topic Re: How to setup pan to inspect/monitor wireless traffic in General Topics

How to setup pan to inspect/monitor wireless traffic

psimilien_1 — Tue, 08 Nov 2011 13:21:12 GMT

I am currently running a PA-500 in IPS mode and is setup as a VWire behind my ASA. I have an environment that consist of a Cisco wireless controller and APs. How do I monitor my wireless traffic or better yet how do i setup policies for this?

By the way I had a conversation with support this morning and it went no where.

Re: How to setup pan to inspect/monitor wireless traffic

psimilien_1 — Tue, 08 Nov 2011 22:43:34 GMT

My question has not been answered yet

Re: How to setup pan to inspect/monitor wireless traffic

jcostello — Tue, 08 Nov 2011 22:55:06 GMT

I think part of what you are asking is really a professional services design question as opposed to a configuration issue.

As far as monitoring your wireless traffic, unless the traffic crosses the wire and passes through either a switch or the PA-500 it won't see the traffic - so any wireless to wireless traffic will not be seen unless you are able to span that traffic out to the PA-500.

Hope that is of some help

James

Re: How to setup pan to inspect/monitor wireless traffic

bpappas — Tue, 08 Nov 2011 22:56:11 GMT

Your question is rather broad. Could you give us some more specifics about your implementation?

Are you going to allow all traffic bidirectionally? If not what applications will you allow and in which direction?

Do you need to identify users and map them to IP addresses?

I assume you will be implementing security profiles to block viruses, malware, spyware and attempts to exploit vulnerabilities. Please confirm if you plan to do this?

Do you plan to implement file blocking?

Will you implement data filtering?

Are you going to implement URL filtering? (requires a license)

thanks,

Benjamin

Re: How to setup pan to inspect/monitor wireless traffic

psimilien_1 — Tue, 08 Nov 2011 23:00:22 GMT

What I would like to do is create a vwire for the traffic from the controller to the core switch. My problem is that, in doing so traffic is block without any policie setting. How can I set this up?

Re: How to setup pan to inspect/monitor wireless traffic

psimilien_1 — Tue, 08 Nov 2011 23:02:32 GMT

The anwser to your questions are yes and yes. I would like to setup a vwire or layer 3 interface (if needed) to map ip to users..ect...

Re: How to setup pan to inspect/monitor wireless traffic

bpappas — Tue, 08 Nov 2011 23:06:53 GMT

Could you please post a screengrab of your security policies?

Once I see that I can give you some specific guidance on most of the questions that you have.

Thanks,

Benjamin

Re: How to setup pan to inspect/monitor wireless traffic

jcostello — Tue, 08 Nov 2011 23:10:55 GMT

P-

Here is a link to an older configuration document on how to set up a Virtual Wire evaluation

https://live.paloaltonetworks.com/docs/DOC-1165

The core concepts have not changed.

You will need a set of policies to pass traffic between the interfaces - the simplest are

1. Zone 1 to Zone 2 allow any address to any application and services

2. Zone 2 to Zone 1 allow any address to any application and services

You can add complexity with more rules as you go.

Hope that helps

James

Re: How to setup pan to inspect/monitor wireless traffic

psimilien_1 — Tue, 08 Nov 2011 23:11:15 GMT

Screenshot:

1. setup vwire on ethernet0/5 and ethernet0/6 with (both) trusted interface

2. no policies where applied to either interface

3. from the lan I could not browse to controller nor see broadcast SSIDs

Re: How to setup pan to inspect/monitor wireless traffic

jcostello — Tue, 08 Nov 2011 23:23:42 GMT

P -

You will still need to configure a trust to trust rule. Traffic passing between interfaces on a Palo Alto Firewall still needs to have zone relative rules to allow the traffic to pass.

Since you do not have a security policy from trust to trust, no traffic is passing.

James

Re: How to setup pan to inspect/monitor wireless traffic

psimilien_1 — Wed, 09 Nov 2011 15:57:10 GMT

Will let you know the outcome of this soon, thank you.