VLAN and the web proxy... How to route web traffic?

[cheredenine]

Hello!

 

We have a Ruckus wifi setup, a HP 5412zl core switch and a Protex webfilter running in a VM. I am setting up BYOD and have a new VLAN for BYOD traffic; this is now working in that wireless clients can connect, pick up an IP via DHCP and can resolve addresses via DNS. They can't connect to the internet, however. Our web filter, Protex, doesn't allow transparent proxying, so I can't list it as a default gateway or anything clever. How to arrange things so that wireless BYOD clients can get on the net?

 

Our core switch is on IP 10.103.163.1 for the default VLAN and on 172.16.0.1 for VLAN-10, the BYOD VLAN. This is the setup on the core switch:

 

; J8698A Configuration Editor; Created on release #K.15.06.0017
; Ver #02:10.0d:1f

hostname "HP-E5412zl" 
module 1 type J9534A 
module 2 type J9535A 
module 3 type J9534A 
module 4 type J9534A 
module 6 type J9637A 
interface F11 
  speed-duplex 100-full 
exit
ip default-gateway 10.103.162.1 
ip routing 
ip directed-broadcast 
ip udp-bcast-forward 
vlan 1 
  name "DEFAULT_VLAN" 
  untagged A1-A24,B1-B24,C1-C24,D1-D24,F1-F24 
  ip address 10.103.163.1 255.255.254.0 
  exit 
vlan 10 
  name "BYOD" 
  ip helper-address 10.103.162.6 
  ip address 172.16.0.1 255.255.255.0 
  tagged B20,C20,F4,F6,F9,F13-F22 
  exit 
console inactivity-timer 10
ip route 0.0.0.0 0.0.0.0 10.103.162.1
snmp-server community "public" unrestricted
spanning-tree
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager
password operator

 

Ip address 10.103.162.5 is the DHCP and DNS server. The web filter I want clients to go through is on IP address 10.103.163.24. Is it a case of adding another helper-address or do i need to do some routing?

[DavetheITguy]

Make sure you have inter-Vlan routing enabled on your Core-Switch / Core-Fibre .

 

- - - Updated - - -

 

Make sure you have inter-Vlan routing enabled on your Core-Switch / Core-Fibre .

[cheredenine]

Routing is enabled as far as I can see! But the browser just wont display a web page... Feel like I'm missing a link in the chain whereby the browser, which is configured with the web filter IP, needs a little help to connect to the web filter. From a device on the BYOD VLAN I can ping the default VLAN and do DNS look ups on Google, etc.

[localzuk]

The way I'd do it is by using a proxy pac, and then add DHCP option and a DNS record for wpad.

 

That way, clients will autodiscover the proxy pac file, and direct things to the proxy as normal.

 

That said, it still won't work properly for you for some apps on android and itunes, as they ignore those settings.

 

The only real way to do it would be to have a true transparent proxy.

 

EDIT: Oh, didn't realise you had entered an IP manually for proxying. From what I can see, your routing is set up right for inter-vlan routing.

Edited February 26, 2015 by localzuk

[ReBoot]

Really need a N/W diagram here. How is the proxy server connected into your network ? If your proxy server is connected to your main VLAN it may not be sufficient to have routing enabled on your switches.

 

Packet starting on BYOD VLAN addressed to proxy. Hits switch and is routed to main VLAN and to proxy server. However, if proxy has no routing info for how to reach BYOD subnet it may not be able to send traffic back. Have you tried ping/traceroute to see where packets are going missing ?

[cheredenine]

Didn't get chance to update this last week, but basically you're all correct. The core switch was correctly set up, but the web filter needed routing set up to direct traffic back to the BYOD VLAN. A support call and team viewer session later and it's working nicely. Thanks for the help and suggestions!

[roadhouse1387]

Glad you got it working, but do really want to route your BYOD traffic on the same router as your internal traffic ?

 

There is a security implication here.. a canny big one.

 

presumabley , the byod users are indeed bringin their own devices, are you vetting their kit ? or enforcing MDM management of some kind ? if not, they could be bringing all sorts of stuff into the organization. Because you have to route the BYOD clients through you internal VLAN to hit the proxy, they can get anywhere and everywhere. Do your servers sit on the 10.103.163.1/23 subnet as well ?

 

Can you at least configure a separate interface on your proxy for your BYOD users, and propagate vlan 10 at layer 2 only through your switch, then route vlan 10 directly from the proxy to negate the need for them to route through your corporate network ?

 

failing that, the least you should do is consider applying an ACL on vlan 10 to allow users access to the proxy only.

 

 

Cheers

Edited March 17, 2015 by elsiegee40

[localzuk]

Ruckus as device segregation and acls built in. If you've not got them enabled, I'd recommend it. That way, the device doesn't even get past the access point to access things it shouldn't.