topic Re: VLAN taggin Wireless traffic in General Topics

VLAN taggin Wireless traffic

pjohnson1 — Tue, 17 Nov 2015 02:45:42 GMT

I have a Wireless Access Point with multiple SSID's configured connected to a PA-200 on the interface ethernet2 (vlan).

The PA config is setup as per https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-Up-the-PA-200-for-Home-and-Small-Office/ta-p/61838

I would like to apply a security policy between each SSID. How would I approach this? Do I need to setup sub vlans or tag the vlans?

Thanks.

Re: VLAN taggin Wireless traffic

rmonvon — Tue, 17 Nov 2015 15:30:05 GMT

Hi there...Assuming each SSID has its own IP subnet, you can try to assign multiple IPs to the VLAN interface (192.168.1.254/24, 192.168.2.254/24, etc). Then write the security rules to inspect traffic within the same Trust-L3 zone:

Trust-L3 --> Trust-L3 src=192.168.1.254/24 dst=192.168.2.254/2 action=allow/deny

Alternatively, Eth2 can be configured as a layer3 interface with multiple IPs (192.168.1.254/24, 192.168.2.254/24, etc) and define policies as above. Thanks.

Re: VLAN taggin Wireless traffic

pjohnson1 — Tue, 17 Nov 2015 22:58:12 GMT

Thanks for the response. Much appreciated.

So just to confirm, there is no need to setup vlan sub interfaces?

I will give what you suggested a go...

Regards