nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

VSZ - Active Directory and Default Group Attribute Value

unknown

Hello,

I am just wondering if anyone has got their VSZ setup with a WLAN that users log into the web authentication using accounts from Active Directory.

I had this set up p[perfectly with the ZoneDirector but can't seem to get it to work with the VSZ.

The Admin Guide i have says I can set the default Group Attribute Value when configuring the Roles, but that option is not there. The option is there how ever when I configure a Proxy AAA, but when testing, the results return Primary server success but do not list the group (which I've read it should). When logging into the WLAN I can an Invalid username or password message.

Has anyone got this kind of setup working. I have a case open, just looking to see if people have the same issue.

Thanks.

Find more posts tagged with

Accepted answers

All comments

unknown

David, I've had the same problem. you'll see the case I brought about a year agoi;I tried everything you did and still had no success. It's a problem that Ruckus know about but have not come up with a solution yet.
It's pretty urgent I would feel because a basic feature like this needs to be available to quite a lot of companies/organisations. Hopefully we'l get a solution sooner rather than later

unknown

I had to guys remoted in all of Monday trying to setup NPS and RADIUS as a work around but no joy yet. I need to get this working by Monday or else I'm going to have to stick with the Zonedirector, which means sitting on 53 brand new APs and carrying on using 802.11b/g 😞

unknown

Well we got somewhere today. We were able to log in with AD users, but unfortunately any AD users. We were not able to limit it based on AD groups and vSZ Roles.

unknown

I have one problem with the attributes.

I try to restrict the
access to the one especifc wlan based on the RADIUS Group Atributes, but
i does have susses. The users still have access to that wlan.

unknown

This could be down to two issues, a) Either your group attributes arent working and everyone is getting the role of "default" and has access to all WLANs or b) In the vsz you have to select one of the wlans when selecting which wlans a role can use where as you didnt have to select one in the zone director software.

tim_hobson

I'd be interested to see if this and been resolved as i'm having the exact same problem. I have a vSZ and 22 R510 APs sat waiting to replace a 1100 controller and 20 7363 APs but the 1100 just works and i feel that i've laid out a load of money to go backwards on functionality. Here's my thread with what we have at the moment https://forums.ruckuswireless.com/ruckuswireless/topics/vsz-3-5-roles-with-web-auth-limit-ad-groups-...

Why cant Ruckus just keep features in that are actually useful!

unknown

It was ment to be resolved with a firmware update that was ment to come out at the end of Feburary according to the person at ruckus thats looking after the case for me. I haven't heard from him since december but you have reminded me to get incontact and get an update!

tim_hobson

Ha, false promises, that's a good start.

Would you be able to update this thread when you've heard back, i'm keen to get my setup in next week / week after as that's a maintenance window for us otherwise it's going to be the end of May.

tim_hobson

Did you manage to get an update from Ruckus?

unknown

Good news, the new firmware was released a few weeks ago. I haven't got my hands on it yet so can't comment on it.

If you have a login for the ruckus support site it's up for download.

tim_hobson

I've got 3.5.0.0.808 which is showing on the downloads page however this hasn't addressed the issue with AD groups and roles meaning AD groups are still not supported in this release.

unknown

Well that's not what I wanted to hear. I haven't even fired up the vSZ in about forever so have to get it on there and see. Can you see any changes in it?

tim_hobson

I was on 3.4 before 3.5 - 3.5.0.0.808 came out a week or so after i purchased the vSZ.

3.5 has a completely different look and feel to it, my upgrade took a couple of hours to complete however it does seem a lot quicker.

I've asked my reseller to look into the AD problem too but they came back with creating a rule and force them on to a specific VLAN, this is not what i want to do, i'm wanting to stop a specific group in AD from being able to connect to a SSID.

Here are 2 screenshots of 3.5 - the login screen and the home page which can be customised.

Image_ images_messages_5f91c431135b77e2479aee49_b15902f8acafef566d1d11dfa486fbf0_RackMultipart2017041945263p6yu-c79f5135-dc89-469e-9fbc-8582700ca9f2-1514718001.PNG1492601542

Image_ images_messages_5f91c431135b77e2479aee49_b15902f8acafef566d1d11dfa486fbf0_RackMultipart2017041945263p6yu-c79f5135-dc89-469e-9fbc-8582700ca9f2-1514718001.PNG1492601542

Image_ images_messages_5f91c431135b77e2479aee49_1dcbf5f12234b129a1d7c6ff1d301899_RackMultipart201704196661310a0-9de9c83a-3f52-4e5e-80d8-55d38746d5fa-1014696559.PNG1492601552

unknown

Do you have your smartzone and zonedirector up at the same time, is it safe to do that?

tim_hobson

I cannot retire the smartzone yet until ruckus bring about the AD group feature. The smartzone has 20 7363s connected to it which is live.

I've got the vSZ setup with 22 R510s sat in a box waiting to be swapped out. Once Ruckus release the AD groups feature, then i'll setup the vSZ to the same configuration as the 1100 and swap the 7363s with the R510s. The R510s will detect with vSZ automatically and set them selves up.

It's been tested and the system is pretty much waiting to go but Ruckus will not release the AD groups feature to the vSZ. It feels like ive spent a small fortune on a white elephant!

lorenzo_temperi

Hello,
someone know if the AD Groups feature is released or not?

unknown

Hello All,

Just to update, we now have the VSZ up and running, but not using the AD groups feature. We've switched to using a RADIUS server through our smoothwall.

For all those waiting on the AD groups feature, it is now included in the software, version 3.5.1.0.296 is what I'm running, it's the last option when you configure a AAA server.

On the downside though they have removed the section under roles where you can limit a role to individual WLANS, this screen on the ZoneDirector. So kind of give with one hand, take away with the other. There must be a way to replicate with with traffic profile mapping but I haven't looked at that.

unknown

I can't believe we're still waiting for AD to be included in our vSZ-H. I started to raise this issue way back at vSCG stage and now at vSZ 3.4 still not sorted.
I have a school asking us to give them a quotation to install WiFi for the full school but they want to be assured that AD will work for them. I have to turn the opportunity down. I also have an existing school looking for AD authentication and I can't provide it. How long do we have to wait??? Can somebody give a straight answer?

unknown

You can't use AAA (RADIUS) authentication? Seems pretty straight forward with our vSZ-E deployment.

unknown

For some reasson the version 3.5.1.0.862, VSZ High is not letting us use proxy mode, does somebody knows if this mode works in this version ? im thinking that maybe I need an upgrade to fix some bug, have of you went through this problem? when I changed the mode to none proxy I started receving erros and logs from the AP, but I wasnt able to receive logs from the cVSZ controller in proxy mode.

tim_hobson

We have been in the fortunate situation where we have a ZD1200 on loan from our suppliers when we bough the vSZ license. 2 Years on as we are still no where near to using the vSZ for what i want to do with it however it feels like we have some software that promissed to deliver but it simply doesn't, the vSZ is now running 5.1.

I was told years ago that the vSZ and the ZD software would alost be exactly the same however this isn't the case. It seems that the ZD software is more feature rich than the vSZ by a country mile.

It would seem that Ruckus have finally brough in the Active Directory Group lookup as shown here from my vSZ-H setup:

Image_ images_messages_5f91c455135b77e247a2cf93_91414bdacb781a22e2b849e7bc99608d_RackMultipart2019040428558tv22-37437abb-856f-41f0-9307-5183c5977291-83129147.JPG1554371832

Image_ images_messages_5f91c455135b77e247a2cf93_91414bdacb781a22e2b849e7bc99608d_RackMultipart2019040428558tv22-37437abb-856f-41f0-9307-5183c5977291-83129147.JPG1554371832

however they haven't yet implimented the ROLES side so this user who is a test user in our AD is in the correct AD Group, however they aren't limited to join a specific SSID.

Here is what i am using now in the ZD1200 and would have hoped to have seen the same in the vSZ but this isn't the case:

Image_ images_messages_5f91c455135b77e247a2cf93_b02e1b4941729a6a573a36a9abab7f0f_RackMultipart20190404126920s45-6e05fe2a-8860-4b05-bbf2-f0d570e2b494-1471800179.JPG1554371974

Image_ images_messages_5f91c455135b77e247a2cf93_b02e1b4941729a6a573a36a9abab7f0f_RackMultipart20190404126920s45-6e05fe2a-8860-4b05-bbf2-f0d570e2b494-1471800179.JPG1554371974

Image_ images_messages_5f91c455135b77e247a2cf93_9d59b3568583a8d83397da08bcc93d8a_RackMultipart20190404154211xks-2c82ff50-b396-4a62-8b4a-34f96d3f3fb9-849710419.JPG1554371986

What the above 2 images from my ZD1200 are showing is, picture 1 is showing the ZD querying our AD to find what group memberships user 2012 is part of.

Picture 2 is showing the options under ROLES so that if the GROUP ATTRIBUTES field matches those that the user is part of in AD, the user is able to access that SSID.

This feature is missing from the vSZ and cannot be found!

I guess this is what others are waiting for and using RADIUS Authentication is not an option. We do Radius Accounting via our Smoothwall on the ZD1200.

Also what is missing on the vSZ, is the ability to have HOTSPOT (WSPr) set and to authenticate via Active Directory.

unknown

I'm doing vSZ And have run into this problem, moving from ZD3050 and realize.the feature are just there in vSZ, disappointing. Also web authentication doeant seem to work, having to do hotspot Wispr. Not impressed so far, so disappointed. I did some trouble shooting before my planned deployment next week, I discovered when doing AD auth, if a user is in one group it's fine, but if it multiple groups it's only the first queried group that works, and it's in alpha order.

unknown

I got round the problem in the end. BYOD WLAN setup as 802.1x EAP and the authentication server set as our RADIUS server (Smoothwall). In the smoothwall box is now where we can limit the access to users that are a member of a certain AD group. Any users that we then want to have BYOD access we can add to a named security group and they can authenticate with their AD username and password.

john_nicoletti

Dave, how did you go about doing this? We are trying to do something similar using Windows NPS and are striking out. I have a AAA (RADIUS) server setup (our NPS) and I configured a specific WLAN for a NAS-ID. I enabled Web Auth and tied the Web Auth portal to the WLAN. The page comes up but no user can authenticate, period. If I change the portal to HotSpot WISPr, authentication works just fine...I'm not sure what the issue is here.

unknown

I was told that this is a feature request to have atrrib mapping for users in more then one AD group, which is ridiculous, how is that a feature to request, its a bug. I was also told the workaround is setting up a radius server, which I am trying to avoid but may have to do.

Paddy_Naughton

Has anybody got this working yet either through NPS or whatever? I have a school looking for the service but still doubt if it will work.