Wireless Access

Aruba VIA automatically uses the proxy settings from IE to connect to the controller. Isn't this a design mistake?

For example, our company network is 10.0.5.0. The proxy server in IE is set to 10.0.5.10 on all laptops.

If somebody works from home, they are not able to reach our company network without VIA. So they use VIA connect to our company network. But while connecting, VIA will try to use the proxy server in the company network. Which is not yet reachable. So it will fail, or at least hang for a while. Can we somehow tell the VIA client NOT to use a proxy?

Because proxy is only available while on company network. And while on company network, you don't need VIA. So why would VIA use proxy?

In the windows client, there is a settings tab where I believe you can blank out the proxy settings.  

Can you send me the output of.  Not sure if there is something ticked off in there disallowing this...

 show aaa authentication via connection-profile "default"

(Aruba650) #show aaa authentication via connection-profile "default"

VIA Connection Profile "default"
--------------------------------
Parameter Value
--------- -----
VIA Servers 0/87.X.X.X/10.X.X.X/vpn1
Client Auto-Login Enabled
VIA Authentication Profiles to provision 0/default
Allow client to auto-upgrade Disabled
VIA tunneled networks N/A
Enable split tunneling Disabled
VIA Client WLAN profiles N/A
Allow client side logging Enabled
VIA IKE V2 Policy 10007
VIA IKE Policy 20
Use Windows Credentials Enabled
Enable IKEv2 Disabled
Use Suite B Cryptography Disabled
IKEv2 Authentication method eap-mschapv2
VIA IPSec V2 Crypto Map default-dynamicmap/10000
VIA IPSec Crypto Map default-dynamicmap/10000
Allow user to save passwords Enabled
Enable Supplicant Disabled
Enable FIPS Module Disabled
Auto-launch Supplicant Disabled
Lockdown All Settings Disabled
Domain Suffix in VIA Authentication Disabled
Enable Controllers Load Balance Disabled
Enable Domain Pre-connect Disabled
VIA Banner Message Reappearance Timeout(minutes) 60
VIA Client Network Mask 255.255.255.255
Validate Server Certificate Disabled
VIA Client DNS Suffix List corp.X.X
VIA max session timeout 1440 min
VIA Logon Script N/A
VIA Logoff Script N/A
VIA Support E-Mail Address N/A
Maximum reconnection attempts 1
VIA external download URL N/A
Allow user to disconnect VIA Enabled
Content Security Gateway URL N/A
Comma seperated list of HTTP ports to be inspected (apart from default port 80) N/A
Enable Content Security Services Disabled
Keep VIA window minimized Disabled
Block traffic until VPN tunnel is up Disabled
Block traffic rules N/A

The only thing I can think of in there is the block traffic until VPN is established setting.  This is also found in the UI under Config --> Authentication --> L3 authentication.

I am unsure if this will work or not...perhaps a call into support if it does not.

Yeah - so please open a tac case and see what they say

This is solved by adding both the internal and external ip's/hostnames of the controller to the proxy exception list in Internet Explorer.