Why would what worked in Sophos would not work with PA

[A.Roytman]

Hello everyone,

Trying to make my ubiquity unifi access points with multiple ssid tagged with their  own vlan IDs work with PA. it worked seamlessly with Sophos but can't make it work with PA. 

I have one Ethernet port L3 configured with subnet DHCP, DNS and assigned to office zone. Acces points are connected to it via smart switch which is in no vlan mode

I created a sub interface with its own subnet, DNS,DHCP tagged with vlan=3 with is security zone "iot" with nat and security policies to external interface.

On unifi side I created a network tagged 3 and created ssid with it

I believe unifi needs Ethernet and default network be untagged. And any additional networks tagged.

It is basically what I had with Sophos 

My wifi client can connect and obtain DHCP info and from firewall I can ping internet from subinterface but Wi-Fi can't complete connection successfully and no access shows up in iot zone

What am I missing?

Thanks 

Alex

[SutareMayur]

Hi @A.Roytman 

Is it possible for you to share the network topology diagram which will help to understand it more?

Looking at current details, I can see you have created sub-interfaces with different VLAN tagging to segregate traffic. Still, not able to understand what exactly not working. Ideally with different VLAN tags in sub-interfaces and desired vlan flowed / allowed on the switch side works well with Palo Alto as well without any issue. Also you need to make sure there are required security policies configured to allow the traffic.

[A.Roytman]

Hi @SutareMayur Below is a diagram which is a slight evolution of what was described above. Where in my original diagram office L3 Eth1/4 interface had IP, Zone, DHCP, DNS, policies etc. and served office network plus had guest sub interface tagged as VLAN-3, this iteration below (in hope of solution) I removed everything from Eth1/4 leaving it L3 and created two sub interfaces 1/4.1 (tagged vlan-1) and 1/4.3 (tagged vlan-3)
and on changed my switch (SQ) from non-vlan mode (which would normally retain/pass through all vlan tags) to vlan mode with Palo Alto uplink configured as trunk port and all others as Access vlan-1
Result is exactly the same as when I had Office network directly on physical Eth1/4:
- I can connect to internet from office network
- I can obtain DHCP lease from guest subinterface (192.168.70.2) and ping it. Packets show up in traffic log as intrazone policy. I did it both via Unifi WiFi ssid tagged vlan-3 and from computer connected to switch with access port tagged vlan3. So it appears it is not unique to Unifi 

- from firewall I can ping 8.8.8.8 on guest subinterface 

- I can not ping anything on internet guest network and nothing shows up in traffic log

Network Diagram