I have tried to repower the switch and doing a reset with the reset button but the issue still persist.

Kindly assist. 

I have a lot of the new AP R370's not connecting to Ruckus One and flashing amber. I can get into their SSH and Web Interface and all looks okay, I am trying to refresh/upgrade its firmware however there are no files available or really any troubleshooting help with this new AP! 

Any help, appreciated!

We've recently upgraded our vSZ-H cluster to 6.1.2 (up from 5.2.2) and I'm trying to test a new H550 into the environment. I currently have around 650+ H510's, that work no problem, but I can't get a new out of the box H550 to join. I've scanned the AP into the vSZ, same process as an H510 with no luck. My H550 has an ip address (same ap management vlan as the H510's) and is pingable from the SmartZones.

I've tried 2 different H550's, with different cables and different switches. Any help would be appreciated.

Jon

We are managing 16 APs from Ruckus Unleashed, we had configured the management IP and we can access to Unleashed through this management IP.
Now, as soon as I access to Unleashed, this shows me the following message:
"Unleashed portal is now available for cloud remote control. Sign up now"
I went to "Sign up now" and created an account
There, when I tried to bind the network, I get:
"Error. Network´s username or password verification failed"

We would like to use the remote management to access directly from anywhere. How can we solve this?

Thanks in advance.
Regards!

Damián

Subject: [Ruckus-Unleashed@192.168.xxx.xxx] Alarm 'SSID-spoofing AP Detected' generated
"An alarm 'SSID-spoofing AP Detected' was triggered."

What would be the best practice for checking what triggered this alert? Can you recommend what things we need to look at? Thank you!

Been using 3 Ruckus R510 AP's, latest Unleashed firmware 200.15.6.212.20.

Something i did while streaming from my phone to my Nvidia Shield gave a popup 'streaming over 2.4ghz causes slowdowns' or something along those lines.

For some reason all devices seem to only get 2.4Ghz hardly any device connects on 5Ghz? And even when a device is connected on 5Ghz the speeds are miserable. 

Yes i know 3 AP's seems a lot, i got 1 in the office, 1 in living room and 1 in bedroom. Coverage seems extreme but i also like to have a good signal outside.

On average ~20 devices are on this network, peaks up to 45.

My setup :

>Fiber 2/2Gbit. (Yes waiting for new router to do 2.5/2.5)
- Edgerouter (Hardware offloading on)
- Juniper EX4200 48T 8xPOE
- 3x R510 on POE ports. (normal use for all devices)
- 3x Ap AC lite on POE ports. (mainly iot stuff, lights, censors, cameras, switches etc overall 40 devices)

Tested on several devices from the same spot not even ~1M away from AP.

- PC - Wired Download Mbps 943.79/Upload Mbps 938.05

- OnePlus 8T 2.4Ghz (oldest phone) ~88Mbps down/58Mbps up.

- OnePlus 11 5G 5Ghz ~ 177Mbps down/100Mpbs up.
>Device info shows Link speed 702Mpbs on 5Ghz.

- OnePlus 13 2.4Ghz ~87Mbps down/63Mbps up.
>Device info shows Link speed 144Mbps on 2.4Ghz

Using the app 'Wifiman' on both the OnePlus 11 and 13 i'm connected to the same AP (same Mac address shows)
 On the OP11 it shows my SSID and both 2.4 and 5Ghz (connected) 
 On the OP13 it shows my SSD and ONLY 2.4Ghz (connected) 

. Is there a way to without creating 2 different SSID's (like: mywifi 2.4 and mywifi 5)  to 'push' the 5Ghz capable devices to 5Ghz? 

https://community.ruckuswireless.com/t5/ICX-Switches/DHCP-server-icx-7750/m-p/101495#M7109 

SW version is 08.0.95pT203

I have created 2 VLANS. For example vlan 100 and vlan 101
For vlan 100 I have used the dhcp pool created on ICX7750 and For Vlan 101 I used the TP-link router to provide DHCP. Both PC+ Mobile working fine with VLAN101 in SSID101 but VLAN 100 has SSID 100 in AP on which only PC get connects.

On checking VSZ6.1.2 it shows in AP clients i can see the DHCP ip received by the PC but the DHCP from the mobile phone reaches to VSZ but it shows 0.0.0.0:: and it donot request the dhcp to switch but incase of PC it does with the same SSID.

On checking via Wireshark:

--On Laptop (Wi-Fi)
--Receives DHCP Pool Address
DHCP Request:
*Option:(50) Requested IP address (192.168.92.4)
DHCP ACK:
*Option:(54) DHCP Server Identifier(192.168.92.1)

--On Mobile (Same Wi-Fi)
--Do not lease IP address, no Request and ACK, Only Discover is seen in Wireshark
*Option:(53) DHCP Message Type (Discover)
DHCP: Discover (1)
*Option:(61) Client Identifier
Client Mac Address:<------>
*OPtion:(12) Hostname
Hostname: <Redmi-12-5G>
*option:(55) Parameter Request list
Length:12
Parameter Request List Item: (1) Subnet mask
Parameter Request List Item: (3) Router
Parameter Request List Item: (6) Domain name Server
Parameter Request List Item: (15) Domain name
Parameter Request List Item: (26) Interface MTU
Parameter Request List Item: (28) Broadcast Address
Parameter Request List Item: (51) IP Address lease time
Parameter Request List Item: (58) Renewal time value
Parameter Request List Item: (43) vendor-specific Information
Parameter Request List Item:(114) DHCP Captive-Portal
Parameter Request List Item: (108) IPv6-Only Preferred

switch configuration:
ip dhcp-server pool vlan100
excluded-address 192.168.92.1
!
excluded-address 192.168.92.100 192.168.92.254
lease 1 0 0
network 192.168.92.0 255.255.255.0
option 3 ip 192.168.92.1
deploy
ip helper-use-responder-ip

interface ve 100
vrf forwarding abc
ip address 192.168.92.1 255.255.255.0
ip helper-address 1 192.168.92.1

also globally i have enabled
ip dhcp-server enable
ip dhcp-server relay-agent-echo enable

Are there any issues we should be aware of or settings changes that should be made to resolve the issue. A majority of our fleet uses the AX201 chipset and we are often seeing these issues popup.

Let me know what other info I can provide and any help is appreciated!

One of the frame's flows that affect the overall performance of the wireless network is the retransmission rate (a frame is retransmitted when the delivery was not acknowledged or it's reported as corrupted), excessive frame retransmission forces the client-AP to negotiate lower data rates for the communications, causing greater delay and higher airtime utilization.

How can I tell if the retransmission rate is high?

• From the AP support log. 

----------------------- Host/Target Tx Stats ----------------------
RKS stats magic: cafe0001
421200 MSDUs success(msdus_success)
4582766 MPDUs success(mpdus_success)
632 tx completions delivered(comp_delivered)
7828618 Tx HW queued(hw_queued)
7828618 Tx HW reaped(hw_reaped)
188 Tx MAC underrun(underrun)
1424910 Tx HW paused(hw_paused)
3290623 Tx seq posted(seq_posted)
740 Tx mu seq posted(mu_seq_posted)
72066 Tx seq failed(seq_failed_queueing)
1342284 MPDUs requed(mpdu_requed)
5925004 MPDUs tried(mpdu_tried)
2748 MPDUs sw_flush(mpdus_sw_flush)
19468 MPDUs truncated(mpdus_truncated)
1324450 MPDUs block ack_failed(mpdus_ack_failed)
568 MPDUs expired(mpdus_expired)
2654643 excess retries(tx_xretry) ------------------------> very high 'tx_xretry'
902025741 sched self trig(self_triggers)
116763 ampdu retry failed(sw_retry_failure)

Excessive retries can be directly related to PHY errors:

------------ Host/Tgt Rx Stats ------------
34066065 PPDUs Rx from HW(htt.ppdu_recvd)
31502324 MPDUs Rx OK(htt.mpdu_cnt_fcs_ok)
2602746 MPDUs Rx Err(htt.mpdu_cnt_fcs_err)
2696712 MPDUs dropped in FW ring(htt.fw_ring_mpdu_drop)
2599042 local mgmt Rx(pdev_local_buffer_stats.local_reaped)
63379830 Rx PHY errors(rx_phyerr) ---------------------------------> very high 'rx_phyerr'
34073621 Rx MPDU errors(rxdesc_err_att)
2599027 Rx MPDU FCS errors(rxdesc_err_fcs)

• From Wireshark.

Collect a packet capture on the specified wireless interface of the AP by selecting the AP and then click 'More'>Packet Capture.

In the Packet capure page, select the appropiae radio you want to monitor and the option 'save to file'. Click 'Start' to begin to capture and then 'Stop' to stop the capture. When the file is ready, the 'Download' option will appear for you to download the file.

Once you have got the pcap file, then you can look for the 'Retry' flag on the 802.11 information of the frame.

Right click and 'Apply as Filter>Selected to fiter out the all the retransmitted frames:

This is the wireshark filter for the retry flag in the frames.

wlan.fc.retry == 1

Check the total amount of packets in the file vs. the number of packets displayed and then you will have a meassure of the retransmission rate of the packets captured in the specific lapse. In our example, we have a 10% of retransmission rate.

We can see, for our example, the probe response from the AP was retrasmitted many times, which means  -most likely- the client never received it. This could have ended on a client unable to connect to the wireless network or maybe just connecting to the next available AP -no usually the closest one-.

What are the causes of high retransmission rates and how can I address them?

1. non-wifi interference. Identify the source of the interference and shut it down -if it's under your administration- or relocate the AP if the interference cannot be disabled.
2. wifi interference (co-channel or adjacent channel). Review the channel plan and choose a channel selection option that best services your enviroment.
3. hidden nodes. Reduce the cell size or relocate the AP.
4. poor signal to noise ratio. Identify the sources of the most noise signals and reduce/disable them -if it's under you administration- or relocate the AP if the interence cannot be reduced.
5. bad coverage configuration. Relocate the APs, add more APs or increase the cell size.

• Network connectivity issues
• Master AP election problems 
• Potential hardware failures
• Assessing controller connection status 

It's important to note that the presence and functionality of LED lights on a Ruckus AP can vary depending on the specific model and series. However, most Ruckus APs feature the following five LED indicators: PWR, CTL, AIR, 2.4G, and 5G.

PWR (Power Indicator):

Solid RED: Bootup in progress.

Flashing Green: AP firmware image booted. No routable IP received or assigned.

Solid Green: Routable IP address received.

CTL/DIR (Control/Direction Indicator):

Off: AP is a RUCKUS Unleashed member AP.

Slowly Flashing Green (every 2 sec): RUCKUS Unleashed Master AP discovery in progress.

Fast Flashing Green (twice a sec): Receiving configuration or image upgrade.

Solid Green: AP is the RUCKUS Unleashed Master.

AIR (Mesh indicator:)

Off: AP is operating in standalone or Root or non-Mesh AP        

Solid Green: AP is functioning as Mesh AP (MAP)        

Blinking Solid Green (2 Hz): AP is functioning as Mesh AP (MAP)        

Blinking Solid Green (0.5 Hz):         

2.4G (WLAN Service Indicator):

Off: The WLAN service is down.

Green: The WLAN is up, and at least one client is associated.

Amber: The WLAN is up, but no clients are associated.

5G (WLAN Service and Mesh Downlink Indicator):

Off: The WLAN service is down.

Green: The WLAN is up, and at least one client is associated. No downlink MAPs are connected.

Slow Flashing Green (one flash every two seconds): The WLAN is up, and at least one downlink MAP is connected. No clients are associated.

Fast Flashing Green (two flashes every second): The WLAN is up, at least one downlink MAP is connected, and at least one client is associated.

More info about the LEDs can be found here: https://docs.commscope.com/bundle/unleashed-200.10-troublshootingref/page/GUID-738984DA-2A47-4E71-A690-B6DF9023AA50.html

I have a Ruckus R650 [901-R650-US00] running Ruckus Unleashed (200.16.7.0.402) and the Web UI is broken. Though it loads up initially just fine, whenever I try to edit a Wi-Fi network or click on the "access points" section it just loads an empty grey screen. Here are some relevant logs that I found in the syslog:

Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, insert_field_to_upgrade_ap_list(): firmware_file open failure
Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, get_ap_list(): see [/tmp/unleashed_upgrade/upgrade_ap_list_from_election.xml.ready], ap-list ready!
Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, get_ap_list(): ap-list loop 0.

I have another problem with it not negotiating 802.3at (POE+) no matter what I try. I'm powering it with a Juniper SRX320-POE, and I have enabled POE negotiation on the source but it still recognizes it as a "802.3af Switch/Injector":

ruckus(ap-mode)# get power-mode
PoE Configured Mode : Auto
Power Consumption Status : 802.3af Switch/Injector
USB Status : Disabled
OK

Forcing it to use POE+ with `set power-mode at` works, but doesn't persist after reboot.

Finding what the log messages mean has been a big pain as documentation that refers to it is almost non-existent.

Thank you

1. Client Connection Troubleshooting

Link as reference https://docs.commscope.com/bundle/unleashed-200.16-troublshootingref/page/GUID-5BBF52D0-939D-416F-B696-FABB12AC5EE9.html

This is a demonstration for the client troubleshooting.

Select Clients, and then click the Troubleshooting button.

Figure 1: Clients Tab

Here, we can enter the MAC address of the client device in the specified format to begin troubleshooting process. If the device is already connected to the network, simply click on it, and the troubleshooting process will begin automatically.

Figure 2: Troubleshooting button.

Identify the MAC Address: Obtain the MAC address of the client device you want to analyze. Ensure you have this information handy as it will be used to filter the capture.

Input the MAC address of the client device into the designated filter.

Click the Start button to begin the troubleshooting.

In this demonstration I will use the following Mac-address for one of my Wireless clients 62:b6:b1:eb:09:89

Figure 3: Start Troubleshooting Process

Once you click Start, no data will be displayed initially because the device has not yet connected to the network or attempted to connect to any of the AP's SSIDs.

Figure 4: Troubleshooting Process

In this example, I will attempt to connect my end client to the SSID of the Access Point and intentionally use an incorrect password.

Figure 5: Initial Packet Capture View

First, we will analyze what we are observing firsthand during this test. We can identify which Access Point the end device is connecting to, the band it is using (whether 2.4 GHz or 5 GHz), and in this case, it is 5 GHz on channel 157. Additionally, we can observe the environmental SNR and the timestamp of the events according to the Access Point's log.

Now we will analyze the packets exchanged between the end client and the Access Point.

Figure 6: Analysis of Packet Exchange Between Client and Access Point

The client device initiates the connection by sending authentication and association requests, which the AP responds to. During the 4-way handshake, each attempt fails repeatedly, suggesting there is an issue. After multiple failures, the AP deauthenticates the client, ending the connection attempt.

Figure 7: Final Analysis - Client Failed Handshake

When the Information button on the error is pressed, it often provides a suggested error code and status, which can also be copied for reference. In this example, the tool indicates an "invalid passphrase" error, accurately reflecting the intentional use of an incorrect password for testing purposes. This tool is highly effective for troubleshooting connectivity issues, as it provides insights into client behavior during the authentication process, in roaming scenarios, and across various other network situations.

2.    Capturing Remote Packets

Remote packet capture enables one or more APs to operate in packet sniffer mode, allowing them to capture wireless packets on the network. These packets can either be saved locally on the device or streamed in real time to a packet analysis tool, such as Wireshark, for detailed inspection and troubleshooting. This feature is valuable for diagnosing connectivity issues and monitoring network performance by analyzing the captured packet data.

Link as reference https://docs.commscope.com/bundle/unleashed-200.16-onlinehelp/page/GUID-FE747C7C-8F63-409B-A423-63F898CA8331.html

Go to Admin & Services > Administration > Diagnostics > Packet Capture.

Figure 8: Packet capture tab

In this section, we will find the Access Points in our network, along with their model, device name, and corresponding IP address.

To troubleshoot the client connectivity issue, select the desired APs, and then choose Add to Capture. This action will move the APs to the Capture APs table.

Figure 9: Selecting the Access Point for the Packet Capture

For Radio, select either 2.4 GHz or 5 GHz/6 GHz. In this case, since we are working with a 5 GHz connection, select the 5 GHz option.

You can Select Local Mode or Streaming Mode as the capture mode:

+To capture a limited snapshot on each AP, select Local Mode.
+To stream the captured packets directly to Wireshark for real-time analysis, select Streaming Mode.

In this example we are going to select Local Mode.

In this example, since the MAC address of the problematic device is known, enter it to filter the capture data specifically for that client. Click Start to begin capturing packets. At this stage, reproduce the issue. Once the issue has been reproduced, click Stop to end the capture.

Figure 10: Initiate the Packet Capture

Then click Save to store the packet capture as a local file for later analysis.

Figure 11 : Downloaded PCAP from the Unlashed UI.

Once the file is downloaded, it will be saved in the Downloads folder. Extract the contents, and you’ll find folders containing the PCAP files. These files include detailed information on the association process for the end client , which will help you investigating if there is any incidents.

Note : Remember to remove the AP from the capture list and disable packet capture after completing this process.

By analyzing the packet exchange during the connection process, you can pinpoint where the failure occurs and take appropriate corrective actions. This method provides valuable insights into the interaction between client devices and APs in real time.

Unleashed Overview

In an Unleashed network, a RUCKUS Unleashed 'Master' Access Point acts similarly to a controller, managing all control functions. These settings are then propagated to the other APs in the network. If the Master AP go offline, a 'Member' AP will automatically take on the role of the Unleashed Master, assuming control and maintaining network operations.

Unleashed Support

-Bridge mode 128 APs and 2,048 clients.

-Gateway mode supports up to 25 APs and 512 clients.

-Dedicated Master

Overview Limitations from Zone Director

-IPv6 is not supported.

-No interface to communicate with SmartCell Insight analytics engine or SPoT location.

-No Northbound Interface to pass client authentication responsibility to an external entity.

-No WLAN groups.

What are the necessary conditions or prerequisites for an access point to successfully connect to an existing Unleashed network?

Connect the Member Access Point (AP) to the network, ensuring it is on the same VLAN as the Master AP. Upon powering up, the Member AP will engage in an election to determine if a Master already exists. It's important that the Member AP either matches or has a lower firmware version than the Master.

Additionally, it must be able to ping the Master AP and share the same country code setting.

Commands to check if a member Access Point is not joining to the Unleashed Network.

•  ping < Master_AP>
•  get version 
•  get boarddata : Display hardware version and system board information
•  get discovery-agent: Check if LLWAP protocol is enable.
• get countrycode :
• get director : show Master AP information.
• get election: shows the status of all Unleashed APs
• get syslog log

The same information can be collected on the Master AP.

• Ping <Member_IP>
• get version 
• get countrycode 
• get boarddata 
• get election 

Ruckus CLI on unleashed when SSH to the Access Points.

The 'ruckus>' CLI prompt indicates you are logged into the 'Master' Access Point. From here, you can navigate through various configuration modes to manage settings and preferences.

Enable:

ruckus#

Under enable mode we can go to different modes example:

ap-mode: Note under this mode you can run set-get commands.

ruckus(ap-mode)#

Config

ruckus(config)#

Under config there are some different modes

+Admin:

ruckus(config-admin)#

+System:

ruckus(config-sys)#

+Using the Mac-address of the AP: 

ruckus(config)# ap d4:bd:4f:01:bc:10
The AP 'd4:bd:4f:01:bc:10' has been loaded. To save the AP, type 'end' or 'exit'.
ruckus(config-ap)#

The 'rkscli:' prompt indicates that you are logged into a 'Member' Access Point. In this CLI, you can execute 'get' or 'set' commands to retrieve or configure the Access Point settings. For example:

Best Regards 

Fernando Vasquez 

I recently purchased a Ruckus R650 AP and I'm looking to set it up in bridge mode to wirelessly extend my network. Here’s my current setup:

• I have a UniFi AP upstairs that’s connected to my switch, and I’m using it to broadcast my network.
• Downstairs, I used to have another UniFi AP set to bridge mode, wirelessly connecting to the upstairs AP to extend the network.
• Now, I’d like to replace the downstairs UniFi AP with the Ruckus R650, set it to bridge mode, and connect wirelessly to the upstairs UniFi AP.

Does anyone know the steps to configure the R650 for this kind of wireless backhaul in bridge mode? Also, are there any compatibility issues I should be aware of when mixing the Ruckus AP with the UniFi upstairs?

Thanks in advance for your help!

In this article, I will explains an issue with customer DHCP configuration (related to DNS Domain name) which can potentially cause AP connectivity issue with RUCKUS Cloud.

Symptoms

• If you hit this issue, AP may show online but as soon as you make any configuration changes on venue, AP, WLAN, it will result AP state changing to "Never contacted Cloud".

• AP will not show any new event, since the time of its last successful connection to Cloud.
  In some cases AP will also show in "Operational -  applying configuration" state on Cloud UI and will never complete applying configuration.

• AP will still serve clients with last known configuration (if AP was not rebooted).

How to troubleshoot?

• Run a capture on switch port where AP is connected and reboot the AP.
  Note: This will not help if AP is configured with static IP configuration.
• Check the uplink packet capture and analyze (look at the DHCP Offer frame) the DHCP packets for the DHCP process.
• You will see DHCP server sending DNS domain name information.

• When Domain Name is added to the DHCP and configured on AP, AP will append the AP-Cloud discovery URL which is device.ruckus.cloud to device.ruckus.cloud.xyz.com. Because of this change in Cloud URL, AP will not be able to reach the correct controller IP (usually DNS resolution will fail) and will eventually fail to connect to Cloud.
• In case domain specific URL (in this case "device.ruckus.cloud.xyz.com") has a valid DNS entry on customer/public DNS server, it will further result in connection failure as resulted IP address will not match with the correct Cloud controller IP address.
• You can also factory reset one AP and then SSH into it (with default credentials super/sp-admin), run below commands to confirm if AP is getting the DNS Domain name configuration from DHCP.
• Run and review the output of "get dns" command.
• Output when DNS Domain name is received from DHCP server.
  

  rkscli:
  rkscli: get dns
  Allow DNS from DHCP: Enabled
  Ethernet DNS servers:
  DNS 1 : 8.8.8.8
  DNS 2 : 8.8.4.4

  IPv6 DNS Setting

  DNS Domain
  <None>

  DNS Search List
  <None>
  OK

• Output when DNS Domain name is received from DHCP server

  rkscli:
  rkscli: get dns
  Allow DNS from DHCP: Enabled
  Ethernet DNS servers:
  DNS 1 : 8.8.8.8
  DNS 2 : 8.8.4.4

  IPv6 DNS Setting

  DNS Domain
  xyz.com

  DNS Search List
  <None>
  OK

Resolution

While issue is impacting RUCKUS APs, this is completely an issue caused by customer DNS and/or DHCP server configuration.

Follow below steps to fix the issue.

• Check and remove the domain name configuration from DHCP IP pool which is used for RUCKUS Access points.
• Just updating the configuration on DHCP server may not fix APs as APs will still hold old IP which has valid lease time. In this case you may reboot the AP so that AP can get the fresh IP lease from DHCP server without DNS domain name. Also clearing the IP lease from DHCP server can help.
• Even after rebooting or re-requesting IP from DHCP if issue is not solved, remove the AP from the Cloud and re-add.
• If you continue seeing issue even after fixing the DHCP configuration, please contact RUCKUS Support and report the issue.

I hope this will help!

Got any queries? Start the conversation!

I have seen all the posts about the slow speed, which I am also having on the 5Ghz band, but with the latest 200.15.6.112.54 firmware I am having not only speed issues but connection stability as well. I have done a full reset and left the AP on auto, allowing the BSSID to be on both 2.4Ghz and 5Ghz band. I either get extremely slow upload speeds like a Phy link speed of 3Mbps, or the client disconnects. Here is the config below. As far as I know this device shouldn't perform this poorly? My client also show wifi gen 4 is being used and not wifi gen 5 on the 2.4Ghz connection. 

From all the other issues I have seen with the R720, was this just a bad product, or is it the unleashed firmware that is really damaging here?

AP:
ID:
1:
MAC Address= xx:xx:xx:xx:xx:xx
Model= r720
Approved= Yes
Device Name= RuckusAP
Device Role= Master
Description=
Location=
GPS=
CERT = Normal
Bonjour-policy=
Bonjour-fencing=
Group Name= System Default
Channel Range:
A/N= 36,40,44,48,52,56,60,64,100,104,108,112,116,120,132,136,149,153,157,161 (Disallowed= 124,128)
B/G/N= 1,2,3,4,5,6,7,8,9,10,11,12,13 (Disallowed= )
Radio a/n:
Channelization= Auto
Channel= Auto
WLAN Services enabled= Yes
Tx. Power= Auto
WLAN Group Name= System Default
Call Admission Control= OFF
Protection Mode= 2
Radio b/g/n:
Channelization= Auto
Channel= Auto
WLAN Services enabled= Yes
Tx. Power= Auto
WLAN Group Name= System Default
Call Admission Control= OFF
Protection Mode= 2
Override global ap-model port configuration= No
Network Setting:
Protocol mode= IPv4-Only
Device IP Settings= DHCP
IP Address= 192.168.1.35
Netmask= 255.255.255.0
Gateway= 192.168.1.1
Primary DNS Server= 192.168.1.5
Secondary DNS Server=
Mesh:
Status= Disabled
LLDP:
Status = Use Parent Setting
LAN Port:
0:
Interface= eth0
Dot1x= None
LogicalLink= Down
PhysicalLink= Down
Label= 10/100/1000 Port1
1:
Interface= eth1
Dot1x= None
LogicalLink= Up
PhysicalLink= Up 2500Mbps full
Label= 100/1000/2500 PoE Port2
802.3af PoE Tx. chain= 2
LACP State= false

1- Make sure the server has the necessary basic features installed.

2-Navigate to the Network Policy Server tab, access NPS (local), and choose the 'Radius server for 802.1x' option for both wireless and wired connections. Finally, select 'Configure 802.1x'

3-In this step, select 'Secure wireless connections' and customize the policy name to your preference. In this case, append 'DEMO' at the end of the policy name.

4-In this step, you need to configure the Radius Client by providing a friendly name, entering the IP address of the master Access Point, and optionally setting a password or using a password generation tool. Remember to save this configuration as it will be used in Step 9.

5-In this step, choose 'Microsoft Protect EAP (PEAP)' as the network access method

6- Next, leave the remaining options at their default settings, and conclude the configuration by clicking on the 'Finish' button.

7-Configure the “Connection Request Policies”

To configure the connection request policy, navigate to the 'Policies' section. Then, access the 'Connection Request Policy' folder and locate the policy is created with the same name. Double-click on it to access its properties. In the 'Properties' window, navigate to the 'Conditions' tab. Remove the 'Current' condition and any others if present. Add the 'Time' condition and select 'Permit all time'. Finally, click 'Apply' and then 'OK' to save the changes.

8-Configure Network policies

To configure the Network Policies access to “Network Policy” folder and locate the policy is created on the folder and locate the policy is created with the same name. Double-click on it to access its properties. In the 'Properties' window for this example, I choose to ignore the user properties dial and proceed to the 'Conditions' section. Here, I add the 'User Groups' option to use the Active Directory users.

In this part, you have the option to either use an existing group and its users or create a new group along with its users.

Optional step

How to create a group and users

Open Active Directory Users and Computers, then select the domain used in this case, cslab12.com. Navigate to the 'Users' folder, right-click on it, and choose 'New' > 'Group.' Finally, enter the required information

Reference : https://docs.commscope.com/bundle/sz-700-accessservicesguide-sz300vsz/page/GUID-D9E129C3-A6AF-433F-ABA3-81BD8A1CCA91.html

How to create an user

Navigate to the Active Directory of users and computers, then left-click on it. Next, select 'New,' followed by 'user’, and proceed to fill in the required information (username and password ).

In this case, we need to edit the 'Member of' properties of this user. Since I want this user to belong to the earlier created 'DEMO' group, we navigate to the user's properties, specifically the 'Member of' section. Subsequently, we add the group and configure it as the primary group.

Continue with the network policies configuration next, we will select the desired group and proceed to the 'Constraints' tab. Here, we will add CHAP as the authentication method.

9-Unleashed Configuration

In the Unleashed configuration, navigate to 'Admin and Services' and then 'Services.' Click on the plus (+) sign to add the RADIUS server and fill in the information based on the configuration we completed in Step 4. Ensure that the IP address points to the RADIUS server.

10- WLAN Creation

Navigate to 'Wi-Fi Networks' and select the tab for creating a wireless network. Fill in the necessary information accordingly. In this step, the only addition is to include the server that we created in Step 9 as the authentication server.

11-Wireless Client

After creating the wireless network, it's important to check the connectivity. Connect to the network and when prompted, enter the credentials of the created DEMO-USER along with the corresponding password. If the credentials match, you should be able to connect to the network without any issues.

I'm new to Ruckus hardware but experienced with networking, particularly with Netgear and Unifi products. I recently got two free Ruckus R750 APs from work and have a Unifi switch with three VLANs set up (in addition to the LAN).

I know I need to configure the the switch to allow the specific VLANs, but I can't find any VLAN settings in the configuration page. Also, I want to set one of the APs in bridge mode because my router is on a different floor than my home lab. I need the second AP to function as an Ethernet port for my switch in the lab, similar to my current Unifi setup. The AP as been reset, is online and has the default firmware. 

Any pointers would be greatly appreciated. Thanks!

We have very old virtual SmartZone, version is - 3.4.0.0.976. It work's good, but we purchased several old Ruckus AP (R310). I Would like to add it to this SmartZone (I have free license's), but I can't. I need to approve this AP, but I can't click approve or delete. 

I Tried with several browsers, different PC, but without success. I already have another R310 connected to this SmartZone and they works good.

How I can fix this issue? or is it possible approve AP from CLI? 

This option is configured in the DHCP server and must be masked. Also, the vendor code and the length of the IP address must be specified in HEX.

RUCKUS vendor code:

- 06 for SmartZone

- 03 for Zone Director

Using this website you will quickly mask the IP address from IPV4 to dnsmasq values.  

For example, let's mask the IP address 192.168.0.200 using the website: the final value to enter in your DHCP server is "060d3139322e3136382e302e323030"

How did they get to such a result? 

1. Divide the IP Address: Start by splitting the IP address into its four individual parts: A.B.C.D.

   1. 192
   2. 168
   3. 0
   4. 200

2. Mask the decimal values: For each part, convert the decimal value to its corresponding hexadecimal representation. For instance:

   • Decimal 1 becomes "31"
   • Decimal 9 becomes "39"
   • Decimal 2 becomes "32" ...

3. Add Separators: Place "2e" (ASCII value for dot) between each pair of translated hex values.

4. Include Vendor Code and Length: Prefix the vendor code at the beginning (e.g., "06" for RUCKUS). Add the IP address length in bytes (e.g., "0d" for 13 bytes).

   Note: The length is 13 bytes since each pair of characters equals one byte.

5. IP Address Translation: The IP address "192.168.0.200" transforms into the hexadecimal string "3139322e3136382e302e323030".

6. Combining Elements: Combine all the translated parts to form the final hexadecimal representation.

Example for the IP address "192.168.0.200":

• Translated octets: "31", "39", "32", "2e", "31", "36", "38", "2e", "30", "2e", "32", "30", "30"
• Vendor code: "06"
• Length: "0d"
• Combined: "060d3139322e3136382e302e323030"

Visit this post to learn other ways to provision RUCKUS APs with the IP address of their controllers.

I'm trying to understand if an AP connected to a trunk port setup with a Bonjour Gateway policy, can act as a bonjour gateway between two wired VLANs.  Is this service agnostic of WiFi vs. Wired and purely just working between VLAN tags?

I have about 10 APs R550's running the latest firmware with 4 VLANs - we want to put certain people on certain VLANs only and prevent them from logging in otherwise.   The first group is about 50 mac addresses, the second is about 100 and the third is about 25 mac addresses.

We'd really prefer to import a mac address list rather than add 175 mac addresses 1 at a time.

Anyone know a way to import the CSVs?

How can we check this?  The data sheet of the device(s) !.
Let’s consider, RUCKUS ICX 7150-48P Switch, which has the following hardware specifications: 

• 48× 10/100/1000 Mbps RJ-45 PoE+ ports  
• 370 W PoE budget  
• 2× 10/100/1000 Mbps uplink RJ-45 ports  
• 4× 1/10 GbE uplink/stacking SFP/SFP+ ports 

 Which shows that,  It has a PoE budget of 370 W and there are 48 ports that can support PoE+ or 802.3at.

For more reading, refer : https://www.commscope.com/globalassets/digizuite/61729-ds-icx-7150.pdf 
Note that in this example we have considered 7150, but for other models such as 8200, 7550, etc. Please refer to the data sheets for the respective switch families.

Number of devices it can deliver PoE to.  

This relates to the PoE budget of the device and the type of Powered Devices (PDs) used. Nowadays, PDs typically come with PoE+ capabilities, although there are still some that support only PoE. The crucial factor is understanding the PD's capability to determine how many of them the switch can accommodate or power up. For instance, consider an Access Point (AP) rated for PoE+. When negotiating for PoE, the device communicates with the switch through the LLDP TLV field, specifying its class and power requirements. Based on this class, the switch allocates power accordingly.

The above reference is as per IEEE Documentation for PoE standards 802.3at and 802.3bt.  
Based on this, considering that the PD is PoE+ capable, on RUCKUS ICX 7150-48P that has 370 W PoE budget. 
We can calculate the below:  
PSE's budget = 370W 
PD's PoE Class = PoE+ that reserves max. of 30W at PSE  
Number of devices = PSE's PoE budget / PoE Class of the device = 370 / 30 = 12.3333 
It can power up to 12 PDs at PoE+ power level. Any additional PDs would not activate due to insufficient remaining power in the budget.

Now the question arises, why not define the power limit manually?  
    Strict manipulation can indeed bring up more PDs, but it carries a risk. After all PDs are operational and receiving optimal power, reallocating power back to the budget pool is possible. However, if a reload or power cycle of the Power Sourcing Equipment (PSE) occurs unexpectedly, PDs may encounter power-up issues. During the initial power-up or startup phase, the PSE delivers full power to the PDs. Consequently, some connected PDs may experience power shortages and struggle to come online.

Can it be done? And how?  
To configure the power limit manually on a interface based on power limit.  
Please do refer.  
https://docs.commscope.com/bundle/fastiron-08095-managementguide/page/GUID-58622E67-07D7-41E4-B4C6-A9B6F3EA8C74.html 
To configure the power limit manually on a interface based on class of the PD. 
Please do refer. 
https://docs.commscope.com/bundle/fastiron-08095-managementguide/page/GUID-155FABD5-F3C2-4579-ADBB-CC240997524A.html 

How does Ruckus address this?
Ruckus offers two well-known ways for Power Management methods for ICX line that are PoE capable.
Static Power Management:
Power is set aside for each powered device (PD) connected to switch ports when in static PM. This approach adheres to the previously discussed procedure, wherein the maximum power is set aside according to the linked power device's class. If the power reservation is not possible, even when the overall usage is less than the entire power budget, no new PDs will be powered. 
The ICX devices are configured or made available in this mode for PoE management Out of the Box. 

To overcome this, we have Dynamic Power management.  
Dynamic Power Management: 
Where this helps via having the power allocation done based on the consumption of the PD that’s connected.  Here power is not set aside for any ports in dynamic PM. Until the overall power consumption is within the ICX device's total power budget, PDs are turned on automatically.  
However here the switch will immediately shut down any PDs with low priority ports or, if all ports have the same priority, shut down PDs attached to higher-numbered ports in order to keep the total power consumption within the total power budget if the power consumption increases, either by increasing the power consumption of connected PDs or by adding new PDs. 

How to go about setting this?  
Do refer here:  https://community.ruckuswireless.com/t5/RUCKUS-Self-Help/How-to-enable-Dynamic-PoE-power-on-the-ICX-switches/m-p/68751 

There however is a third way, that is Hybrid Power Management. 
This is a mix of the above 2 methods and can be achieved by configuring static PM for a few of the ports and dynamic PM for a few of the ports. The way this works to differentiate between the two methods is based on the priority that is set for the specific interfaces, priority of 1 dictate that it uses static PM, as priority of 2 or higher dictates it uses dynamin PM. This priority can be set per interface or globally as well.  

Under this method, after enabling dynamic poe, below settings are needed enable Hybrid PM,
(1) to enable Static PM, use "inline power ethernet unit/slot/port priority 1" on those specific ports. 
Example: in config mode,  
Inline power ethernet 1/1/1 priority 1 
(2) to enable Dynamic PM, use a priority of 2 or 3 instead of 1 on those specific ports. 
Example: in config mode,  
inline power ethernet 1/1/4 priority 2 

Apart from this, there is also Perpetual PoE and Fast Boot PoE.
Perpetual PoE, where PoE power delivery to the equipment is uninterrupted, when the device is rebooting or reloading.  
Fast Boot PoE, where the PoE is delivered as soon as the switch is turned on, where the PD would not have to wait until the system is up.  
To enable this, Use “inline power poe-ha” in interface configuration prompt.  

For Further reading on PoE features on the ICX line-up, Click here,  

Abbreviations used:
PD - Power Device. 
PSE - Power Source Equipment also known as Endspan device. 
PoE - Power over ethernet. 
PoE Injector is also known as Midspan device. 

show commands:
1. show config
2. show running-config
3. show stack
4. show version
5. show chassis
6. show vlan
7. show inline power | inc stack/slot/port)
8. show interface brief
9. show inline power detail
10. show chassis
11. show lldp
12. show lldp neighbors detail ports all (for single port: ports ethernet stack/slot/port)
13. show fdp
14. show fdp neighbors ethernet stack/slot/port
14. show inline power emesg

General information to request:

What Powered Device (PD) types are connecting to the Power Source Equipment (PSE)
i.e. Model number, firmware version, serial number, manufacturer, PoE standard provides up to 15.4 W, PoE+ or PoE plus, provides up to 25.5 W of power?
And/or Power over HDBaseT (PoH), ratified in September 2011, extends PoE’s capabilities to deliver up to 95W?

 This communication is intended for our Partners/Customers who rely on Device Registrar Service (DRS) to onboard devices (AP/Switch) onto Smart Zone Controller.

Please be aware of an upcoming change to the Device Registrar Service (DRS) Public Certificate Issuer. The Public Certificate Issuer is scheduled to be migrated from Entrust to GoDaddy, on March 27, 2024. 

Action Required:

Customers who onboard devices through DRS discovery should whitelist http://ocsp.godaddy.com in their firewalls, so that the devices can OCSP-validate the DRS certificate before performing Controller discovery.

Impact on Customers:

This activity impacts only those Customers who have outbound firewall rules blocking OCSP validation. In such environments devices would fail to discover a controller through DRS service.

FAQs:

• What is the downtime of this activity?
• There is no downtime expected.

• What happens to my devices which are in production?
• There is no impact on devices which are in production or until the devices are rebooted.

• Who and what does it affect?
• Customers who are about to deploy devices already registered or about to be registered in DRS should whitelist http://ocsp.godaddy.com.

If you have any urgent concerns or require immediate assistance, please do not hesitate to reach out to our support team at https://support.ruckuswireless.com/contact-us

Thank you for your continued support.

Sincerely,

Ruckus NOC

https://support.ruckuswireless.com/software 

The advantage of the SZ controller is that if you need to upgrade to the newest version 6.1.1, you can still keep the EOL R600 AP on a separate AP Zone with the firmware 5.2.2 for this zone, while the newer APs are managed in zones with the appropriate version for them.

Need to upgrade de controller? Follow this step-by-step.

Customer Environment

APs and Switches deployed behind a firewall and inbound/outbound traffic needs to be allowed for successful communication between RUCKUS network devices and RUCKUS One.

Symptoms

Newly added APs and switches are in Never Contacted Cloud state, not joining RUCKUS One.

Resolution

To allow RUCKUS One to function properly, please configure your firewall to allow for outbound connectivity according to the following guidelines:
 

Outbound HTTPS (TCP 443) from APs and Switches to:

https://ap-registrar.ruckuswireless.com
https://sw-registrar.ruckuswireless.com
https://ocsp.comodoca.com
https://ocsp.entrust.net
https://ruckus.cloud
https://eu.ruckus.cloud
https://asia.ruckus.cloud
https://device.ruckus.cloud
https://device.eu.ruckus.cloud
https://device.asia.ruckus.cloud
https://storage.googleapis.com
http://ocsp.godaddy.com

Outbound SSH (TCP 22) from APs and Switches to:

device.ruckus.cloud
device.eu.ruckus.cloud
device.asia.ruckus.cloud

Network Requirements

The following list of firewall ports is required to allow APs to enable Cloud discovery and continued connection with the Cloud

Checking the firewall ports is the first step of troubleshooting if an AP is unable to connect to the Cloud or disconnects from the Cloud.

https://docs.cloud.ruckuswireless.com/ruckusone/userguide/GUID-D00EA4CC-7B8A-4F99-969B-2A5FB5DDB178-low.png 

If these information helped you in any way, please click on "KUDOs", so you can help other users.