I have 2 switches within stacking port , Switch A ( master ) Switch B (slave), 

any suggestion good idea how to upgrade frimware without downtime ? all product ICX 7650 

thks so much

In this community article, we will look at the steps involved in setting up Guest Portal authentication via Social Media Login, in this case via Facebook.

Test Environment:  

• SmartZone/Virtual SmartZone [Essentials/High-Scale] (Controller), version 6.1.1.x.
• R350 (Access Point)

Setup Procedure:

• In the vSZ/SZ GUI, navigate to ‘Network -> Wireless LANs’ and select ‘Create'.

Create the Guest WLAN.

Below example using WLAN name as "SOCIAL_MEIDA" and Authentication Type as "Guest Access" and Method as "Open"

Encryption Options is selected as 'Open' (but it can change based on requirement). 

Under Guest Access Portal, select 'Social Media Login'

In 'Social Media Profile' click '+'icon to create the profile

'Name' the social media profile and in Social Auth Option turn 'ON' Facebook and click the 'here' button

It will redirect to the Facebook Developer account.

Alternatively, we can use the https://developers.facebook.com --> My Apps

Next, log in with your Facebook credentials and select 'Create App'

Select App Type as 'Consumer' and provide a name on Display name (Here example is 'Social-Media'). 

Then click 'Create App'

Next in 'Settings' --> 'Basic' update the below information:

1. Privacy Policy URL: https://support.ruckuswireless.com/privacy_policy

2. User data deletion: https://support.ruckuswireless.com/privacy_policy

3. If needed update 'App Icon' and 'Category'

4. Website: https://support.ruckuswireless.com/

Then Add Product --> 'Facebook Login'

In Facebook Login, navigate to Settings and update the below:

1. Valid OAuth Redirect URIs: https://ap.ruckus.com:9998/facebookHandler

2. Login from Devices -> Yes

Next in App Review --> 'Permissions and Features' --> 'public_profile' --> select 'Get advanced access'

Finally, make the App Mode --> 'Live'

Now on SmartZone 'Social Media Profile' the Update the 'Facebook Client ID' and 'Facebook Secret' in Social Auth Option.

Then add the below Whitelisted Domains:

1. *.facebook.com

2. fbcdn-profile-a.akamaihd.net

3. fstatic-a.akamaihd.net

4. *.fbcdn.net

The next step is to create a 'Guest Portal Service' by clicking the '+' icon

Type the 'Portal name' and 'Save' (It can be modified based on requirement).

For this example, all other settings including VLAN assignment for end-user devices are set to the default values.

Next click 'OK'.

This configuration will be good to go ahead with Social media login using Facebook.

Regards,
Francis Borah

In this article, I am going to explain the configuration steps of Social Login Guest Portal authentication with Google.

Network Environment:  

• SmartZone/Virtual SmartZone [Essentials/High-Scale] (Controller), version 6.1.1.0.x.
• R350 (Access Point)

Setup Procedure:

• In the vSZ/SZ GUI, navigate to ‘Network -> Wireless LANs’ and select ‘Create'.

• Name the WLAN, in my setup I named it as ‘SOCIAL_LOGIN’, Authentication Type as "Guest Access" and Method as "Open"

• Encryption Options is selected as 'Open' (but it can change based on requirement). 

• Under Guest Access Portal, select 'Social Media Login'
• In 'Social Media Profile' click '+'icon to create the profile

• Name the social media profile and in Social Auth Option turn 'ON' the toggle for Google and click the 'here' button

• If you click on “here” you will be redirect to Google APIs section of your Google account, login, accept terms of service and click on “+ Create Project”

• Enter Project Name and Location and click on Create.

• Once the project has been created, go to the OAuth consent screen, and select External and click Create

• Under App information, complete the following steps:

• For App name, enter the application name.
• For User support email, select an email address from the list.

• For Developer contact information, enter valid email address and click SAVE AND CONTINUE.

• In the Edit app registration > Scopes page, click SAVE AND CONTINUE.
• In the Edit app registration > Test users page, click SAVE AND CONTINUE.
• On the OAuth consent screen, click PUBLISH APP.

• In the Push to production dialog box, click Confirm.

• Under Publishing status, change the status to In production.

• Go to the Credentials page and click CREATE CREDENTIALS and select OAuth client ID.

• For Application type, select Web application and for Authorized redirect URIs, enter https://ap.ruckus.com:9998/googleHandler or http://ap.ruckus.com:9997/googleHandler

• Click Create. If successful, Google displays the Client ID and Client Secret, as shown in the following figure. 

• The Google Client ID and Google Secret would be automatically filled once the above steps are performed              

• Then add these Whitelisted Domains:*.geotrust.com, *.google.com, *.gstatic.com
• The next step is to create a 'Guest Portal Service' by clicking the '+' icon

• Enter the 'Portal name' and 'Save' (It can be modified based on requirement).

For this example, all other settings including VLAN assignment for end-user devices are set to the default values.

Next click 'OK'.

This configuration will be good to go ahead with Social Media login With Google.

Regards,

Leimapokpam Ambika

To Enable SSO for Administrative Access:

Navigate to Administration >> Settings >> Click on "Setup" below "Enable SSO with 3rd Party provider" 

In the Set Up SSO with 3rd Party Provider page, enter Identity Provider (IdP) Metadata that is provided by the third party. You can paste the IdP Metadata (XML code) or the URL in the IdP Metadata field.

To get the Idp Metadata from Azure, we need to fill in the below 2 fields in the SAML application configuration page:

Syntax: 

Entity ID: https://<REGION, if applicable>.ruckus.cloud/saml2/service-provider-metadata/<tenant ID>
Reply URL: https://<REGION, if applicable>.ruckus.cloud/login/saml2/sso/<tenant ID>

Example:

Entity ID: https://eu.ruckus.cloud/saml2/service-provider-metadata/3e81c1a1bdb34c448e2f53ee4e16b484
Reply URL: https://eu.ruckus.cloud/login/saml2/sso/3e81c1a1bdb34c448e2f53ee4e16b484

Then copy the App Federation Metadata URL under the Section SAML Signing Certificate in your Set up Single
Sign-On with SAML screen of the Azure app that was created to the RuckusOne Setup Page

Reference: https://docs.cloud.ruckuswireless.com/ruckusone/userguide/GUID-DC39C8C4-5DBA-493C-A1C0-FE2A40440FF1.html?hl=enabling%2Csso%2Cthird-party%2Cprovider 

• In this article, we will look into the steps involved in setting up Self Registration Guest Pass Generation in Smart Zone controller running in 6.1 version

Note: This feature is available  since 6.1 version onwards

Network Environment:  

• SmartZone/Virtual SmartZone [Essentials/High-Scale] (Controller), version 6.1.0.x.x
• R710 (Access Point)

Setup Procedure:

• To create SMTP server in the vSZ/SZ GUI, navigate to ‘System->External Services->SMTP’ and turn on the “Enable SMTP Server” toggle, fill the SMTP server details. In my example, I am using gmail server

• Do the test, once it is successful, click on “OK”

• Once the SMTP server has configured, create a “Guest Access Portal”, navigate to “Services & Profiles”-> “Hotspots & Portal” -> “Guess Access” then select the “Create”

• Fill the details, turn on the “Self-registration” toggle and the “Guest Pass SMTP Server”

• Post Guest Access Portal creation, create the WLAN for the Guest Access
• Navigate to “Wireless LANs”-> Select the Zone then click on “Create”

• Name the WLAN, in my setup I named it as ‘Test, Authentication Type as "Guest Access" and Method as "Open"

• Encryption Options is selected as ‘None' (but it can change based on requirement). 

• Under Guest Access Portal, select ‘Guest
• In 'Guest Portal Service’, select the Guest Access Portal profile which we have created from the drop down then click on “OK”

• All other settings including VLAN assignment for end-user devices are set to the default values in my set up

Regards,

Leimapokpam Ambika

Thanks 

I wanted to take a moment to look at spanning tree. By default, ICX switches run 802.1d spanning tree on a per-vlan basis. Ideally, we want to use a protocol with faster convergence such as rapid spanning tree (802.1w). I will go through some general configuration steps and a few best practices. These configurations will not suit all customers, but it is a good starting point for many. 

Enabling RSTP on vlan(s) 

ICX#conf t
ICX(config)#vlan 10 20 30 <--edits three vlans at once. You can edit vlans one at a time or using a range via the 'to' syntax (vlan 1 to 20)
ICX(config-mvlan-10*30)#spanning-tree 802-1w

Now that 802.1w is running, we will want to set a root bridge priority. If no priority is defined, the default of 32768 will be used. Let us assume you want this switch to be the root bridge. A lower priority number wins, so let us go ahead and set it to zero to ensure this switch becomes root bridge:

ICX(config-mvlan-10*30)#spanning-tree 802-1w priority 0

The resulting configuration will look like this:

vlan 10 by port
 tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8
 spanning-tree 802-1w
 spanning-tree 802-1w priority 0
!
vlan 20 by port
 tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8
 spanning-tree 802-1w
 spanning-tree 802-1w priority 0
!
vlan 30 by port
 tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8
 spanning-tree 802-1w
 spanning-tree 802-1w priority 0

Now that our RSTP instances are running, let's take a look at a couple best practices.

Switch-to-switch connections should be defined as point-to-point links to optimize convergence times. In this example, let us assume ports 1/2/1 through 1/2/8 are all switch-to-switch links:

ICX#conf t
ICX(config)#interface ethernet 1/2/1 to 1/2/8
ICX(config-mif-1/2/1-1/2/8)#spanning-tree 802-1w admin-pt2pt-mac

The resulting configuration:

interface ethernet 1/2/1
 port-name Switch-to-Switch-Connection
 spanning-tree 802-1w admin-pt2pt-mac

Switch-to-client (edge) connections should be defined as operational edge ports. In this example, let us assume ports 1/1/1 through 1/1/48 are all client edge ports:

ICX#conf t
ICX(config)#interface ethernet 1/1/1 to 1/1/48
ICX(config-mif-1/1/1-1/1/48)#spanning-tree 802-1w admin-edge-port

Client ports can also have STP BPDU Guard enabled. This will shut down the port if any BPDUs are received on the port. 

ICX#conf t
ICX(config)#interface ethernet 1/1/1 to 1/1/48
ICX(config)#stp-bpdu-guard

The resulting configuration:

interface ethernet 1/1/1
 port-name Client-Port
 spanning-tree 802-1w admin-edge-port
 stp-bpdu-guard

To see RSTP information, you can use the following commands:

ICX#show 802-1w
ICX#show 802-1w detail

Note: If you are running 802.1d, you will use 'show spanning-tree' and 'show spanning-tree detail'. MSTP also has unique commands such as 'show mstp' and 'show mstp detail'

To see all available configuration options for spanning tree, please see our FastIron Layer 2 Switching Configuration Guide:

HTML Version

PDF Version (requires login)

Let us know if you have any questions!

When a 3m DAC cable connection is made in 7150 between port 1/3/1 to 2/3/3

The link remains down, and the two switches will not stack with each other.

Details from Ruckus optic guide:

Link to Ruckus optic guide for reference:

• https://www.commscope.com/globalassets/digizuite/61722-ds-ethernet-optics-family.pdf

Below is link to KBA which briefs about the problem:

• https://support.ruckuswireless.com/articles/000011828

Technical Bulletin link:

• https://support.ruckuswireless.com/technical_support_bulletins/607

Root Cause:
The issue is due to the Security DNS introduced in the IOS. The new IOS versions support security DNS, but our AP's dnsspoof can work for our fixed domain Unleashed.ruckuswireless.com.  When mobile App use this domain to access the master AP, it fails.

Fix:
The issue is addressed in the latest Unleashed version 200.14.6.1.199 and with the new iOS mo
https://support.ruckuswireless.com/software/3780-ruckus-unleashed-ap-200-7-mr-refresh8-software-for-r310
bile app.
You need to upgrade the AP and the IOS app to resolve the issue.

We have also released a 200.7 MR version to fix the issue on older AP models.
Ruckus Unleashed AP 200.7 (MR Refresh8) : 200.7.10.202.145
Check out the release notes for the AP models supported.
https://support.ruckuswireless.com/software/3780-ruckus-unleashed-ap-200-7-mr-refresh8-software-for-r310

Since the mobile app is not working in order to upgrade the AP, you can use the below options to access the AP.
1. Open the browser and access the AP's IP address >> enter the admin credentials >> Upgrade the AP firmware to 200.14.6.1.199
2. Use a PC to access the AP.

Below is the complete steps for accessing the AP from PC:

1. Please connect your laptop/PC to the Unleashed SSID Or to the LAN network where the AP is connected.
2. If you are connecting to LAN, Make sure the Laptop has same IP range as AP’s.
3. Open browser and enter address https://unleashed.ruckuswireless.com Or use AP’s IP address.
4. Login with your Unleashed username and password.
   

    

5. Once successfully logged in go to Admin & Services -> Administration >> Upgrade >> Select the firmware version 200.14.6.1.199 and upgrade.
   Or, you can also use “Local Upgrade” option if you have the 200.14.6.1.199 firmware downloaded from the support site.
   
   
    
   

Regards,
Sanjay Kumar

Boot Loop Process

When a unit is stuck in a boot loop and fails to stabilize, the first step is to console into the unit directly and review the boot process. This can provide insights into why the unit is not booting correctly.

Example Error:

Booting image from Secondary

Wrong Image Format for bootm command

ERROR: can't get kernel image!

could not boot from secondary, no valid image; trying to boot from primary

Booting image from Primary

Wrong Image Format for bootm command

ERROR: can't get kernel image!

1. Console the Unit:
2. Connect to the unit via a console cable and monitor the boot process. Interrupt the boot process by pressing b at the boot counter.

   Ruckus Networks Bootloader: 10.1.26T215 (Nov 29 2022 - 04:42:59)

   Validate Shmoo parameters stored in flash ..... OK

   Restoring Shmoo parameters from flash .....

   Running simple memory test ..... OK

   ICX7450-24 Copper (Non-POE), PVT1

   SYS CPLD VER: 0x10, Released Ver: 0

   Enter 'b' to stop at boot monitor:  3 >>>> Press 'b' to stop the process.

   ICX7450-Boot>

1. Access Boot Mode:
2. Check the installed images using the show_image command.

   ICX7450-Boot> show_image

   ===========================

   Primary  : SPR08095k(33554432)

   Secondary: SPS08095j(31457280)

   ===========================

1. Set Up for Recovery:
2. Connect an Ethernet cable from the management port to the TFTP server.
3. Ensure the device is in boot mode for recovery.

Example:

1. Configure Environment Variables:
2. Set the TFTP server IP and other necessary network settings.

   ICX 7450-48> setenv serverip 10.10.10.21

   ICX 7450-48> setenv ipaddr 10.10.10.22

   ICX 7450-48> setenv gatewayip 10.10.10.1

   ICX 7450-48> setenv netmask 255.255.255.0

   ICX 7450-48> saveenv

• Verify the settings:

   ICX 7450-48> printenv

   baudrate=9600

   ipaddr=10.10.10.22

   gatewayip=10.10.10.1

   netmask=255.255.255.0

   serverip=10.10.10.21

   uboot=ruckus/ICX7450/bootcode/spz10115

   Version:10.1.06T215 (May 15 2015 - 11:28:23)

1. Test Connectivity:
2. Ping the TFTP server to ensure connectivity.
3. Disable the Windows Firewall

   ICX 7450-48> ping 10.10.10.21

   ethPortNo = 0

   Using egiga0 device

   host 10.10.10.21 is alive

1. Update the Flash:
2. Set the image file name and update the flash.

   ICX 7450-48> setenv image_name images/ICX/SPR08090.bin

   ICX 7450-48> update_primary

• For versions below 8080f, update the uboot file.

Provide the file name of the boot image to be copied from the tftp server.

   ICX 7450-48> setenv uboot <xxx.bin>

   ICX 7450-48> update_uboot

1. Boot the Unit:
2. Load the image from the primary or secondary flash.

   ICX 7450-48> boot_primary

Video Link as reference: https://www.youtube.com/watch?v=RHriOYYD_iI

Link as reference : https://docs.commscope.com/bundle/fastiron-09010-upgradeguide/page/GUID-9B5D5A56-039D-44FB-8FD2-B9B55E71ADE8.html

• For ICX-8200 models, boot from the golden image if necessary.

   boot_golden_primary - Flash the Golden UFI Image to Primary and boot from Primary

Name : sysDescr

OID : 1.3.6.1.2.1.1.1

Output / Value (OctetString): Ruckus Wireless, Inc. Stacking System ICX7750-48F, IronWare Version 08.0.90kT201 Compiled on Feb 22 2021 at 23:56:00 labeled as SWS08090k

Name : sysObjectID

OID : 1.3.6.1.2.1.1.2

Output / Value (OID): snFastIronStackICX7750Switch

Name : sysUpTime

OID : 1.3.6.1.2.1.1.3

Output / Value (TimeTicks): 2418 hours 16 minutes 35 seconds (870579500)

Name : sysName

OID : 1.3.6.1.2.1.1.5

Output / Value (OctetString): Superman1

Memory :

Name : snAgGblDynMemUtil

OID : 1.3.6.1.4.1.1991.1.1.2.1.53

Output / Value (Gauge): 14

Name : snAgGblDynMemTotal

OID : 1.3.6.1.4.1.1991.1.1.2.1.54

Output / Value (Gauge): 3853291520

Name : snAgGblDynMemFree

OID : 1.3.6.1.4.1.1991.1.1.2.1.55

Output / Value (Gauge): 3246243840

Hardware :

CPU :

Name : snAgGblCpuUtil1SecAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.50

Output/ Value (Gauge): 1

Name : snAgGblCpuUtil5SecAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.51

Output/ Value (Gauge): 1

Name : snAgGblCpuUtil1MinAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.52

Output/ Value (Gauge): 1

Power supply :

Without Stacking

Name : snChasPwrSupplyIndex

OID  : 1.3.6.1.4.1.1991.1.1.1.2.1.1.1

Output / Value (Integer): 1

Name : snChasPwrSupplyDescription

OID : 1.3.6.1.4.1.1991.1.1.1.2.1.1.2

Output / Value (OctetString): Power supply 1 (AC - Regular) present, status ok

       Model Number:  BRCD-10G

       Serial Number: CUB2V34L06M

       Firmware Ver: 2.1

Name : snChasPwrSupplyOperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.2.1.1.3

output / Value (Integer): normal (2)

With Stacking :

Name : snChasPwrSupply2Unit

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.1

Output :

Name/OID: snChasPwrSupply2Unit.1.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Unit.2.1; Value (Integer): 2

Name/OID: snChasPwrSupply2Unit.3.1; Value (Integer): 3

Name : snChasPwrSupply2Index

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.2

Output :

Name/OID: snChasPwrSupply2Index.1.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Index.2.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Index.3.1; Value (Integer): 1

Name : snChasPwrSupply2Description

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.3

Output :

Name/OID: snChasPwrSupply2Description.1.1; Value (OctetString): Power supply 1

Name/OID: snChasPwrSupply2Description.2.1; Value (OctetString): Power supply 1

Name/OID: snChasPwrSupply2Description.3.1; Value (OctetString): Power supply 1

Name : snChasPwrSupply2OperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.4

Output :

Name/OID: snChasPwrSupply2OperStatus.1.1; Value (Integer): normal (2)

Name/OID: snChasPwrSupply2OperStatus.2.1; Value (Integer): normal (2)

Name/OID: snChasPwrSupply2OperStatus.3.1; Value (Integer): normal (2)

Fan

Without stacking :

Name : snChasFanIndex

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.1

Output :

Name/OID: snChasFanIndex.1; Value (Integer): 1

Name/OID: snChasFanIndex.2; Value (Integer): 2

Name/OID: snChasFanIndex.3; Value (Integer): 3

Name/OID: snChasFanIndex.4; Value (Integer): 4

Name : snChasFanDescription

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.2

Output :

Name/OID: snChasFanDescription.1; Value (OctetString): Fan 1 (from left when facing back side)

Name/OID: snChasFanDescription.2; Value (OctetString): Fan 2 (from left when facing back side)

Name/OID: snChasFanDescription.3; Value (OctetString): Fan 3 (from left when facing back side)

Name/OID: snChasFanDescription.4; Value (OctetString): Fan 4 (from left when facing back side)

Name : snChasFanOperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.3

Output :

Name/OID: snChasFanOperStatus.1; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.2; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.3; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.4; Value (Integer): normal (2)

With stacking

Name : snChasFan2Unit

OID : 1.3.6.1.4.1.1991.1.1.1.3.2.1.1

Output :

Name/OID: snChasFan2Unit.1.1; Value (Integer): 1

Name/OID: snChasFan2Unit.1.2; Value (Integer): 1

Name/OID: snChasFan2Unit.1.3; Value (Integer): 1

Name/OID: snChasFan2Unit.1.4; Value (Integer): 1

Name/OID: snChasFan2Unit.2.1; Value (Integer): 2

Name/OID: snChasFan2Unit.2.2; Value (Integer): 2

Name/OID: snChasFan2Unit.2.3; Value (Integer): 2

Name/OID: snChasFan2Unit.2.4; Value (Integer): 2

Name/OID: snChasFan2Unit.3.1; Value (Integer): 3

Name/OID: snChasFan2Unit.3.2; Value (Integer): 3

Name/OID: snChasFan2Unit.3.3; Value (Integer): 3

Name/OID: snChasFan2Unit.3.4; Value (Integer): 3

When a user goes through enrolment and gets a DPSK. When they then use that DPSK each device shows up as AccountDPSK-xxxxxx for the username:

Since the user went through an enrollment, CloudPath knows the username and we can use a POLICY to return the username attribute.

1. Create a RADIUS Attribute Group that associates the RADIUS value “User-name” to the variable ${USERNAME} make sure to modify the assignment behavior to add or replace:
2. Create a POLICY that returns that attribute:
3. Apply that POLICY to the DPSK pool:

    

During the next auth of that device, the returned value of the variable ${USERNAME} will be visible in the controller:

Thanks.

One of the frame's flows that affect the overall performance of the wireless network is the retransmission rate (a frame is retransmitted when the delivery was not acknowledged or it's reported as corrupted), excessive frame retransmission forces the client-AP to negotiate lower data rates for the communications, causing greater delay and higher airtime utilization.

How can I tell if the retransmission rate is high?

• From the AP support log. 

----------------------- Host/Target Tx Stats ----------------------
RKS stats magic: cafe0001
421200 MSDUs success(msdus_success)
4582766 MPDUs success(mpdus_success)
632 tx completions delivered(comp_delivered)
7828618 Tx HW queued(hw_queued)
7828618 Tx HW reaped(hw_reaped)
188 Tx MAC underrun(underrun)
1424910 Tx HW paused(hw_paused)
3290623 Tx seq posted(seq_posted)
740 Tx mu seq posted(mu_seq_posted)
72066 Tx seq failed(seq_failed_queueing)
1342284 MPDUs requed(mpdu_requed)
5925004 MPDUs tried(mpdu_tried)
2748 MPDUs sw_flush(mpdus_sw_flush)
19468 MPDUs truncated(mpdus_truncated)
1324450 MPDUs block ack_failed(mpdus_ack_failed)
568 MPDUs expired(mpdus_expired)
2654643 excess retries(tx_xretry) ------------------------> very high 'tx_xretry'
902025741 sched self trig(self_triggers)
116763 ampdu retry failed(sw_retry_failure)

Excessive retries can be directly related to PHY errors:

------------ Host/Tgt Rx Stats ------------
34066065 PPDUs Rx from HW(htt.ppdu_recvd)
31502324 MPDUs Rx OK(htt.mpdu_cnt_fcs_ok)
2602746 MPDUs Rx Err(htt.mpdu_cnt_fcs_err)
2696712 MPDUs dropped in FW ring(htt.fw_ring_mpdu_drop)
2599042 local mgmt Rx(pdev_local_buffer_stats.local_reaped)
63379830 Rx PHY errors(rx_phyerr) ---------------------------------> very high 'rx_phyerr'
34073621 Rx MPDU errors(rxdesc_err_att)
2599027 Rx MPDU FCS errors(rxdesc_err_fcs)

• From Wireshark.

Collect a packet capture on the specified wireless interface of the AP by selecting the AP and then click 'More'>Packet Capture.

In the Packet capure page, select the appropiae radio you want to monitor and the option 'save to file'. Click 'Start' to begin to capture and then 'Stop' to stop the capture. When the file is ready, the 'Download' option will appear for you to download the file.

Once you have got the pcap file, then you can look for the 'Retry' flag on the 802.11 information of the frame.

Right click and 'Apply as Filter>Selected to fiter out the all the retransmitted frames:

This is the wireshark filter for the retry flag in the frames.

wlan.fc.retry == 1

Check the total amount of packets in the file vs. the number of packets displayed and then you will have a meassure of the retransmission rate of the packets captured in the specific lapse. In our example, we have a 10% of retransmission rate.

We can see, for our example, the probe response from the AP was retrasmitted many times, which means  -most likely- the client never received it. This could have ended on a client unable to connect to the wireless network or maybe just connecting to the next available AP -no usually the closest one-.

What are the causes of high retransmission rates and how can I address them?

1. non-wifi interference. Identify the source of the interference and shut it down -if it's under your administration- or relocate the AP if the interference cannot be disabled.
2. wifi interference (co-channel or adjacent channel). Review the channel plan and choose a channel selection option that best services your enviroment.
3. hidden nodes. Reduce the cell size or relocate the AP.
4. poor signal to noise ratio. Identify the sources of the most noise signals and reduce/disable them -if it's under you administration- or relocate the AP if the interence cannot be reduced.
5. bad coverage configuration. Relocate the APs, add more APs or increase the cell size.

In 8200, The Switching image was deprecated with 10.0 and each platform will only use one image starting with 10.0.

ALL the L3 image support L2 features starting with 10.0, Only routing image are available for all supported models.
Switching features are still available in the routing image.

>The 8200 by design doesn't support l2 image so there is no ip default-gateway command.

>Instead we need to specify the route to forward the traffic to an external subnet. We can either use static routes, default routes or a routing protocol.

>If you want to use the ICX8200 switch as a L2 device follow the below steps:

You just need to add a default route to the device, And then add the VLANs you want. The ICX8200 model can only run L3 firmware images. That's why we need to add a default route for it to start behaving as an L2 switch, where it is only passing VLAN traffic in and out. We also need to identify the VLAN where this default route communication goes through. And then create a virtual interface and assign the IP that will be used for management and for communication with the default gateway.

Example:

-Create the virtual interface and assign the IP form MGMT and default route:

ICX8200-switch#conf t
ICX8200-switch(config)#vlan 10
ICX8200-switch(config-vlan10)#interface ve 10
ICX8200-switch(config-if-ve10)#ip address 10.10.10.2/24

Here's the command for the default route:

ICX8200-switch#conf t
ICX8200-switch(config)#ip route 0.0.0.0/0 10.10.10.1 (IP address of your ICX7850 router, which is the default gateway for the management vlan)

ICX8200 with the code 10.00, this code only came in routing, so you can configure the IP address under a VE, loopback or port.

Beginning with the 09.0.00 release, when a VLAN is configured, a virtual routing interface is statically mapped to the VLAN ID. However,
only when you issue the interface ve-num command does the virtual interface get created.

Please refer to the below link of the L3 Routing configuration Guide under Subheading "Assigning an IPv4 Address to an Ethernet Port"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

Please refer to the below link of the L3 Routing Configuration Guide under Subheading "Assigning an IP address to a virtual interface"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

Please refer to the below link of the L3 Routing Configuration Guide under Subheading "Assigning an IP address to a loopback interface"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

• Network connectivity issues
• Master AP election problems 
• Potential hardware failures
• Assessing controller connection status 

It's important to note that the presence and functionality of LED lights on a Ruckus AP can vary depending on the specific model and series. However, most Ruckus APs feature the following five LED indicators: PWR, CTL, AIR, 2.4G, and 5G.

PWR (Power Indicator):

Solid RED: Bootup in progress.

Flashing Green: AP firmware image booted. No routable IP received or assigned.

Solid Green: Routable IP address received.

CTL/DIR (Control/Direction Indicator):

Off: AP is a RUCKUS Unleashed member AP.

Slowly Flashing Green (every 2 sec): RUCKUS Unleashed Master AP discovery in progress.

Fast Flashing Green (twice a sec): Receiving configuration or image upgrade.

Solid Green: AP is the RUCKUS Unleashed Master.

AIR (Mesh indicator:)

Off: AP is operating in standalone or Root or non-Mesh AP        

Solid Green: AP is functioning as Mesh AP (MAP)        

Blinking Solid Green (2 Hz): AP is functioning as Mesh AP (MAP)        

Blinking Solid Green (0.5 Hz):         

2.4G (WLAN Service Indicator):

Off: The WLAN service is down.

Green: The WLAN is up, and at least one client is associated.

Amber: The WLAN is up, but no clients are associated.

5G (WLAN Service and Mesh Downlink Indicator):

Off: The WLAN service is down.

Green: The WLAN is up, and at least one client is associated. No downlink MAPs are connected.

Slow Flashing Green (one flash every two seconds): The WLAN is up, and at least one downlink MAP is connected. No clients are associated.

Fast Flashing Green (two flashes every second): The WLAN is up, at least one downlink MAP is connected, and at least one client is associated.

More info about the LEDs can be found here: https://docs.commscope.com/bundle/unleashed-200.10-troublshootingref/page/GUID-738984DA-2A47-4E71-A690-B6DF9023AA50.html

```
Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, insert_field_to_upgrade_ap_list(): firmware_file open failure
Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, get_ap_list(): see [/tmp/unleashed_upgrade/upgrade_ap_list_from_election.xml.ready], ap-list ready!
Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, get_ap_list(): ap-list loop 0.
```

That's my first problem with it. My second problem is that it won't negotiate 802.3at (POE+) no matter what I try. I'm powering it with a Juniper SRX320-POE, and I have enabled POE negotiation on the source but it still recognizes it as a "802.3af Switch/Injector":

```
ruckus(ap-mode)# get power-mode
PoE Configured Mode : Auto
Power Consumption Status : 802.3af Switch/Injector
USB Status : Disabled
OK
```
Forcing it to use POE+ with `set power-mode at` works, but doesn't persist after reboot.

Finding what the log messages mean has been a big pain as documentation that refers to it is almost non-existent.

Thank you

I have a Ruckus R650 [901-R650-US00] running Ruckus Unleashed (200.16.7.0.402) and the Web UI is broken. Though it loads up initially just fine, whenever I try to edit a Wi-Fi network or click on the "access points" section it just loads an empty grey screen. Here are some relevant logs that I found in the syslog:

Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, insert_field_to_upgrade_ap_list(): firmware_file open failure
Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, get_ap_list(): see [/tmp/unleashed_upgrade/upgrade_ap_list_from_election.xml.ready], ap-list ready!
Sep 6 13:10:11 prd-radio syslog: upgrade_debug: pid=5161, get_ap_list(): ap-list loop 0.

I have another problem with it not negotiating 802.3at (POE+) no matter what I try. I'm powering it with a Juniper SRX320-POE, and I have enabled POE negotiation on the source but it still recognizes it as a "802.3af Switch/Injector":

ruckus(ap-mode)# get power-mode
PoE Configured Mode : Auto
Power Consumption Status : 802.3af Switch/Injector
USB Status : Disabled
OK

Forcing it to use POE+ with `set power-mode at` works, but doesn't persist after reboot.

Finding what the log messages mean has been a big pain as documentation that refers to it is almost non-existent.

Thank you

1. Client Connection Troubleshooting

Link as reference https://docs.commscope.com/bundle/unleashed-200.16-troublshootingref/page/GUID-5BBF52D0-939D-416F-B696-FABB12AC5EE9.html

This is a demonstration for the client troubleshooting.

Select Clients, and then click the Troubleshooting button.

Figure 1: Clients Tab

Here, we can enter the MAC address of the client device in the specified format to begin troubleshooting process. If the device is already connected to the network, simply click on it, and the troubleshooting process will begin automatically.

Figure 2: Troubleshooting button.

Identify the MAC Address: Obtain the MAC address of the client device you want to analyze. Ensure you have this information handy as it will be used to filter the capture.

Input the MAC address of the client device into the designated filter.

Click the Start button to begin the troubleshooting.

In this demonstration I will use the following Mac-address for one of my Wireless clients 62:b6:b1:eb:09:89

Figure 3: Start Troubleshooting Process

Once you click Start, no data will be displayed initially because the device has not yet connected to the network or attempted to connect to any of the AP's SSIDs.

Figure 4: Troubleshooting Process

In this example, I will attempt to connect my end client to the SSID of the Access Point and intentionally use an incorrect password.

Figure 5: Initial Packet Capture View

First, we will analyze what we are observing firsthand during this test. We can identify which Access Point the end device is connecting to, the band it is using (whether 2.4 GHz or 5 GHz), and in this case, it is 5 GHz on channel 157. Additionally, we can observe the environmental SNR and the timestamp of the events according to the Access Point's log.

Now we will analyze the packets exchanged between the end client and the Access Point.

Figure 6: Analysis of Packet Exchange Between Client and Access Point

The client device initiates the connection by sending authentication and association requests, which the AP responds to. During the 4-way handshake, each attempt fails repeatedly, suggesting there is an issue. After multiple failures, the AP deauthenticates the client, ending the connection attempt.

Figure 7: Final Analysis - Client Failed Handshake

When the Information button on the error is pressed, it often provides a suggested error code and status, which can also be copied for reference. In this example, the tool indicates an "invalid passphrase" error, accurately reflecting the intentional use of an incorrect password for testing purposes. This tool is highly effective for troubleshooting connectivity issues, as it provides insights into client behavior during the authentication process, in roaming scenarios, and across various other network situations.

2.    Capturing Remote Packets

Remote packet capture enables one or more APs to operate in packet sniffer mode, allowing them to capture wireless packets on the network. These packets can either be saved locally on the device or streamed in real time to a packet analysis tool, such as Wireshark, for detailed inspection and troubleshooting. This feature is valuable for diagnosing connectivity issues and monitoring network performance by analyzing the captured packet data.

Link as reference https://docs.commscope.com/bundle/unleashed-200.16-onlinehelp/page/GUID-FE747C7C-8F63-409B-A423-63F898CA8331.html

Go to Admin & Services > Administration > Diagnostics > Packet Capture.

Figure 8: Packet capture tab

In this section, we will find the Access Points in our network, along with their model, device name, and corresponding IP address.

To troubleshoot the client connectivity issue, select the desired APs, and then choose Add to Capture. This action will move the APs to the Capture APs table.

Figure 9: Selecting the Access Point for the Packet Capture

For Radio, select either 2.4 GHz or 5 GHz/6 GHz. In this case, since we are working with a 5 GHz connection, select the 5 GHz option.

You can Select Local Mode or Streaming Mode as the capture mode:

+To capture a limited snapshot on each AP, select Local Mode.
+To stream the captured packets directly to Wireshark for real-time analysis, select Streaming Mode.

In this example we are going to select Local Mode.

In this example, since the MAC address of the problematic device is known, enter it to filter the capture data specifically for that client. Click Start to begin capturing packets. At this stage, reproduce the issue. Once the issue has been reproduced, click Stop to end the capture.

Figure 10: Initiate the Packet Capture

Then click Save to store the packet capture as a local file for later analysis.

Figure 11 : Downloaded PCAP from the Unlashed UI.

Once the file is downloaded, it will be saved in the Downloads folder. Extract the contents, and you’ll find folders containing the PCAP files. These files include detailed information on the association process for the end client , which will help you investigating if there is any incidents.

Note : Remember to remove the AP from the capture list and disable packet capture after completing this process.

By analyzing the packet exchange during the connection process, you can pinpoint where the failure occurs and take appropriate corrective actions. This method provides valuable insights into the interaction between client devices and APs in real time.

Unleashed Overview

In an Unleashed network, a RUCKUS Unleashed 'Master' Access Point acts similarly to a controller, managing all control functions. These settings are then propagated to the other APs in the network. If the Master AP go offline, a 'Member' AP will automatically take on the role of the Unleashed Master, assuming control and maintaining network operations.

Unleashed Support

-Bridge mode 128 APs and 2,048 clients.

-Gateway mode supports up to 25 APs and 512 clients.

-Dedicated Master

Overview Limitations from Zone Director

-IPv6 is not supported.

-No interface to communicate with SmartCell Insight analytics engine or SPoT location.

-No Northbound Interface to pass client authentication responsibility to an external entity.

-No WLAN groups.

What are the necessary conditions or prerequisites for an access point to successfully connect to an existing Unleashed network?

Connect the Member Access Point (AP) to the network, ensuring it is on the same VLAN as the Master AP. Upon powering up, the Member AP will engage in an election to determine if a Master already exists. It's important that the Member AP either matches or has a lower firmware version than the Master.

Additionally, it must be able to ping the Master AP and share the same country code setting.

Commands to check if a member Access Point is not joining to the Unleashed Network.

•  ping < Master_AP>
•  get version 
•  get boarddata : Display hardware version and system board information
•  get discovery-agent: Check if LLWAP protocol is enable.
• get countrycode :
• get director : show Master AP information.
• get election: shows the status of all Unleashed APs
• get syslog log

The same information can be collected on the Master AP.

• Ping <Member_IP>
• get version 
• get countrycode 
• get boarddata 
• get election 

Ruckus CLI on unleashed when SSH to the Access Points.

The 'ruckus>' CLI prompt indicates you are logged into the 'Master' Access Point. From here, you can navigate through various configuration modes to manage settings and preferences.

Enable:

ruckus#

Under enable mode we can go to different modes example:

ap-mode: Note under this mode you can run set-get commands.

ruckus(ap-mode)#

Config

ruckus(config)#

Under config there are some different modes

+Admin:

ruckus(config-admin)#

+System:

ruckus(config-sys)#

+Using the Mac-address of the AP: 

ruckus(config)# ap d4:bd:4f:01:bc:10
The AP 'd4:bd:4f:01:bc:10' has been loaded. To save the AP, type 'end' or 'exit'.
ruckus(config-ap)#

The 'rkscli:' prompt indicates that you are logged into a 'Member' Access Point. In this CLI, you can execute 'get' or 'set' commands to retrieve or configure the Access Point settings. For example:

Best Regards 

Fernando Vasquez 

In this community article, we will look at the steps involved in setting up Guest Portal authentication via Social Media Login, in this case via LinkedIn.

Question:

How is this different from traditional Guest Access authentication methods?

• This method is designed for authenticating guest users logging in through the captive portal with their Social Media Accounts, such as Google, Facebook, LinkedIn and Twitter.

       Note: Guests must re-authenticate after the session ends.

Customer Environment:  

• SmartZone/Virtual SmartZone [Essentials/High-Scale] (Controller), version 6.1. 0.0.935.
• R610 (Access Point)

Setup Procedure:

• In the vSZ/SZ GUI, navigate to ‘Security – Authentication’ and select ‘Non-Proxy (Social Login).

• Select your AP zone from the left-hand side menu and click on the ‘Create’ button.

• Provide a name for your ‘Social Media Login Profile’. In this example, this is called ‘RuckusLinkedin’.

• Select the click ‘here’ button to generate your LinkedIn Client ID and LinkedIn Secret.

• This action will redirect you to your LinkedIn Developers account, which you will need to create your custom app. The URL is https://www.linkedin.com/developers/login.
• Once authenticated to your LinkedIn account, please select the ‘Create App’ button under the ‘My Apps’ menu.

• The first step to creating your own app is to provide an ‘App name*’ as shown in the image below. In this example, this is named ‘RuckusLinkedIn’. 

• Next, select a “LinkedIn Page*” associated with your organization. In this test case, this is ‘Ruckus Networks’.

• Next, we can upload a custom logo as required in the ‘App logo*’ section of the same page.
• Use the ‘Upload a logo’ button.

• The privacy policy URL is optional, and, in this example, this is left untouched.
• Accept the ‘Legal Agreement’ and then click on the ‘Create App’ button.

• The created app is now visible as seen below. Click on the ‘Verify’ button to complete the App verification process.

• In the next window, click on the ‘Generate URL’ button under the ‘Verification URL’ tab.  

• Click on the ‘I’m done’ button in the next window to complete the verification.

• Select the ‘Auth’ tab and add the ‘Redirect URL’ for LinkedIn under the ‘Authorized redirect URLs for your app’ section.  
• The redirect URL for LinkedIn is ‘https://ap.ruckus.com:9998/linkedinHandler’.
• Click on ‘Update’ to complete this configuration.

• Select the ‘Products’ tab and select the ‘Sign In with Linkedin’ product.

• Complete this step by accepting the ‘Legal Agreement‘ and finish by clicking the ‘Add product’ button as shown below.

• The ‘Added Product’ is now visible in the ‘Added Products’ section as shown below.

• Select the ‘Auth’ tab and copy the ‘Client ID’ and ‘Client Secret’.

• Input the copied ‘Client ID’ and ‘Client Secret’ onto the ‘Social Auth Options’ in the SZ/vSZ GUI.

• Add the following domains to the list of the ‘Whitelisted Domain’ in the ‘Create Social Media Login Profile’.
• *.linkedin.com
• *.licdn.com

• Next step is to create a ‘Guest Access’ portal under for our Guest users, under Services.

• In this example, this is named “Guest_portal_123”. Click ‘Ok’ to save the Guest Access portal configuration.

• Next, create the concerned ‘Guest Access’ WLAN for our Guest users.
• In this example, the WLAN is named ‘Guest_Access_123’.
• Select the following parameter for Authentication Options - Guest Access.
• Select the required ‘Encryption Options’. In this example, WPA2 & Passphrase is deployed. 

• Under ‘Guest Access Portal’ section in the ‘Create WLAN Configuration’ window select ‘Guest Access/Social Media Login’ and assign the ‘Social Media profile’ and ‘Guest Portal Service’ previously configured.  

• For this example, all other settings including VLAN assignment for end-user devices are set to the default values.
• Now, click ‘OK’.

Sample of client login page:

In this article, I will explains an issue with customer DHCP configuration (related to DNS Domain name) which can potentially cause AP connectivity issue with RUCKUS Cloud.

Symptoms

• If you hit this issue, AP may show online but as soon as you make any configuration changes on venue, AP, WLAN, it will result AP state changing to "Never contacted Cloud".

• AP will not show any new event, since the time of its last successful connection to Cloud.
  In some cases AP will also show in "Operational -  applying configuration" state on Cloud UI and will never complete applying configuration.

• AP will still serve clients with last known configuration (if AP was not rebooted).

How to troubleshoot?

• Run a capture on switch port where AP is connected and reboot the AP.
  Note: This will not help if AP is configured with static IP configuration.
• Check the uplink packet capture and analyze (look at the DHCP Offer frame) the DHCP packets for the DHCP process.
• You will see DHCP server sending DNS domain name information.

• When Domain Name is added to the DHCP and configured on AP, AP will append the AP-Cloud discovery URL which is device.ruckus.cloud to device.ruckus.cloud.xyz.com. Because of this change in Cloud URL, AP will not be able to reach the correct controller IP (usually DNS resolution will fail) and will eventually fail to connect to Cloud.
• In case domain specific URL (in this case "device.ruckus.cloud.xyz.com") has a valid DNS entry on customer/public DNS server, it will further result in connection failure as resulted IP address will not match with the correct Cloud controller IP address.
• You can also factory reset one AP and then SSH into it (with default credentials super/sp-admin), run below commands to confirm if AP is getting the DNS Domain name configuration from DHCP.
• Run and review the output of "get dns" command.
• Output when DNS Domain name is received from DHCP server.
  

  rkscli:
  rkscli: get dns
  Allow DNS from DHCP: Enabled
  Ethernet DNS servers:
  DNS 1 : 8.8.8.8
  DNS 2 : 8.8.4.4

  IPv6 DNS Setting

  DNS Domain
  <None>

  DNS Search List
  <None>
  OK

• Output when DNS Domain name is received from DHCP server

  rkscli:
  rkscli: get dns
  Allow DNS from DHCP: Enabled
  Ethernet DNS servers:
  DNS 1 : 8.8.8.8
  DNS 2 : 8.8.4.4

  IPv6 DNS Setting

  DNS Domain
  xyz.com

  DNS Search List
  <None>
  OK

Resolution

While issue is impacting RUCKUS APs, this is completely an issue caused by customer DNS and/or DHCP server configuration.

Follow below steps to fix the issue.

• Check and remove the domain name configuration from DHCP IP pool which is used for RUCKUS Access points.
• Just updating the configuration on DHCP server may not fix APs as APs will still hold old IP which has valid lease time. In this case you may reboot the AP so that AP can get the fresh IP lease from DHCP server without DNS domain name. Also clearing the IP lease from DHCP server can help.
• Even after rebooting or re-requesting IP from DHCP if issue is not solved, remove the AP from the Cloud and re-add.
• If you continue seeing issue even after fixing the DHCP configuration, please contact RUCKUS Support and report the issue.

I hope this will help!

Got any queries? Start the conversation!

Port mirroring is an effective network traffic monitoring technique. It involves duplicating each packet entering or leaving a specific port on a network switch and sending this copy to another port for analysis. This technique is particularly useful for diagnostic and debugging purposes, as well as for enhancing network security.

To set up port mirroring, you designate a 'monitor port' from which packets are copied, and a 'mirror port' that receives these copies. Both incoming and outgoing packets from the monitor port are sent to the mirror port. A network analysis tool, like Wireshark, can then be connected to the mirror port to capture and analyze the traffic. This process allows for detailed examination of data packets without interfering with the normal operation of the network.

Standalone(config)# mirror-port ethernet x/x/x - This command designates the connection to the analyzer tool.
Standalone(config)# interface ethernet x/x/x - This command selects the specific interface from which data capture is desired.
Standalone(config-if-e1000-x/x/x)# monitor ethernet x/x/x both - This command establishes the monitoring of the specified interface and directs the traffic to the analyzer tool.

Verification of Configuration:

To verify the configuration, use the "show mirror" command. This will display the current mirror configuration, confirming the setup for traffic capture and analysis.

Here is an example using the given topology. Our objective is to capture traffic from port 1/2/1 and redirect it to an analyzer tool connected to port 1/1/1, where Wireshark is installed.

Device(config)#mirror-port ethernet 1/1/1
Device(config)#interface ethernet 1/2/1
Device(config-if-e25000-1/2/1)#monitor ethernet 1/1/1 both

Device(config-if-e25000-1/2/1)#show mirror
Mirror port 1/1/1
  Input monitoring      : (U1/M2)   1
  Output monitoring     : (U1/M2)   1

For additional details, please refer to our guides :

Official Guide Port Mirroring and Monitoring Configuration:

https://docs.commscope.com/bundle/fastiron-10010-monitoringguide/page/GUID-7165A5D9-141A-4F23-9965-2940D12A672E.html

Official Guide Configuration Notes for Port Mirroring and Monitoring:

https://docs.commscope.com/bundle/fastiron-10010-monitoringguide/page/GUID-8CDDEB0F-08D9-41A9-9681-B3C05D315BD7.html

Monitoring an Individual LAG Port:

https://docs.commscope.com/bundle/fastiron-08095-monitoringguide/page/GUID-35140D88-386B-438B-A700-59AFDE2297B7.html

Best Regards 

Fernando Vasquez 

1- Make sure the server has the necessary basic features installed.

2-Navigate to the Network Policy Server tab, access NPS (local), and choose the 'Radius server for 802.1x' option for both wireless and wired connections. Finally, select 'Configure 802.1x'

3-In this step, select 'Secure wireless connections' and customize the policy name to your preference. In this case, append 'DEMO' at the end of the policy name.

4-In this step, you need to configure the Radius Client by providing a friendly name, entering the IP address of the master Access Point, and optionally setting a password or using a password generation tool. Remember to save this configuration as it will be used in Step 9.

5-In this step, choose 'Microsoft Protect EAP (PEAP)' as the network access method

6- Next, leave the remaining options at their default settings, and conclude the configuration by clicking on the 'Finish' button.

7-Configure the “Connection Request Policies”

To configure the connection request policy, navigate to the 'Policies' section. Then, access the 'Connection Request Policy' folder and locate the policy is created with the same name. Double-click on it to access its properties. In the 'Properties' window, navigate to the 'Conditions' tab. Remove the 'Current' condition and any others if present. Add the 'Time' condition and select 'Permit all time'. Finally, click 'Apply' and then 'OK' to save the changes.

8-Configure Network policies

To configure the Network Policies access to “Network Policy” folder and locate the policy is created on the folder and locate the policy is created with the same name. Double-click on it to access its properties. In the 'Properties' window for this example, I choose to ignore the user properties dial and proceed to the 'Conditions' section. Here, I add the 'User Groups' option to use the Active Directory users.

In this part, you have the option to either use an existing group and its users or create a new group along with its users.

Optional step

How to create a group and users

Open Active Directory Users and Computers, then select the domain used in this case, cslab12.com. Navigate to the 'Users' folder, right-click on it, and choose 'New' > 'Group.' Finally, enter the required information

Reference : https://docs.commscope.com/bundle/sz-700-accessservicesguide-sz300vsz/page/GUID-D9E129C3-A6AF-433F-ABA3-81BD8A1CCA91.html

How to create an user

Navigate to the Active Directory of users and computers, then left-click on it. Next, select 'New,' followed by 'user’, and proceed to fill in the required information (username and password ).

In this case, we need to edit the 'Member of' properties of this user. Since I want this user to belong to the earlier created 'DEMO' group, we navigate to the user's properties, specifically the 'Member of' section. Subsequently, we add the group and configure it as the primary group.

Continue with the network policies configuration next, we will select the desired group and proceed to the 'Constraints' tab. Here, we will add CHAP as the authentication method.

9-Unleashed Configuration

In the Unleashed configuration, navigate to 'Admin and Services' and then 'Services.' Click on the plus (+) sign to add the RADIUS server and fill in the information based on the configuration we completed in Step 4. Ensure that the IP address points to the RADIUS server.

10- WLAN Creation

Navigate to 'Wi-Fi Networks' and select the tab for creating a wireless network. Fill in the necessary information accordingly. In this step, the only addition is to include the server that we created in Step 9 as the authentication server.

11-Wireless Client

After creating the wireless network, it's important to check the connectivity. Connect to the network and when prompted, enter the credentials of the created DEMO-USER along with the corresponding password. If the credentials match, you should be able to connect to the network without any issues.

Command “aaa authentication login privilege-mode” was removed in 9010 and 10.0.00 versions.

This command was missing in certain 9010 and 10.0.0 versions. Below is the example the output looked like.

ICX7850-48FS Router(config)#aaa authentication login

  default   The default authentication list

In the above output it is noticed that privilege mode option is missing.

Solution:

This command was added back in version 9010h and below is a example from lab output where 7650 switch is running on 9010h version

ICX7650_test(config)#aaa authentication login

  default          The default authentication list

  privilege-mode   Take user to privilege mode after successful authentication

ICX7650_test(config)#aaa authentication login privilege-mode 

For 8200 switches this command was added back in version 10.0.10b and above and below is an example

ICX8200_test(config)#aaa authentication login

  default          The default authentication list

  privilege-mode   Take user to privilege mode after successful authentication

If you are looking to enable privilege mode on the switch and switches are on 9010 and 10.0.00 versions then they would need a upgrade to 9010h and above or 10.0.10b and above.

Run “show ip ssh config” to view all SSH details.

Device#show ip ssh config

SSH server                 : Enabled

SSH port                   : tcp\22

Host Key                   : RSA 2048

Encryption                 : aes256-cbc, aes192-cbc, aes128-cbc, aes256-ctr, aes192-ctr, aes128-ctr, 3des-cbc

Permit empty password      : No

Authentication methods     : Password, Public-key, Interactive

Authentication retries     : 3

Login timeout (seconds)    : 120

Idle timeout (minutes)     : 5

SCP                        : Enabled

SSH IPv4 clients           : All

SSH IPv6 clients           : All

SSH IPv4 access-group      :

SSH IPv6 access-group      :

SSH Client Keys            :

Client Rekey               : 0 Minute, 0 KB

Server Rekey               : 0 Minute, 0 KB

To disable weak SSH cipher:

The diffie-hellman-group1-sha1 key exchange method is a weaker algorithm and can be disabled using the “no ip ssh key-exchange-method dh-group1-sha1” command.

Command:

• Device(config)#no ip ssh key-exchange-method dh-group1-sha1

To disable CBC encryption mode:

Command:

• Device(config)# ip ssh encryption disable-aes-cbc

Output after disabling CBC encryption mode:

ICX7150-24F Switch(config)#show ip ssh config

SSH server                 : Enabled

SSH port                   : tcp\22

Host Key                   : RSA 2048

Encryption                 : aes256-ctr, aes192-ctr, aes128-ctr

Permit empty password      : No

Authentication methods     : Password, Public-key, Interactive

Authentication retries     : 3

Login timeout (seconds)    : 120

Idle timeout (minutes)     : 5

SCP                        : Enabled

SSH IPv4 clients           : All

SSH IPv6 clients           : All

SSH IPv4 access-group      :

SSH IPv6 access-group      :

SSH Client Keys            :

Client Rekey               : 0 Minute, 0 KB

Server Rekey               : 0 Minute, 0 KB

Reference links below:

Enabling SSH

• https://docs.commscope.com/bundle/fastiron-09010-securityguide/page/GUID-8AAB14D8-A662-493A-8504-F7457B9BED02_1.html

Viewing SSH

• https://docs.commscope.com/bundle/fastiron-09010-securityguide/page/GUID-CA1D6AD1-861E-49B3-8CC3-2C14BBA51136.html

Disabling telnet Access

• https://docs.commscope.com/bundle/fastiron-08030-securityguide/page/GUID-0352E51C-3BF4-4F44-9853-466821A8E83E.html

Disable CBC

• https://docs.commscope.com/bundle/fastiron-08030-adminguide/page/GUID-FFF3988D-6510-4D9E-B134-D484DB6BFE7C.html

Disable weak SSH cipher:

• https://docs.commscope.com/bundle/fastiron-08090-securityguide/page/GUID-E6D5CCBB-B8BA-4818-B589-8FA464F2D4B6.html

This Article explains about how to setup QinQ in ICX switches. QinQ setup in used in networks like service provider, ISP’s etc. to help mange the network easily and provide more sublets independent of each other.

Question:

How to configure QinQ using tag profile in ICX switches

Customer Environment:

Customer environment would be mostly a service provider network.

Topology:

Note:

• Service provider switch model is 7550-24 port model.
• Client switch model is a 7150-24 port model.
• Firmware version running is SPR8095m.

Configuration:

Client switch 1 Configuration:

!
vlan 100 by port
tagged ethe 1/1/2
router-interface ve 100
spanning-tree 802-1w
!

!
interface ve 100
ip address 100.0.0.2 255.255.255.0
!

Client switch 2 Configuration:

!
vlan 100 by port
tagged ethe 1/1/1
router-interface ve 100
spanning-tree 802-1w
spanning-tree 802-1w priority 1
!

!
interface ve 100
ip address 100.0.0.1 255.255.255.0
!

Service provider switch 1 Configuration:

!
vlan 1000 by port
tagged ethe 1/1/3
untagged ethe 1/1/2
!
tag-profile 9100
!
!
interface ethernet 1/1/2
tag-profile enable
l2protocol dot1q-tunnel stp
l2protocol dot1q-tunnel lacp
l2protocol dot1q-tunnel cdp
l2protocol dot1q-tunnel lldp
!

Service provider switch 2 Configuration:

vlan 1000 by port
tagged ethe 1/1/3
untagged ethe 1/1/1
!
tag-profile 9100
!
interface ethernet 1/1/1
tag-profile enable
l2protocol dot1q-tunnel stp
l2protocol dot1q-tunnel lacp
l2protocol dot1q-tunnel cdp
l2protocol dot1q-tunnel lldp
!

Outputs:

Client Switch 1:

LLDP details:

client_sw1#show lldp ne
Lcl Port Chassis ID Port ID Port Description System Name
1/1/2 28b3.713f.bcec 28b3.713f.bced 2.5GigabitEthernet1/1/2 service_sw1
1/1/2 609c.9ffe.44d0 609c.9ffe.44d0 2.5GigabitEthernet1/1/1 client_sw2
client_sw1#

Ping details:
client_sw1#show ip int
Interface IP-Address OK? Method Status Protocol VRF
Eth mgmt1 10.176.193.210 YES manual up up default-vrf
Ve 100 100.0.0.2 YES manual up up default-vrf
client_sw1#

client_sw1#ping 100.0.0.1
Sending 1, 16-byte ICMP Echo to 100.0.0.1, timeout 5000 msec, TTL 64
Type Control-c to abort
Reply from 100.0.0.1 : bytes=16 time=3ms TTL=64
Success rate is 100 percent (1/1), round-trip min/avg/max=3/3/3 ms.

client_sw1#traceroute 100.0.0.1

Type Control-c to abort
Tracing the route to IP node 100.0.0.1(100.0.0.1) from 1 to 30 hops

1 1 ms 1 ms 5 ms 100.0.0.1

STP details:
client_sw1#show 802-1w

IEEE 802-1w is not configured on port-vlan 1

--- VLAN 100 [ STP Instance owned by VLAN 100 ] ----------------------------

Bridge IEEE 802.1W Parameters:

Bridge Bridge Bridge Bridge Force tx
Identifier MaxAge Hello FwdDly Version Hold
hex sec sec sec cnt
8000609c9fe853c0 20 2 15 Default 3

RootBridge RootPath DesignatedBri- Root Max Fwd Hel
Identifier Cost dge Identifier Port Age Dly lo
hex hex sec sec sec
0001609c9ffe44d0 20000 0001609c9ffe44d0 1/1/2 20 15 2

Port IEEE 802.1W Parameters:

<--- Config Params --><-------------- Current state ----------------->
Port Pri PortPath P2P Edge Role State Designa- Designated
Num Cost Mac Port ted cost bridge
1/1/2 128 20000 F F ROOT FORWARDING 0 0001609c9ffe44d0
client_sw1#

Client switch 2:
LLDP details:
client_sw2#show lldp ne
Lcl Port Chassis ID Port ID Port Description System Name
1/1/1 28b3.7129.9a4e 28b3.7129.9a4e GigabitEthernet1/1/1 service_sw2
1/1/1 609c.9fe8.53c0 609c.9fe8.53c1 GigabitEthernet1/1/2 client_sw1
client_sw2#

Ping details:
client_sw2#show ip int
Interface IP-Address OK? Method Status Protocol VRF
Eth mgmt1 10.176.194.211 YES NVRAM up up default-vrf
Ve 100 100.0.0.1 YES manual up up default-vrf
client_sw2#

client_sw2#ping 100.0.0.2
Sending 1, 16-byte ICMP Echo to 100.0.0.2, timeout 5000 msec, TTL 64
Type Control-c to abort
Reply from 100.0.0.2 : bytes=16 time=1ms TTL=64
Success rate is 100 percent (1/1), round-trip min/avg/max=1/1/1 ms.

client_sw2#traceroute 100.0.0.2

Type Control-c to abort
Tracing the route to IP node 100.0.0.2(100.0.0.2) from 1 to 30 hops

1 1 ms 1 ms 1 ms 100.0.0.2
client_sw2#

STP details:
client_sw2#show 802-1w

IEEE 802-1w is not configured on port-vlan 1

--- VLAN 100 [ STP Instance owned by VLAN 100 ] ----------------------------

Bridge IEEE 802.1W Parameters:

Bridge Bridge Bridge Bridge Force tx
Identifier MaxAge Hello FwdDly Version Hold
hex sec sec sec cnt
0001609c9ffe44d0 20 2 15 Default 3

RootBridge RootPath DesignatedBri- Root Max Fwd Hel
Identifier Cost dge Identifier Port Age Dly lo
hex hex sec sec sec
0001609c9ffe44d0 0 0001609c9ffe44d0 Root 20 15 2

Port IEEE 802.1W Parameters:

<--- Config Params --><-------------- Current state ----------------->
Port Pri PortPath P2P Edge Role State Designa- Designated
Num Cost Mac Port ted cost bridge
1/1/1 128 20000 F F DESIGNATED FORWARDING 0 0001609c9ffe44d0
client_sw2#

This Article explains about how to setup SNMPv2 and SNMPv3 Traps in ICX switches. SNMP traps are used to trace Issues related to switches using monitoring tools. This article will help with configuration and tracing SNMP traps using captures.

Question:

How to configure and troubleshooting SNMPv2 and SNMPv3 Traps in ICX switches

Customer Environment:

Monitoring tools would be used to capture SNMPv2 and SNMPv3 traps. These monitoring tool could be for example SolarWinds , PRTG etc.

SNMPv2 Configuration:

This configuration applies on all versions for a ICX switches.

Configuration:

snmp-server community public rw
snmp-server host 10.177.89.241 version v2c public

SNMPv2 trap troubleshooting: To troubleshoot and isolate if the polling and trap are working good use the Wireshark to run Packet capture in the uplink of the switch or on port which falls in path of traffic that helps lead the traffic to monitoring tool.

SNMPv2 request from SNMP tool:

SNMPv2 response from Switch:

SNMPv2 Trap Response from the switch:

Here port 1/1/23 is disabled and enabled to generate SNMPv2 trap:

Port disabled:

Port Enabled:

SNMPv3 Configuration:

This configuration applies on all versions for a ICX switches.

Configuration:

snmp-server enable ethernet 1/1/7
snmp-server host 10.177.89.241 version v3 auth test
snmp-server group admin v3 auth notify all read all write all
snmp-server user test admin v3 auth md5 testmd5123 priv des testdes123

SNMPv3 trap troubleshooting: To troubleshoot and isolate if the polling and trap are working good use the Wireshark to run Packet capture in the uplink of the switch or on port which falls in path of traffic that helps lead the traffic to monitoring tool.

SNMPv3 request from SNMP tool:

SNMPv3 response from Switch:

SNMPv3 Trap Response from the switch:

Here port 1/1/11 is disabled and enabled to generate SNMPv2 trap:

Port disabled:

Port Enabled:

How to Decrypt SNMPv3 packets in Wireshark

SNMPv3 Configuration used:

snmp-server enable ethernet 1/1/7
snmp-server host 10.177.89.241 version v3 auth test
snmp-server group admin v3 auth notify all read all write all
snmp-server user test admin v3 auth md5 testmd5123 priv des testdes123

When the SNMP packets are not decrypted it would look like below

Steps:

• Go to Edit > Preferences > Protocols.

• In protocols go to “SNMP” -> Edit “User Table”

• Click on “+” and add SNMPv3 details like Username, Authentication and privacy method and password

Once the details are added the decoded SNMPv3 traps would look like below picture in Wireshark

1. Create the Workflow on Cloudpath and add the required Plug-Ins except the SAML authentication plug-in. We will add this plug-in after the configuration on PingIdentity (IdP) side and will publish it.

2. Copy the Workflow URL (Enrollment portal URL) from Advanced tab and keep it handy for use in later steps.

3. Go to PingIdentity Portal. Select Applications > Click on + sign to create a new SAML application for Cloudpath.

4. Enter the name of the Application, add description and choose SAML as the Application type and hit Save button.

5. At this point, it will give us three options for SAML Configuration. Use "Manually Enter" option to enter the ACS URL and the Entity ID of the Service Provider (SP) which in our case is the Cloudpath server. ACS URL and SP Entity Id configuration is given in the next step.

6. In the ACS URL option, paste the Workflow URL we copied in Step 2 and append it with /samlAssertionConsumer as shown in the following screenshot :-

6. In the Entity Id option, enter the Cloudpath URL followed by /sp as shown in the screenshot below and hit Save.

7. Next, Go to the Configuration tab of the SAML app and download the metadata. This will be used in Configuring the SAML based plug-in on Cloudpath Workflow.

8. Now go to Cloudpath and edit the Workflow you created and add a plug-in “Authenticate to a Traditional authentication server” and choose SAML.

9. Choose the IdP metadata type as XML and copy the metadata into the IdP metadata XML option.

10. Next comes the IdP Entity-Id. For this, go back to PingIdentity, under the Configuration tab where we had downloaded the metadata, we can see the “Issuer Id”. This is our IdP Entity-Id that needs to be entered in the Cloudpath IdP Entity-Id option :-

11. In the SP Entity ID option, enter the same URL as in Step 6.

12. Scroll down to SAML options and select "Exact" in the AuthN Context Comparison. This may change based on your requirement.

13. Leave all other settings as default unless you want to customize the configuration based on your requirement and publish the Workflow and test it. Following is a screenshot of the Enrollment details tab showing user successfully completed the SAML authentication of the workflow :- 

Regards,