topic Re: trafic redirection in General Topics

trafic redirection

atelcom — Tue, 28 Jan 2014 15:08:10 GMT

Hi,

I have a PA200 and i want to pass all users by this firewall, include whos connect with wireless

how can i configure PA to inspect wireless users

thanks in advance

Sarah

Re: trafic redirection

rmonvon — Tue, 28 Jan 2014 15:38:30 GMT

Please provide a network diagram if you can so we can review it. Wireless users will come back to a wireless controller, and you would configure the controller to use the PA as its default gateway. Or configure the PA200 in virtual-wire mode, and place the PA in the path between the controller and the Internet.

Re: trafic redirection

Retired Member — Tue, 28 Jan 2014 20:17:24 GMT

it depends on how wireless users traffic passes through....

if only missing part is user id solution will be different...

Re: trafic redirection

pulukas — Tue, 28 Jan 2014 23:21:28 GMT

To pass the wireless users through the firewall, you will need to configure one of the interfaces to receive your wirelss lan connection and become the default gateway for that network.

Place this interface into its own zone so you can apply separate policies to the wireless users as compared to your normal business lan.

You will then need a nat policy for the wireless zone to the internet for their access out.

Re: trafic redirection

mario11584 — Wed, 29 Jan 2014 17:45:19 GMT

I'd create a v-wire interface on the Palo Alto (if you have two interfaces available) and connect the Wireless controller to one of the v-wire ports. Connect the second v-wire interface to your router. Traffic will come in from your controller through the v-wire interfaces to your router. All this traffic will be seen by the firewall.

If you don't have enough interfaces for v-wire then your default gateways will all need to be configured to live on the firewall. You can do this by creating VLANs on your network and VLAN tagging interfaces on the firewall. You'll need to configure routing on the firewall. I'd suggest, like Steven said, to create separate zones for better management.

My preference, however, would be to use v-wire. I think routing should be done on routers and traffic inspection on firewalls. That's just me though.