Set up a firewall between wireless controller and APs

[wfqk]

Hi, I would like to setup a Palo Alto firewall between cisco WLC and APs to control some traffic. Anyone can share some idea for this? or send link in order to know what I need to pay attention to? Thank you very much.

[Francesco Molino]

Hi

Here 1 link out of plenty on Cisco websites to show what ports are used and so that will need to be open between APs and WLC:

https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113344-cuwn-ppm.html

[Rich R]

At the minimum APs need UDP 5246-5247 (CAPWAP control and CAPWAP data) to the WLC.

UDP 5248 for multicast depending on your design and configuration.

That's assuming the AP DHCP etc is provided local to the AP and will not need to pass through the firewall.

[wfqk]

Thank you very much for your reply. The below is a diagram. Can I do this way?

WLC ------------FW(Palo Alto) -------switch------AP  ............ PC/user
                                                                      |
                                                                 DHCP

[Rich R]

Yes

[wfqk]

If we setup vlan10 as management interface and vlan20 for client traffic going through firewall like the below. and DHCP is connected to vlan20 at firewall outside. The reason is we can make it easier to setup relation between WLC and AP. How do you think about it? 

WLC(vlan10) --------------------(vlan10)AP . . . . . . . PC
   |                                                                 |
vlan20-------------FW----------------vlan20

                                                                      |

                                                                   DHCP

[Scott Fella]

I think you need to test your theory out to be honest. You had two different designs and your last one seems like you will put a PA between vlan 20. What are you trying to achieve here and during your testing, you need to make sure that there is no stability issue and or client experience issues. Just seems like you will introduce more headaches down the road and for folks whom have to troubleshoot.

[Rich R]

I'll go one step further than @Scott Fella and say no you can't do what you show in your second design.

You seem to not understand what the options are with local and central switching of the client traffic with a WLC.

If the client traffic is centrally switched then your AP has no connection to vlan 20.  The client traffic is tunnelled to the WLC over CAPWAP and exits the WLC on vlan 20.  Yes you could then switch that back to the client side via firewall if you wanted to but that would be independent of the AP.  There wouldn't be much point in having a firewall at all in this case.

If you use flexconnect with local switching then the traffic is switched directly onto vlan 20 by the AP so why would you want to send it to the WLC, and over a firewall, and then obviously the WLC doesn't need any connection to vlan 20.  Although maybe you'd want a firewall between your client vlan 20 and the internet but then vlan 20 will go to your internet router not the WLC.

So you need to decide on the most appropriate design, understanding the difference between AP in local mode or flexconnect mode and the difference between central switching and local switching.  Then you can decide if you want to put a firewall in the path.  Go read the basics of how WLC and CAPWAP APs work.  Then when you've understood that, work out which design works best for your circumstances and then decide whether a firewall is appropriate and where it should be situated.  Don't put a firewall in just for the sake of it when it doesn't add any value and could reduce the reliability of your solution (like Scott said headaches down the road).