Thanks Sven Hruza, not quite what I am looking for but still possibly useful, thanks for the suggestion. ... View more

Ok thats good we have made some progress. When testing I suggest go into ipad wifi settings and turn the auto connect off for each SSID except for your guest one. Makes testing easier. I noticed on your second screenshot of the SSID security layer 3 tab that you don;t have the overide global config box selected. Have look at the screenshot from my post about of my setup and you will see you need to select this and enter URL for the webauth to redirect too. You also need to create a pre-atuh ACL for the webpolicy. This can be done under Security -> ACL's -> ACL's. ... View more

Hi Rod You WLC interface and PA interface config look correct. I assume you have policies rules on the PA to permit traffic from your guest zone to the destination. You will also require a policy on the PA to permit traffic from the guest zone to the guest zone as the default route for the subnet is on the PA and any traffic to the IP is filtered by the policies. I have my WLC doing DHCP for my guest subnet as your guest SSID/vlan is probably central switched on the WLC its the easiest way to do this. The PA has no DHCP helper function as far as I am aware and I've never tried passing DHCP requests through a PA via a centrally switched SSID. I assume 10.118.6.112 is the management IP of your controller? if its not try changing the IP to your controller management IP if your not getting DHCP I'm not sure how your guest system works but I have an SSID which has a web-auth policy fowarding the guest auth to an authentication server with a webconsole which the passes a radius auth session back to the WLC. Do you have any other SSID's configured to use that physical port on the WLC? Even if there HREAP and not using the interface. Do you also have the web policy configured correctly on the SSID? I assume you want the browser to redirect to the guest web login page when they connect to the SSID. Are you using an external server for this or the WLC? ... View more

Rod you do need to setup layer 3 in order for a WLC and a Palo Alto Firewall  to work. I have an SSID setup on my WLC 5508 which is output from a port on WLC and patched directly into a port on a Palo Alto 5050. I have the interface on the WLC setup with a vlan identifier number and the WLC internal DHCP server for the subnet. That interface on the WLC is patched directly to port 9 on the PA. Setup you PA port as layer 3 and nothing else. Then create a subnet interface 1.9/## (## is your vlan number). Set the tag to you vlan number, apply your security zone to the sub-interface and set a static ip on the sub-interface. The IP I used was the default gateway of my wireless subnet. If you need more info, reply and I'll post some screenshots. ... View more

Hi Arslan WAAS requires a Central Manager however once they are setup it doesn;t technically require one in order to continue to to optimise traffic. If your WAAS environment is setup correctly and is intercepting the traffic http and CIFS should automatically been compressed with LZ compression. WAAS can accelerate Exchange however it depends on how your Exchange environment is setup and whether it is encrypted? If its encrypted via SSL you will need a WAAS Central manager to accelerate it. To check if you WAE's are running correctly type in "show cms info" on the WAAS and you will probably see your WAE is status is not online: WAE2#sh cms info Device registration information : Device Id                            = 3107921                             Device registered as                 = WAAS Application Engine             Current WAAS Central Manager         = ##.##.##.##                        Registered with WAAS Central Manager = ##.##.##.##  Status                               = Online                              Time of last config-sync             = Mon Sep 24 13:18:51 2012            CMS services information : Service cms_ce is running You can check the accelerator status with the below command: WAE2#sh accelerator Accelerator     Licensed        Config State    Operational State             -----------     --------        ------------    -----------------             cifs            Yes             Enabled         Running    epm             Yes             Enabled         Running    http            Yes             Enabled         Running    mapi            Yes             Enabled         Running    nfs             Yes             Enabled         Running    ssl             Yes             Enabled         Running    video           No              Disabled        Shutdown   ... View more