Does anyone have Meru Wireless? Help!

[craigg]

Hello guys!

 

Hopefully someone with a Meru system can help out here.

 

I'm having a nightmare getting our student and guest ESS profiles working.

 

Ill give you the run down..

 

We currently have three security profiles each with its own ESS profile and VLAN.

 

college domain

college student

and college guest

 

College domain works fine. We have a radius server set up on the network and it authenticates users that are in the \AuthenticatedUsers windows group.

 

College student works fine up to a certain point.

 

I have configured the radius for web authentication and am using the captive portal. Clients can authenticate with no issues and connect to the wireless network vlan.

 

My issue is that I can't seem to get it to do the next hop (to the internet). If I manually enter the proxy server into IE, and set an exeption for the vlan Network address (10.0.92.*) http traffic is pushed through the proxy and the users can access the internet just fine.

 

The only problem is management want to to be a seamless experience for students. I.E. they dont want them having to enter the proxy address everytime they want to get on the internet?

 

How can I get arround this? I'm going a bit mad trying to work it out.

 

The unfortunate thing is our firewall is about 1000 years old and doesn't have capacity for a blue network card. So it kind of rules out that... Otherwise life would be simple.

 

We have a Barracuda 610 web filter and I "think" you can route traffic through it so that it is filtered and then routed to the correct gateway from there. I have also been told that it will filter the content as well.

 

Then on from there we will need to configure ACLs on the core switch to stop them finding their way arround the network.

 

Has anyone done this? Or something similar?

 

Hope you can help.

 

Craig

[ihaveaproblem]

At my old work place they had a similar setup and i believe it was the free smoothwall express we used to get around the problem of having to set the proxy.

Then we just had ACLS set like you mentioned

[CyberNerd]

if you are going down the route of student owned devices, you should probably upgrade the firewall. A Cisco ASA is excellent (£1500 ish), smoothwall will combine web proxy and firewalling may be an option, or a linux box and iptables if cash is short.

 

To automatically configure proxy settings on most browsers, set them to 'automatic configuration' - the default on IE, so no changes needed by students.

Then create a DNS entry for wpad and set it to an internal web server, that can be accessed from the student network without proxy settings.

Create a file called wpad.dat so that the proxy config URL is http://wpad/wpad.dat the format is javascript

 

lots more detail here:

Web Proxy Autodiscovery Protocol - Wikipedia, the free encyclopedia

Proxy auto-config - Wikipedia, the free encyclopedia

 

this also means staff/students don't need to change their proxy settings when at home. it also works with most operating systems and browsers (personally had issues with safari in osx, but fine with linux/windows)

[craigg]

Money is very tight unfortunatly.

 

We have looked into upgrading the firewall already but have had the powers from above deny our requests.

 

Really appreciate your replys though guys.

 

I'm guessing something like Endian would do the same as smoothwall?

 

Thanks

[craigg]

@ihaveaproblem

 

When you set up your smoothwall box did it go straight out to the internet or did you have to go through your existing firewall?