topic Re: Wireless Authorization Profile Forcing WEB Proxy IP in Network Access Control

Wireless Authorization Profile Forcing WEB Proxy IP

orkhan.rustamli.96 — Mon, 01 Jul 2019 08:33:57 GMT

Hi All,

I have just started deploying my wireless system with 1850 Mobility Express solutions. I have configured Radius authentication. The only problem is that I want to create WLAN with corresponding user subnet VLAN which can only connect internet through my WSA as proxy. So is there any Radius attribute where i can use it for forcing my WSA IP and Port to mobile phones so that they can connect internet. If no I will have to create separate Wireless Subnet which is not preferable solution for me.

Thanks in Advance!

Re: Wireless Authorization Profile Forcing WEB Proxy IP

hslai — Mon, 01 Jul 2019 20:46:47 GMT

I believe we do this by hosting the proxy PAC on a web server and using DNS or DHCP to discovery it, per WinHTTP AutoProxy Support.

I do not think any RADIUS attribute can help with that. At least I am not aware of.

Re: Wireless Authorization Profile Forcing WEB Proxy IP

orkhan.rustamli.96 — Tue, 02 Jul 2019 07:52:14 GMT

Thank you very much, for your response.

For corporation computers I am using DHCP 252 option with PAC file URL that is okay. But, what about mobile phones? I am no sure that phones will understand PAC file.

Re: Wireless Authorization Profile Forcing WEB Proxy IP

hslai — Tue, 02 Jul 2019 13:00:16 GMT

In order to support various clients in wild ranges, Transparent proxy is a better option. Below is what we used in our training lab using a Cisco 3650 with ip routing enabled:

conf t
!
! create redirect ACL for WCCP
ip access-list extended wccp-redirect
 deny   ip any 10.0.0.0 0.255.255.255
 permit tcp 10.0.0.0 0.255.255.255 any eq www
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
!
! enable wccp with service-id 90, matched WSA config
ip wccp 90 redirect-list wccp-redirect
!
! apply wccp to the client VLAN 50
interface Vlan50
 ip wccp 90 redirect in
!
end