Hello,
Web Proxy Auto Discovery (WPAD)
- The Web Proxy Auto-Discovery Protocol (WPAD) feature enables Polycom phones to locate the URL of a Proxy Auto- Configuration (PAC) file you configure.
You can configure WPAD using configuration parameters on your provisioning server, DHCP, or DNS-A protocol mechanism to discover the PAC file location.
Values you configure using parameters take precedence over DHCP and DNS-A.
Polycom phones support Basic, Digest, and NTLM Authentication mechanisms to authenticate with a proxy server. Microsoft recommends using Blue Coat proxy with this feature.
Note: If the proxies you configure in the PAC file or configuration file are either invalid or unreachable with a working fallback proxy, the time to register with Skype for Business is delayed and the responsiveness of features that support WPAD degrade.
- The VVX UC Software 5.7.0 added this feature.
- The Trio UC Software 5.7.1 added this to the Trio range.
Some screens to troubleshoot WPAD via the Web Interface Diagnostics > Skype for Business Status > WPAD or Diagnostics > Web Proxy Auto Discovery (WPAD) Status
WPAD Enabled
Proxy connect failed with an incorrect password
WPAD DNS Settings
Manual Proxy Configuration:
| Parameter | Permitted Values | Change Causes Restart or Reboot | Example Values |
| feature.wpad.enabled | 1 – Enable WPAD (Default Skype for Business) | YES | 1 |
| 0 – Disable WPAD (Teams mode only) | YES | ||
| feature.wpad.curl | Enter the Proxy Auto-Configuration (PAC) file location. | YES | https://server/wpad.pac |
| feature.wpad.proxy | Configure the web proxy server address. If you configure this parameter with a proxy address, the VVX phones do not discover or fetch the PAC file even if you configure a PAC file location using feature.wpad.curl. | YES | PROXY 10.1.1.2:8080 |
| feature.wpad.proxy.username | Enter the user name to authenticate with the proxy server. | YES | proxyuser |
| feature.wpad.proxy.password | Enter the password to authenticate with the proxy server. The credentials you can use depend on how authentication is enabled on the proxy server. You can use administrator or user credentials. If Skype for Business Active Directory in integrated with the proxy server, you do not need to configure user name or password credentials. | YES | proxypass1234 |
Example configuration to specify a Proxy:
<proxy feature.wpad.proxy="PROXY proxy.domain.com:8080" />
You can specify multiple proxies using this parameter by separated each with a semicolon the same
way you specify them in the PAC file. For example:
PROXY 0.10.1.1:8080;
PROXY 10.12.2.1:8080
Example to point manually to a PAC file:
feature.wpad.curl="https://server.domain.com/wpad.dat"
WPAD PAC File Location
It is important to set the Mime Type to application/x-ns-proxy-autoconfig
Working log from correctly set Mime type:
0820141836|curl |3|00|Connected to iistestserver.sbaierhome.lab (10.252.149.123) port 80 (#0) 0820141836|curl |1|00|HEADER_OUT: GET /wpad.pac HTTP/1.1 0820141836|curl |1|00|HEADER_IN : HTTP/1.1 200 OK 0820141836|curl |1|00|HEADER_IN : Content-Type: application/x-ns-proxy-autoconfig 0820141836|curl |1|00|HEADER_IN : Last-Modified: Mon, 20 Aug 2018 13:12:08 GMT 0820141836|curl |1|00|HEADER_IN : Accept-Ranges: bytes 0820141836|curl |1|00|HEADER_IN : ETag: "74708668738d41:0" 0820141836|curl |1|00|HEADER_IN : Server: Microsoft-IIS/8.5 0820141836|curl |1|00|HEADER_IN : Date: Mon, 20 Aug 2018 13:18:36 GMT 0820141836|curl |1|00|HEADER_IN : Content-Length: 3043
Wireshark:
Logs when Mime type is not set:
0820134231|curl |1|00|HEADER_OUT: GET /proxy%2Fwpad.dat HTTP/1.1 0820134231|curl |1|00|HEADER_IN : HTTP/1.1 404 Not Found 0820134231|curl |1|00|HEADER_IN : Date: Mon, 20 Aug 2018 12:42:32 GMT 0820134231|curl |1|00|HEADER_IN : Server: Apache/2.4.18 (Ubuntu) 0820134231|curl |1|00|HEADER_IN : Content-Length: 292 0820134231|curl |1|00|HEADER_IN : Content-Type: text/html; charset=iso-8859-1 0820134231|curl |1|00|HEADER_IN : 0820134231|curl |0|00|DATA_IN : Data of len 292 not displayed 0820134231|curl |3|00|Connection #0 to host 10.252.122.122 left intact 0820134231|curl |3|00|Closing connection #0 0820134231|nisvc|4|00|m_RetVal[0] eReqRspID[1] csStrippedResponse[HTTP/1.1 404 Not Found Date: Mon, 20 Aug 2018 12:42:32 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 292 Content-Type: text/html; charset=iso-8859-1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /proxy/wpad.dat was not found on this server.</p> <hr> <address>Apache/2.4.18 (Ubuntu) Server at 10.252.122.122 Port 80</address> </body></html>
Log Level needed for debugging:
log.render.level="0"
log.level.change.service.NISvc="2"
log.level.change.nisvc="2" log.level.change.ec="0"
log.level.change.curl="1"
DHCP Option 55 with suboption 252 enabled:
Create a new Scope Option 252 with a String Value containing the proposed URL
During signing into Skype for Business the Polycom Phone will send a DHCP INFORM requesting suboption 252 via option 55:
And a correctly setup DHCP Server will respond with a DHCP ACK containing the URL
Phone downloading dat file
...
004708.766|nisvc|2|00|DHCP 252 Opt Value: http://10.252.149.123/test1.dat
...
****************************HTTP SEND**************************
004708.778|nisvc|2|00|HTTP SEND:: DestUrl(http://10.252.149.123/test1.dat), HttpResCode(200), curlRetCode(0) retVal(0)
004708.778|nisvc|2|00|ErrorBuffer::
004708.778|nisvc|2|00|
****************************HTTP SEND**************************
Example PAC File:
function FindProxyForURL(url, host)
{
if( url.substring(0, 5) == "http:" )
{
return "PROXY 10.20.30.40:8080; PROXY 11.22.33.44:8080; DIRECT";
}
else if( url.substring(0, 6) == "https:" )
{
return "PROXY 10.20.30.40:8080; PROXY 11.22.33.44:8080; DIRECT";
}
else if( url.substring(0, 4) == "ftp:" )
{
return "PROXY 11.22.33.44:8080; DIRECT";
}
else
{
return "DIRECT";
}
}
A good site for PAC examples can be found => here <=