Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Redirecting http traffic to a squid web cache

This thread has been viewed 0 times
  • 1.  Redirecting http traffic to a squid web cache

    Posted Sep 06, 2013 06:15 AM

    Hi,

    I'm just wondering if it is possible to create a policy that'll allow us to redirec traffic for specifc urls to a squid proxy. We have two SSIDS configured here

     

    1) Eduroam  - our production network for properly configured wireless clients, auth via 802.1x

     

    2) UoY Setup - local open private address space SSID using dnsredirection to point users at a client network configuration utility that sets up theclient with appropriate credentials to connect to SSID eduroam. Basically client associates with an open network, dns redirector hands out a real IP addresses for local sites we want them to access and resolves everything else to a fixed IP address, which is the address associated with the configuration package.

     

    Up till now this has worked just fine, except ...... in order for the package to configure an android device the client needs to download something from Google Play... which we can't do because its on a private network with no routable access to the outside world. 

     

    I can set up a squid web cache that'll give clients on UoY setup access to the outside worls  but I need to get traffic from a client to the squid cache in the first place and android doesn't support auto detect proxy settings. We're trying to make this as independent of user input as possible.

     

    Can I set up a user policy that says

     

    "For http(s) traffic to this "<regular expression URL" , redirect traffic to our squid cache"

    "for http(s) traffic to this <local url> pass traffic direct to the url

    "for everything else redirect to <a specific IP address>"

     

    Rgds

    Alex

     



  • 2.  RE: Redirecting http traffic to a squid web cache

    Posted Sep 06, 2013 06:57 AM

    You have a couple of options to try here.

     

    First, have you tried to Source NAT traffic to the Google Play sites using the src-nat action in the firewall?  Likewise, you can try and force http/https traffic to those sames sites to the squid server using the destination nat rules action; dst-nat.



  • 3.  RE: Redirecting http traffic to a squid web cache

    Posted Sep 06, 2013 07:28 AM

    more information:

     

    ip name-server 8.8.8.8

    ip domain-name company.com

    ip domain lookup

     

    netdestination google-play

    name android.clients.google.com

     

    user svc-http alias google-play src-nat

     

    or 

     

    user svc-http alias google-play dst-nat <squid ip> <dst port>