BACK TO SUPPORT PORTAL
RUCKUS Technologies
Wired
Wireless
Cloud Services
Miscellaneous
RUCKUS Lennar Support
Lennar Knowledge Base
RUCKUS Lennar Support
Resources
Community
Technical
Register
RUCKUS Technologies
Home
RUCKUS Technologies and Products
Access Points - Indoor and Outdoor
standalone zoneflex 7372 - private / public wifi - pfsense firewall - cisco catyalst 3560 switch
unknown
just got my first ruckus access point ZF7372, would like to set up private wifi for family, and public wifi for guests.
have Dell Poweredge 2950 Dual Xeon 5160 3GHz 8GB running pfSense Firewall
with 6 x gigabit NICs and cisco catyalst 3560 switch.
any suggestions how to accomplish this? what is best practices on connecting the ZF7372 to the network and separating the public/private wifis, im assuming vlans set up in the switch, in the access point/ssids, and pfsense? kind of new to all this, eager to learn.
current setup is cable modem>pfsense wan>switch>ZF7372
switch is setup all ports vlan 1 default
does the standalone ap get trunked to the switch?
does the pfsense router get trunked to the switch?
Find more posts tagged with
Accepted answers
All comments
dionis_taveras
Patrick, congratulations on your Ruckus AP. The configuration is actually pretty straight forward amd simple. In your pfsense create two virtual interfaces for vlans. IP them accordingly and make one your guest and one private. Pass those VLANs onto the switch. The port configured for the AP, make that a trunk port. Pass the native VLAN and make that the VLAN that will give the AP it's IP address, this may be the private network VLAN if you want to make your life easier. Then allow both, the VLANs for guest and for private on this port plus the native one if different to pss on this trunk port.
That's it, your infrastructure is built. Now, you can move on to configure the AP, that's pretty straight forward. When it gets to the point of assigning a VLAN to the WLAN area, select the VLAN you created for guess and private and apply them to it's corresponding WLAN.
Don't forget to secure your private network by preventing access to it from the guess network and to create your dhcp pools for each subnet on the pfsense.
Hope this helps.
unknown
Dionis, thanks for the reply it has indeed helped.
have a few more questions before i commit.
in the gui of the ap under ports
port 2 goes to the switch, and per your instructions i will set the switchport on the cisco to trunk, allowing the native vlan and the two wifi public/private vlans
should i change the port 2 on the 7372 to trunk i assume to match the trunk setting on the switch?
should i change;
Packet Forward
802.1X
VLAN
Insert DHCP Option 82
Client Fingerprinting
would you please explain; UNTAG ID, and members for the above VLAN setting.
is it best practice to put all my devices on the same management VLAN? and add the mgt vlan to the trunk?
ie. - pfsense router firewall/cisco switch/wireless AP
also do any changes need to be made in>
Administration :: Management
Controller Discovery Agent (LWAPP)
Cloud Discovery Agent (FQDN)
Controller Address
TR069 / SNMP Management Choice
as I have no zone director?
thank you
-+>Patrick
dionis_taveras
Ok, first, only change client fingerprinting, if you want to have clients OS identified and such, no change for dhcp option 82 and 802.1x but do change the VLAN to the ine that correspond to that network.
Don't change the physical port on the AP and leave it as default. By adding the VLAN to the WLAN you are already doing this.
No changes to zone director area. Untagged means it won't be passed forward, it stays there as access only (in the simplest way I can explain it).
Management changes could include the port to access the AP and secured or unsecured access and things like that. Also user and password to manage the AP. In your case, no SNMP or any of that.
unknown
Current setup;
Cable modem to WAN interface of PFSENSE box set to dchp from comcast
PFSENSE LAN interface set to static address 192.168.1.9 to port 0/1 on cisco caytalyst 3560 switch
Ruckus ZF7372 Port 2 set Trunk Port, Bridge to WAN, UNTAG ID 1
to port 0/2 of switch.
interface FastEthernet0/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-99
switchport mode trunk
!
interface FastEthernet0/2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-99
switchport mode trunk
in pfsense i have created two virtual interfaces; wifi, and wifipub
WIFI VLAN1 on lan interface 100baseTX
192.168.10.1
WIFIPUB VLAN20 on lan interface 100baseTX
192.168.20.1
Enabled DHCP server on WIFI interface
Subnet
192.168.10.0
Subnet mask
255.255.255.0
Available range
192.168.10.1 - 192.168.10.254
Enabled DHCP server on WIFIPUB interface
Subnet
192.168.20.0
Subnet mask
255.255.255.0
Available range
192.168.20.1 - 192.168.20.254
in Ruckus ZF7372 AP webui
Status :: Internet
IPv4 Status:
Connection Type: dhcp
IPv4 Address: 192.168.1.141
IPv4 Subnet Mask: 255.255.255.0
IPv4 Gateway: 192.168.1.9
Primary DNS Server: 192.168.1.9
IPv6 Status:
Connection Type: autoconfig
Question: should I set the AP to a static IP?
in Configuration :: Internet
Management VLAN 1
IPV4 Type DHCP
IPV4 DNS Mode Auto
IPv6 Type Auto Config
in Configuration :: Radio 2.4G :: wifi
ssid wifi
packet forward Bridge to WAN
access VLAN 1
in Configuration :: Radio 2.4G :: wifi-pub
ssid wifi-pub
packet forward Bridge to WAN
access VLAN 20
in the switch i have only configured the port that the AP connects to as TRUNK
and added VLAN 20 named wifipub
on the AP i have left the default port as ACCESS
connecting to wifi-pub ssid , gets ip address 192.168.20.101 can access both the pfsense webui and the ruckus ap webui from here, but no Internet.
( LOL, this is the reverse of what i would like to accomplish XD )
I thought having these on different vlans would do this
when i goto 192.168.20.1 it now takes me to the pfsense login page =(
connecting to ssid wifi - can connect to both the local network and the internet
I have not made any firewall rules
also i know this is a layer 3 switch, how can I make sure that pfsense handles the routing?
do i need to change anything in the Local Subnets category in the AP webui config? currently they are disabled
thank you for your help, please let me know if i can provide more information to find a solution.
-+>Patrick
unknown
Hello ,
this is not really ruckus related , i asked for some help in the pfsense forum with no replys.
I have the same setup;
cable modem >> pfsense wan interface
pfsense LAN interface >> Cisco 3560 switch
Ruckus 7372 >> Switch
have recently come across a cisco 2851 router 2 7960 ip phones, and 10 7920 wireless ip phones
could use some help getting them online.
funny story , when i first got the router and phones, i had them connecting to the router, and they could all call each other by extension, even got as far as registering the call manager to flowroute. and then the router lost power, and the config was not saved.
thanks,
Patrick
btw ruckus is awesome, i watched this video on beamforming, antennas and waves.
https://www.youtube.com/watch?v=kcIkgyRGFQE
awesome technology and company
Quick Links
🗂️ All Categories
📄 Recent Posts
❓ Unanswered
🆘 Help
Tags
SmartZone or vSZ
RUCKUS Self-Help
Cloudpath
ICX
AP Management
vSZ
Access points
ICX Switch Management
Lennar homes
SmartZone