topic Re: Recognize IP address in General Topics

Recognize IP address

paoloholzl — Mon, 31 Jul 2023 13:42:03 GMT

We have a Palo Alto PA-410.
Under this is connected a switch, and under this switch a Access Point used for Wifi connection.
This access point is functioning but the IP address is not knowed (and is not normal 192.168.0 192.168.1 ...)
I know MAC address of this apparat,.
Is it possible discover the IP address from PA-410 interface?

Re: Recognize IP address

seb_rupik — Mon, 31 Jul 2023 13:45:49 GMT

Hi there,

Take a look at the ARP table. From the CLI run the following command substituting the interface name which is connected to the switch:

show arp <Eth_int_to_switch>

...this will list the MAC and IP bindings.

cheers,

Seb.

Re: Recognize IP address

paoloholzl — Mon, 31 Jul 2023 13:51:03 GMT

Ok I would like to try also command line instruction as
show interface all
But I have a Web interface not command line.

To do this I have to logon via ssh?

Re: Recognize IP address

seb_rupik — Mon, 31 Jul 2023 13:59:22 GMT

yes, you will need to access the FW via SSH to run these CLI commands.

cheers,

Seb.

Re: Recognize IP address

BPry — Mon, 31 Jul 2023 15:16:55 GMT

@paoloholzl,

If you absolutely can't access this device via CLI for some unknown reason, you can also just use the API to return the same information. CLI access would be easier to setup, but if for some reason that isn't possible you can do the following call:

# API Browser # https://<Firewall>/php/rest/browse.php/op::show::arp # API Call https://<Firewall>/api/?type=op&cmd=<show><arp><entry name='all'/></arp></show>

Re: Recognize IP address

paoloholzl — Mon, 31 Jul 2023 15:47:30 GMT

Do it.
Than I have try all interfaces one by one.
But I have found correct mac address for all devices but not for the searched.
Than I have try also
show arp all
But also the searched MAC address is no present.

Re: Recognize IP address

seb_rupik — Tue, 01 Aug 2023 10:56:31 GMT

Interesting. Does the access point MAC address appear under: show mac all

It is plausible that the access point could be using an IP address which is not part of the subnet to which it is physically connected. Any IP traffic from the firewall which is not from an IP within the interface subnet is probably being dropped as spoof traffic

Maybe you could set up a packet capture on the firewall interface connected towards the switch. The AP should eventually try ARP'ing and you should see something in the PCAP. This will give you an indication of its currently configured IP address.

cheers,

Seb.

Re: Recognize IP address

paoloholzl — Tue, 01 Aug 2023 11:35:28 GMT

... traffic from the firewall which is not from an IP within the interface subnet is probably being dropped as spoof traffic ...

It could be, but I can't figure out why Connection via Wifi on this access point works

Re: Recognize IP address

seb_rupik — Tue, 01 Aug 2023 12:56:23 GMT

Remember that the access-point acts as a bridge between the wired and wireless networks, it does not need an IP address for its primary function as it operates at layer 2. That is why your wireless clients can still get connectivity whilst your access-point interface is currently remaining hidden at Layer3.

cheers,

Seb.