How to inspect wireless LAN traffic pass through Cisco WLC

[mindterra]

Hi, my customer would like to insert PAN device between LAP and WLC to inspect Client A and B traffic. Can we do that ?

[mbutt]

Hi,

If you would just like to inspect the traffic you can put palo alto firewall in virtual wire mode.

Here is a doc which provides details on the virtual wire.

https://live.paloaltonetworks.com/docs/DOC-1165

The doc mentioned above is for 3.0.x software but the working of the virtual wire should be same.

Hopefully this helps.

Thanks

Numan

[msullivan]

If the diagram is accurate, then no.  OTOH, if the clients are in different subnets and those subnets route through the PAN, then yes.  The vwire deployment won't work b/c of the capwap/lwapp tunneling, the PAN can't inspect that, so no policy can be enforced.

Mike