Internet Access for Guest WLAN using WCS

[CFayNTAdmin83]

Hello Everyone. I am trying to deploy a guest wireless network. I created the "guest" SSID and it is set to open authentication with the web authentication option. Once a user associates to guest, they get a DHCP address from an ISA 2004 server that I created. The ISA server is currently running in Proxy server mode. I can get the web authentication to work if I do not have my virtual gateway interface bypass the proxy (1.1.1.1). After that I have to manually enter in the proxy info in my browser to get internet. I've setup WPAD on the ISA server to attempt to get these settings automatically. However I have tried to configure WPAD using DNS and also DHCP with the 252 option and I cannot get it to work. The only other option that I have is to put the ISA server in a edge firewall mode and have the 2nd NIC be my gateway address (pushed out via dhcp). I'd rather not do this because then I'd have to use policy based routing to get other "guest" vlans from remote sites back to the gateway. The other option I thought about would be to setup an anchor here and then have the other controllers send the users back to my controller. Has anyone had any luck with a proxy server and the web authentication feature of the WLC? I need an ISA server to run SurfControl. We don't want our guests viewing questionable content:P

[thomas.chen]

The WLC guest deployment guide is the best resource for this. This document has complete instructions on how to setup guest access using WLC. The document is available at http://www.cisco.com/en/US/products/ps6366/prod_technical_reference09186a0080706f5f.html

[Richard Atkin]

I've done similar with PIX and WebSense.

In this case, we set the PIX inside interface as the default gateway for the Guests, then you need to configure transparent URL re-direction - this is a feature that picks up HTTP (etc..) requests as they hit the PIX and re-directs them to WebSense.

Equally on WebSense, it needs configuring to accept these kinds of incomming connections.

All of this is transparent to the end user.

HTH,

RA