device-Active-Protect-Dynamic-Microsegmentation-Block-everything-and-allow-only-what-s-needed)

Device Active Protect (DAP) dynamically allows and blocks sites based on device behavior and history -- very minimal human intervention needed.