[FAQ] Web Proxy Auto Discovery (WPAD)

[SteffenBaierUK]

Web Proxy Auto Discovery (WPAD)

• The Web Proxy Auto-Discovery Protocol (WPAD) feature enables Polycom phones to locate the URL of a Proxy Auto-Configuration (PAC) file you configure. 
  
  You can configure WPAD using configuration parameters on your provisioning server, DHCP, or DNS-A protocol mechanism to discover the PAC file location. 
  
  Values you configure using parameters take precedence over DHCP and DNS-A. 
  
  Polycom phones support Basic, Digest, and NTLM Authentication mechanisms to authenticate with a proxy server. Microsoft recommends using Blue Coat proxy with this feature.

Note: If the proxies you configure in the PAC file or configuration file are either invalid or unreachable with a working fallback proxy, the time to register with Skype for Business is delayed and the responsiveness of features that support WPAD degrade.

• The VVX UC Software 5.7.0 added this feature.
• The Trio UC Software 5.7.1 added this to the Trio range.

Some screens to troubleshoot WPAD via the Web Interface  Diagnostics > Skype for Business Status > WPAD or Diagnostics > Web Proxy Auto Discovery (WPAD) Status

UC Software 7.3.2 & PVOS 8.0.0 and later:

Web Proxy Username & Password

• No longer required

Deprecating parameter: 

feature.wpad.basicAuth.enabled

• Basic web proxy authentication using a username and password is now always available and does not need to be enabled

Proxy Logging and Diagnostics

• Now accessible as part of the exported System Logs package and from the WPAD diagnostics page on the Web UI

Or

UC Software 7.3.1 or older:

WPAD Enabled

Proxy connect failed with an incorrect password

WPAD DNS Settings

Later Software Versions for CCX or Trio

Access the Proxy via “Settings” -> “Network” -> “Web Proxy”

Manual Proxy Configuration:

Parameter	Permitted Values	Change Causes Restart or Reboot	Example Values
feature.wpad.enabled	1 – Enable WPAD (Default Skype for Business)	YES	1
	0 – Disable WPAD (Teams mode only)	YES
feature.wpad.curl	Enter the Proxy Auto-Configuration (PAC) file location.	YES	https://server/wpad.pac
feature.wpad.proxy	Configure the web proxy server address. If you configure this parameter with a proxy address, the VVX phones do not discover or fetch the PAC file even if you configure a PAC file location using feature.wpad.curl.	YES	PROXY 10.1.1.2:8080
feature.wpad.proxy.username	Enter the user name to authenticate with the proxy server.	YES	proxyuser
feature.wpad.proxy.password	Enter the password to authenticate with the proxy server. The credentials you can use depend on how authentication is enabled on the proxy server. You can use administrator or user credentials. If Skype for Business Active Directory in integrated with the proxy server, you do not need to configure user name or password credentials.	YES	proxypass1234

Example configuration to specify a Proxy:

<proxy feature.wpad.proxy="PROXY proxy.domain.com:8080" />

You can specify multiple proxies using this parameter by separated each with a semicolon the same
way you specify them in the PAC file. For example:

PROXY 0.10.1.1:8080;
PROXY 10.12.2.1:8080

Example to point manually to a PAC file:

feature.wpad.curl="https://server.domain.com/wpad.dat"

WPAD PAC File Location

It is important to set the Mime Type to application/x-ns-proxy-autoconfig

Working log from correctly set Mime type:

0820141836|curl |3|00|Connected to iistestserver.sbaierhome.lab (10.252.149.123) port 80 (#0)
0820141836|curl |1|00|HEADER_OUT: GET /wpad.pac HTTP/1.1
0820141836|curl |1|00|HEADER_IN : HTTP/1.1 200 OK
0820141836|curl |1|00|HEADER_IN : Content-Type: application/x-ns-proxy-autoconfig
0820141836|curl |1|00|HEADER_IN : Last-Modified: Mon, 20 Aug 2018 13:12:08 GMT
0820141836|curl |1|00|HEADER_IN : Accept-Ranges: bytes
0820141836|curl |1|00|HEADER_IN : ETag: "74708668738d41:0"
0820141836|curl |1|00|HEADER_IN : Server: Microsoft-IIS/8.5
0820141836|curl |1|00|HEADER_IN : Date: Mon, 20 Aug 2018 13:18:36 GMT
0820141836|curl |1|00|HEADER_IN : Content-Length: 3043

Wireshark:

Logs when Mime type is not set:

0820134231|curl |1|00|HEADER_OUT: GET /proxy%2Fwpad.dat HTTP/1.1
0820134231|curl |1|00|HEADER_IN : HTTP/1.1 404 Not Found
0820134231|curl |1|00|HEADER_IN : Date: Mon, 20 Aug 2018 12:42:32 GMT
0820134231|curl |1|00|HEADER_IN : Server: Apache/2.4.18 (Ubuntu)
0820134231|curl |1|00|HEADER_IN : Content-Length: 292
0820134231|curl |1|00|HEADER_IN : Content-Type: text/html; charset=iso-8859-1
0820134231|curl |1|00|HEADER_IN : 
0820134231|curl |0|00|DATA_IN   : Data of len 292 not displayed
0820134231|curl |3|00|Connection #0 to host 10.252.122.122 left intact
0820134231|curl |3|00|Closing connection #0
0820134231|nisvc|4|00|m_RetVal[0] eReqRspID[1] csStrippedResponse[HTTP/1.1 404 Not Found
Date: Mon, 20 Aug 2018 12:42:32 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 292
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /proxy/wpad.dat was not found on this server.</p>
<hr>
<address>Apache/2.4.18 (Ubuntu) Server at 10.252.122.122 Port 80</address>
</body></html>

Log Level needed for debugging:

<web log.render.level="0"
 log.render.file.size.VVX101="1000"
 log.render.file.size.VVX150="1000"
 log.render.file.size.VVX201="1000"
 log.render.file.size.VVX250="1000"
 log.render.file.size.VVX300="1000"
 log.render.file.size.VVX301="1000"
 log.render.file.size.VVX310="1000"
 log.render.file.size.VVX311="1000"
 log.render.file.size.VVX350="1000"
 log.render.file.size.VVX400="1000"
 log.render.file.size.VVX401="1000"
 log.render.file.size.VVX410="1000"
 log.render.file.size.VVX411="1000"
 log.render.file.size.VVX450="1000"
 log.render.file.size.VVX500="1000"
 log.render.file.size.VVX501="1000"
 log.render.file.size.VVX600="1000"
 log.render.file.size.VVX601="1000"
 log.render.file.size.VVX1500="1000"
 log.render.file.size.Trio8300="1000"
 log.render.file.size.Trio8800="10240"
 log.render.file.size.Trio8500="10240"
 log.render.file.size.TrioC60="10240"
 log.render.file.size.CCX400="10240"
 log.render.file.size.CCX505="10240"
 log.render.file.size.CCX500="10240"
 log.render.file.size.CCX600="10240"
 log.render.file.size.CCX700="10240"
 log.render.file.size.EdgeE100="10240"
 log.render.file.size.EdgeE220="10240"
 log.render.file.size.EdgeE300="10240"
 log.render.file.size.EdgeE320="10240"
 log.render.file.size.EdgeE350="10240"
 log.render.file.size.EdgeE400="10240"
 log.render.file.size.EdgeE450="10240"
 log.render.file.size.EdgeE500="10240"
 log.render.file.size.EdgeE550="10240"
 log.level.change.nisvc="0"
 log.level.change.curl="1"
 log.level.change.dhcpc="0"
 log.level.change.app1="2"
 log.level.change.proxy="2"
 log.level.change.pps="1"
 log.level.change.so="2"
 log.level.change.pcc="1"
 log.level.change.dns="1" />

DHCP Option 55 with suboption 252 enabled:

Create a new Scope Option 252 with a String Value containing the proposed URL

During signing into Skype for Business the Polycom Phone will send a DHCP INFORM requesting suboption 252 via option 55:

And a correctly setup DHCP Server will respond with a DHCP ACK containing the URL

Phone downloading dat file

...
004708.766|nisvc|2|00|DHCP 252 Opt Value: http://10.252.149.123/test1.dat 
...
****************************HTTP SEND**************************

004708.778|nisvc|2|00|HTTP SEND:: DestUrl(http://10.252.149.123/test1.dat), HttpResCode(200), curlRetCode(0) retVal(0)
004708.778|nisvc|2|00|ErrorBuffer::
004708.778|nisvc|2|00|

****************************HTTP SEND**************************

 Example PAC File:

function FindProxyForURL(url, host)
{
	if( url.substring(0, 5) == "http:" )
	{
		return "PROXY 10.20.30.40:8080; PROXY 11.22.33.44:8080; DIRECT";
	}
	else if( url.substring(0, 6) == "https:" )
	{
		return "PROXY 10.20.30.40:8080; PROXY 11.22.33.44:8080; DIRECT";
	}
	else if( url.substring(0, 4) == "ftp:" )
	{
		return "PROXY 11.22.33.44:8080; DIRECT";
	}
	else
	{
		return "DIRECT";
	}
}

A good site for PAC examples can be found => here <=

[SteffenBaierUK]

Improved CCX/C60 WEB PROXY feature summary from UC Software 7.2.0

• Can be configured via a configuration file (Enabled by default since UC Software 7.3.x for Microsoft Teams Profile) or phone UI
  

  <web feature.wpad.enabled="1"/>​

  Web Interface via Settings > Network > Web Proxy
  
  

  
• Proxies all HTTP/HTTPS traffic, It does not proxy any media

Wireshark Troubleshooting

Example Filter:

http.request.method == "CONNECT"

The Source is the Phone and the Destination for the traffic is the Proxy

Overview

Web Proxy  Features	Teams Base Profile	Skype Base Profile	Generic Base Profile
Proxy All HTTP(s) Traffic including provisioning	Supported in 6.2.21 & Above	Support like VVX	Supported in 6.2.21 & Above
PAC file Auto Discovery via DHCP/DNS	Supported in 6.2.21 & Above	Support like VVX	Supported in 6.2.21 & Above
PAC File Processing	Supported in 6.2.21 & Above	Support like VVX	Supported in 6.2.21 & Above
Static PAC File entry via configuration or Web admin interface	Supported in 6.2.21 & Above	Support like VVX	Supported in 6.2.21 & Above
Web Proxy Diagnostics	Supported in 6.2.21 & Above	-	Supported in 6.2.21 & Above
UCS Proxy module logging for troubleshooting.	Android Logging / UCS debug log NISVC, App1 debug	Support like VVX	Android Logging / UCS debug log NISVC, App1 debug
Support for basic auth	Supported in 7.2.0 & above for CCX and C60 Only	Keep existing implementation. Integrated Auth	Supported in 7.2.0 & above for CCX and C60 Only
Configuration of Proxy feature in config files, Web admin interface.	Supported in 6.2.21 & Above	Configuration files only	Supported in 6.2.21 & Above
Configuration of Proxy Feature in Teams settings Poly app partner settings	Supported in 6.2.21 & Above	Not applicable	Supported in 6.2.21 & Above
Out of Box Configuration	Disabled	Enabled	Disabled