topic Re: Guest Network Setup in General Topics

Guest Network Setup

victorallen — Sun, 21 Jul 2013 19:37:53 GMT

Hi - What is the best method to setup a guest L3 network in PanOS?

UntrustA = Corporate

UntrustB= Guest Internet

wDMZ = Wireless DMZ for Guest Internet

trust = Corporate

Requirements =

1. wDMZ needs to get to a few specific IP's on UntrustA.

2. wDMZ needs to get to the Internet via UntrustB.

Initially I was thinking of a second vRouter? OR is policy based forwarding the way to go?

Thank you!

dpalani — Sun, 21 Jul 2013 21:13:22 GMT

Hi,

If the UntrustB is used to route the Guest traffic to internet then you can use a secondary VR that has wDMZ and UntrustB.

You would need two routes in this VR

> A default route to internet via untrustB for guest users to get to internet

> A static route to get the corporate trust where the next hop would be type VR and value will be the primary VR.

The access from wDMZ to trust can be controlled using security polices than using routes.

Hope that helps.

victorallen — Sun, 21 Jul 2013 21:36:19 GMT

That is what I had, but Internet was not routing out UntrustB. DNS was routing fine to trust with policies.

I am not sure if some of my issue is with UntrustB using DHCP for it's IP address.

I had..

Zone wGuest

> UntrustB

> wDMZ

Static Route 0.0.0.0/0 UntrustB

Static Route (trust) x.x.x.x/24 Next - VR (trust)

I also had policy..

wDMZ to UntrustB allow everything.

Thanks for the reply!

dpalani — Wed, 24 Jul 2013 13:21:15 GMT

Do you have a NAT policy configured ?

Gregoux — Wed, 24 Jul 2013 16:32:29 GMT

I agree with nat to confirme it

activate log at start sesion on your policy rule which have allow your traffic and

go to traffic log in monitor tab and check if you see incomplete application.

if yes that mean you send something but with no retourn back to you.

resolv that by source nat policy which change the client ip to the ip of your untrust interface (the ip gave by dhcp)

regards

victorallen — Thu, 25 Jul 2013 02:12:08 GMT

I had a user error in the NAT Thanks for your thoughts! Plus I ended up setting up a PBF rules as well.