Smoothwall, Ruckus and Radius

[synaesthesia]

Hiya, there's been plenty of mentions of this setup in the past here but all are geared towards BYOD rather than shared devices.

 

This is for a fairly poor IT skilled primary where students need a lot of hand holding, yet at the same time enough for the school to be concerned about the content they are viewing/trying to view on shared portable devices, in this case Hudls (and no doubt in the near future iPads). Goal is simple; users must log in when using a Hudl so they are appropriately filtered AND we can see who was using them. Currently they're filtered with a blanket pupil policy; if there's something to be concerned about, it's near impossible to track down who that person was.

 

There's nothing complicated about the setup or network; it's an entirely flat network, and using a test WLAN to avoid downtime. Single ruckus, smoothwall and domain controller.

 

Smoothwall is present as the filter and wireless is provided by Ruckus.

 

My setup is a sodomisation of some of the things suggested by both Ruckus and Smoothwall but simplified so there's not half a million hoops to jump through for users.

 

So:

 

Ruckus: pair of AAA servers set up, domain controller and Smoothwall as radius accounting. Domain controller tests run fine.

Open authentication directing users to a web auth login page (by Ruckus). This works OK and a user can log on using their domain credentials. Advanced settings for the test VLAN has auto proxy configuration pointing to the domain controller. (this works OK).

 

Smoothwall: Ruckus is set up as a radius client. Under system logs/authentication service I can see the clients connecting and authorising with the username. Authentication is therefore going through without a problem. I can also see in the authentication/user activity logs that a user has connected and what group they have been allocated to; in this case the "Pupil" group.

 

Internet access works fine, however there is absolutely no filtering taking place; all the usual naughty sites work fine, yet despite the above authentication taking place there's no mention of these transgressions in the logs.

 

I'm guessing from the flow of things the issue lies with Smoothwall and it would appear to be something simple.

[FN-GM]

Is Smoothwall handling your DHCP. I think this is required.

I think you also have to set something up in the authentication area on Smoothwall. I think you have to tell it the IP range used for BYOD. I am recalling this from memory so this might not be 100% accurate.

[synaesthesia]

Hmm, seen that a couple of times but thought that'd be a little dubious in any of the environments you'd expect to find a Smoothie installed in.

 

Still, something I can test even by setting up a new range in windows DHCP. Cheers, something to look at.

[5tu]

Have you mapped AD groups to Smoothwall groups in SERVICES > AUTHENTICATION > GROUPS and then linked Guardian Web Filter policies to these groups?

[synaesthesia]

I assumed that was all present and correct anyway as Smoothwall works with AD groups for usual authentication and domain computers?

[tom_newton]

Do you actually see traffic hitting the smoothwall - eg. if you visit 888.com do you see the smoothwall saying "888.com, allowed, 200" in the proxy log? Sounds like the radius auth is working (so you're seeing usernames) but the web traffic isnt actually being filtered. Set the Smoothie as the default gw for these clients, and put transparent proxy on if it's not already.

[free780]

How does smoothwall handle time outs and logging off from the 802.1x Wireless on shared devices that are really 1:1 devices?

[synaesthesia]

Do you actually see traffic hitting the smoothwall - eg. if you visit 888.com do you see the smoothwall saying "888.com, allowed, 200" in the proxy log? Sounds like the radius auth is working (so you're seeing usernames) but the web traffic isnt actually being filtered. Set the Smoothie as the default gw for these clients, and put transparent proxy on if it's not already.

 

Not sure on the actual traffic going through it. I need to go through the setup logs as I recall not being able to use the transparent proxy, there's 2 set up on 8080 and 3128.

Will take a look tomorrow afternoon Cheers

 

 

Edit: Looking at some of the guides I now recall being advised against using it in Transparent mode as it's running on a virtual guest. Is that still an issue?

Edited February 21, 2018 by synaesthesia