trafic redirection

[atelcom]

Hi,

I have a PA200 and i want to pass all users by this firewall, include whos connect with wireless

how can i configure PA to inspect wireless users

thanks in advance

Sarah

[rmonvon]

Please provide a network diagram if you can so we can review it.  Wireless users will come back to a wireless controller, and you would configure the controller to use the PA as its default gateway.  Or configure the PA200 in virtual-wire mode, and place the PA in the path between the controller and the Internet.

[panos]

it depends on how wireless users traffic passes through....

if only missing part is user id solution will be different...

[pulukas]

To pass the wireless users through the firewall, you will need to configure one of the interfaces to receive your wirelss lan connection and become the default gateway for that network.

Place this interface into its own zone so you can apply separate policies to the wireless users as compared to your normal business lan.

You will then need a nat policy for the wireless zone to the internet for their access out.

[mario11584]

I'd create a v-wire interface on the Palo Alto (if you have two interfaces available) and connect the Wireless controller to one of the v-wire ports. Connect the second v-wire interface to your router. Traffic will come in from your controller through the v-wire interfaces to your router. All this traffic will be seen by the firewall.

If you don't have enough interfaces for v-wire then your default gateways will all need to be configured to live on the firewall. You can do this by creating VLANs on your network and VLAN tagging interfaces on the firewall. You'll need to configure routing on the firewall. I'd suggest, like Steven said, to create separate zones for better management.

My preference, however, would be to use v-wire. I think routing should be done on routers and traffic inspection on firewalls. That's just me though.