VLAN taggin Wireless traffic

[pjohnson1]

I have a Wireless Access Point with multiple SSID's configured connected to a PA-200 on the interface ethernet2 (vlan).

The PA config is setup as per https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-Up-the-PA-200-for-Home-and-Small...

I would like to apply a security policy between each SSID.  How would I approach this? Do I need to setup sub vlans or tag the vlans?

Thanks.

[rmonvon]

Hi there...Assuming each SSID has its own IP subnet, you can try to assign multiple IPs to the VLAN interface (192.168.1.254/24, 192.168.2.254/24, etc).  Then write the security rules to inspect traffic within the same Trust-L3 zone:

Trust-L3 --> Trust-L3 src=192.168.1.254/24 dst=192.168.2.254/2 action=allow/deny

Alternatively, Eth2 can be configured as a layer3 interface with multiple IPs (192.168.1.254/24, 192.168.2.254/24, etc) and define policies as above.  Thanks.

[pjohnson1]

Thanks for the response.  Much appreciated.

So just to confirm, there is no need to setup vlan sub interfaces?

I will give what you suggested a go...

Regards