Ruckus & Guest WLAN...again

[djones]

I'm struggling to setup a guest SSID on our Ruckus ZoneDirector 1100 running v9.4.2.0.29. I have got as far as having an open guest SSID which when connected, prompts the user to accept the T&Cs without requiring authentication but never actually redirects to the internet. I have setup WPAD on our internal DHCP/DNS which points all external traffic via our LA provided proxy. This appears to work correctly in that clients connecting to the normal school SSID (security enabled) are correctly routed. I suspect the issue lies with the fact that our internal network and LA proxy are on different networks but I am stuck. Attached is a capture of the guest ACL rules setup on the ZoneDirector.

[neilmac]

Is there a rule on the gateway to allow traffic between the subnets ?

 

NM

[djones]

I suppose there must be because the normal security enabled WLAN (along with the LAN) traffic routes fine.

[djones]

Someone must have managed to get this sorted within a similar setup?! Where am I going wrong? Pretty please.

 

Dave

[neilmac]

Would you be able to do a wireshark capture on to see what's happening at the frame/packet level on the wired side ?

[localzuk]

Is the guest wireless on its own IP subnet? If so, what's doing the routing between it and the proxy subnet?

[djones]

Ok, installed Wireshark and have run a capture from the wired network. I may be interpreting it wrongly but the only IP addresses I see when loading a browser and accessing a known site like bbc.co.uk is the traffic between the IP of the wireshark machine and the proxy.

 

Is the guest wireless on its own IP subnet? If so, what's doing the routing between it and the proxy subnet?

 

No, when a client connects to the guest SSID, it gets given an IP on the same subnet which says to me (rightly or wrongly) that access to the local server for DHCP is working.

[DMcCoy]

So you have DNS/DHCP/wpad set up. Do you have ACLs to allow access to those from the guests? People often forget the webserver with the wpad file in the exceptions.

[djones]

Yes, I added that server's IP shortly after I first posted but it made no difference.

[DMcCoy]

Does the client get an IP? can it ping the gateway?

Same or different IP range for the guests?

[DaveCoop]

HI DJJones, forgive me if this has already been stated but is you public wi-fi on the same subnet as your main network? Our Public network comprises of a public server for DHCP WPAD, IPcop for transparent proxy (Stuck behind LEA connection) and a wireless controller Vlan'd to separate it all. I'm not sure how Rukus works or what it can /cant do but IPcop is good if your behind proxy's.

[DaveCoop]

and the bit i forgot to put is that you can get it to direct your traffic. we couldn't get our public to work before putting in IPcop

[djones]

Ok...I have this working for laptops but not the iPads. On the iPad after clicking accept on the T&Cs, it just hangs and never redirects.

[neilmac]

Have you heard of a program called Fiddler you can use to troubleshoot these kinds of issues (it's free).

 

Here's a blogpost from a chap called Jake Snyder where he explains its use, it may help guide you to the issue.

 

Transmit Failure: Using Fiddler2 to troubleshoot Captive Web Portals

 

NM

Edited October 12, 2013 by neilmac

[White_Fi]

Wow!!! Fiddler.... how did I not know about this!!!

 

Thanks Neil