proxy settings in c9800

[santhoshkdhanapal]

Hi All,

    Customer has c9800 controller integrated with cisco ISE. SAML portal configuration done in cisco ISE, user able to redirect to gmail page when they connect to SSID only incase of proxy turned off. When proxy is on unable to redirect the gmail page. Any option to enable on C9800 to redirect wlan client to gmail page if proxy is turned on. I appreciate in advance for your response.

Cheers,

Santhosh

[balaji.bandi]

what Proxy you have in your environment, what Logs you see on the proxy ?

[Rich R]

That's entirely dependent on the client proxy configuration and/or the proxy server configuration - there's nothing you can do on the 9800 to change that.

[MHM Cisco World]

HTTP Proxy Server and How it Works

You can use an HTTP proxy server. If you need the client to add an exception in its browser that 192.0.2.1 is not to go through the proxy server, you can make the WLC listen for HTTP traffic on the port of the proxy server (usually 8080).

In order to understand this scenario, you need to know what an HTTP proxy does. It is something you configure on the client side (IP address and port) in the browser.

The usual scenario when a user visits a website is to resolve the name to IP with DNS, and then it asks the web page to the web server. The process always sends the HTTP request for the page to the proxy.

The proxy processes the DNS, if required, and forwards to the web server (if the page is not already cached on the proxy). The discussion is client-to-proxy only. Whether or not the proxy obtains the real web page is irrelevant to the client.

Here is the web authentication process:

• User types in a URL.

• Client PC sends to the Proxy server.

• WLC intercepts and imitations Proxy server IP; it replies to the PC with a redirect to 192.0.2.1

At this stage, if the PC is not configured for it, it asks for the 192.0.2.1 WebAuth page to the proxy so it does not work. The PC must make an exception for 192.0.2.1; then it sends an HTTP request to 192.0.2.1 and proceeds with WebAuth.

When authenticated, all communications go through proxy again. An exception configuration is usually in the browser close to the configuration of the proxy server. You then see the message: "Do not use proxy for those IP addresses".

With WLC Release 7.0 and later, the feature webauth proxy redirect can be enabled in the global WLC configuration options.

When enabled, the WLC checks if the clients are configured to manually use a proxy. In that case, they redirect the client to a page that shows them how to modify their proxy settings to make everything work.

The WebAuth proxy redirect can be configured to work on a variety of ports and is compatible with Central Web Authentication.

For an example on WebAuth proxy redirection, refer to Web Authentication Proxy on a Wireless LAN Controller Configuration Example.

This what I read and I think the wlc must config with aware of proxy.

@Rich R check this info and your opinion is appropriate.

MHM

[Rich R]

Interesting @MHM Cisco World I wasn't aware of that feature!
I've never used so can't comment on how well it works.
Some more links on that feature:
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113151-web-auth-proxy-00.html
https://wirelessforccie.wordpress.com/2013/01/29/webauth-proxy-redirection-mode/
https://community.cisco.com/t5/wireless/web-auth-proxy-redirection/td-p/2655654

[Rich R · Accepted solution]

All the above documentation relates to AireOS - I can't find any documentation for a similar feature on 9800.
So unless anybody knows otherwise, it looks to me like the webauth proxy redirect feature is not supported on 9800.
So best to just tell the clients to ensure their proxy is correctly configured or use policy to push configuration if the client devices are managed.

[santhoshkdhanapal]

Hi @Rich R ,

  Also I did the search before posting the content,as per aireos controller ,the redirect option is available but not in c9800. But I want to know am i in right track before suggesting to customer. Thanks for your response.