Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Why would what worked in Sophos would not work with PA

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Why would what worked in Sophos would not work with PA

L1 Bithead

Hello everyone,

 

Trying to make my ubiquity unifi access points with multiple ssid tagged with their  own vlan IDs work with PA. it worked seamlessly with Sophos but can't make it work with PA. 

 

I have one Ethernet port L3 configured with subnet DHCP, DNS and assigned to office zone. Acces points are connected to it via smart switch which is in no vlan mode

I created a sub interface with its own subnet, DNS,DHCP tagged with vlan=3 with is security zone "iot" with nat and security policies to external interface.

On unifi side I created a network tagged 3 and created ssid with it

I believe unifi needs Ethernet and default network be untagged. And any additional networks tagged.

It is basically what I had with Sophos 

My wifi client can connect and obtain DHCP info and from firewall I can ping internet from subinterface but Wi-Fi can't complete connection successfully and no access shows up in iot zone

 

What am I missing?

 

Thanks 

Alex

 

 

2 REPLIES 2

L6 Presenter

Hi @A.Roytman 

Is it possible for you to share the network topology diagram which will help to understand it more?

Looking at current details, I can see you have created sub-interfaces with different VLAN tagging to segregate traffic. Still, not able to understand what exactly not working. Ideally with different VLAN tags in sub-interfaces and desired vlan flowed / allowed on the switch side works well with Palo Alto as well without any issue. Also you need to make sure there are required security policies configured to allow the traffic.

M

Check out my YouTube channel - https://www.youtube.com/@NetworkTalks

L1 Bithead

Hi @${userLoginName} Below is a diagram which is a slight evolution of what was described above. Where in my original diagram office L3 Eth1/4 interface had IP, Zone, DHCP, DNS, policies etc. and served office network plus had guest sub interface tagged as VLAN-3, this iteration below (in hope of solution) I removed everything from Eth1/4 leaving it L3 and created two sub interfaces 1/4.1 (tagged vlan-1) and 1/4.3 (tagged vlan-3)
and on changed my switch (SQ) from non-vlan mode (which would normally retain/pass through all vlan tags) to vlan mode with Palo Alto uplink configured as trunk port and all others as Access vlan-1
Result is exactly the same as when I had Office network directly on physical Eth1/4:
- I can connect to internet from office network
- I can obtain DHCP lease from guest subinterface (192.168.70.2) and ping it. Packets show up in traffic log as intrazone policy. I did it both via Unifi WiFi ssid tagged vlan-3 and from computer connected to switch with access port tagged vlan3. So it appears it is not unique to Unifi 

- from firewall I can ping 8.8.8.8 on guest subinterface 

- I can not ping anything on internet guest network and nothing shows up in traffic log

Network DiagramNetwork Diagram

  • 708 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!