Recognize IP address

[paoloholzl]

We have a Palo Alto PA-410.
Under this is connected a switch, and under this switch a Access Point used for Wifi connection.
This access point is functioning but the IP address is not knowed (and is not normal 192.168.0 192.168.1 ...)
I know MAC address of this apparat,.
Is it possible discover the IP address from PA-410 interface?

[seb_rupik]

Hi there,

Take a look at the ARP table. From the CLI run the following command substituting the interface name which is connected to the switch:

show arp <Eth_int_to_switch>

...this will list the MAC and IP bindings.

cheers,

Seb.

[paoloholzl]

Ok I would like to try also command line instruction  as
show interface all
But I have a Web interface not command line.

To do this I have to logon via ssh?

[seb_rupik]

yes, you will need to access the FW via SSH to run these CLI commands.

cheers,

Seb.

[BPry]

@paoloholzl,

If you absolutely can't access this device via CLI for some unknown reason, you can also just use the API to return the same information. CLI access would be easier to setup, but if for some reason that isn't possible you can do the following call:

# API Browser #
https://<Firewall>/php/rest/browse.php/op::show::arp

# API Call
https://<Firewall>/api/?type=op&cmd=<show><arp><entry name='all'/></arp></show>

[paoloholzl]

Do it.
Than I have try all interfaces one by one.
But I have found correct mac address for all devices but not for the searched.
Than I have try also
show arp all
But also the searched MAC address is no present.

[seb_rupik]

Interesting. Does the access point MAC address appear under: show mac all   

It is plausible that the access point could be using an IP address which is not part of the subnet to which it is physically connected. Any IP traffic from the firewall which is not from an IP within the interface subnet is probably being dropped as spoof traffic

Maybe you could set up a packet capture on the firewall interface connected towards the switch. The AP should eventually try ARP'ing and you should see something in the PCAP. This will give you an indication of its currently configured IP address. 

cheers,

Seb.

[paoloholzl]

... traffic from the firewall which is not from an IP within the interface subnet is probably being dropped as spoof traffic ...

It could be, but I can't figure out why Connection via Wifi on this access point works

[seb_rupik]

Remember that the access-point acts as a bridge between the wired and wireless networks, it does not need an IP address for its primary function as it operates at layer 2. That is why your wireless clients can still get connectivity whilst your access-point interface is currently remaining hidden at Layer3. 

cheers,

Seb.