What we have is slightly different than scenario 3

[esplanade]

What we have is slightly different than scenario 3. It looks like this.


Client-->ap-->routerA----------T1---------->routerB------------------>Switch-------->A.FS.B------
| |
------------------------------->Internet Router C

In this scenerio, both the public and private interfaces of FS are attached to the same network segment.
What is happening is that the client requests an IP from FS and is assigned 10.20.2.xx. FS has an IP of
10.20.2.1 on interface A, the private side. When the client requests a web page, router B sends the request
packet directly to internet router C which cannot do anything with the packet as it is from a private address and
is non routable. I can tell router B to use FS as it's default gateway, but it receives an icmp redirect to router C
and the same problem ensues.

I could construct the network as in scenerio B, where FS sits between all traffic, however we have nearly a hundred
fixed IP customers also running across this T1 and this is a lot of IP's to place in the session exception table considering
that the session exception table does not seem to be aware of the concept of subnets for exceptions and I would have to
manually enter each ip and maintain that table going forward.

Has anyone dealt with this issue? What was your solution.?

[esplanade]

in the former diagram the || connects to the switch

[alan]

I am not too sure about what your exact problem. In general:

1) FirstSpot needs to sit between the client PC and the Internet. In particular, FirstSpot needs to be in the outgoing path so that it can intercept the traffic (i.e. captive portal).

2) Why you need to put the IP in the Exception Free Websites table? This feature is designed so that the client PC can view some special web sites without login (e.g. Hotel guest can view the hotel web sites)

3) Regarding ICMP redirect, can you use static route instead?
_________________
~ Patronsoft Limited ~

[esplanade]

We run a mixed network where we have hundreds of fixed customers who never authenticate through firstspot.
They are all on fixed real world IP addresses. We agree that firstspot has to be physically in the path, but we only want the
traffic from our hotspots to be actually affected by the firstspot. Hence the need to enter exceptions for all of the
downstream fixed users. How do we do this?
_________________
www.esplanade.us using Firstspot

[alan]

Okay, I understand. You don't need to use Exception Free Websites.

You can try network setup like:

http://patronsoft.com/firstspot/FirstSpot_Scenario3b.ppt

Note that you need to turn off NAT within FirstSpot.
_________________
~ Patronsoft Limited ~