When i enter an IP adress or subnet in either Source or Destination Field or both, all traffic is denied even though all devices should be able to contact 192.168.90.10.
Default = deny
Rule 3 = allow Source 192.168.90.1/24 to Destination 192.168.90.10/32
Expectation: Connection to 192.168.90.10 should be possible, all other devices should be isolated
Result: pinging 192.168.90.10 or any other device is not possible.

Can someone confirm this?
Is there someting obvious I am missing?

Ruckus R510 with Unleashed 200.15.6.212.27

In this article, I am going to explain the configuration steps of Social Login Guest Portal authentication with Google.

Network Environment:  

• SmartZone/Virtual SmartZone [Essentials/High-Scale] (Controller), version 6.1.1.0.x.
• R350 (Access Point)

Setup Procedure:

• In the vSZ/SZ GUI, navigate to ‘Network -> Wireless LANs’ and select ‘Create'.

• Name the WLAN, in my setup I named it as ‘SOCIAL_LOGIN’, Authentication Type as "Guest Access" and Method as "Open"

• Encryption Options is selected as 'Open' (but it can change based on requirement). 

• Under Guest Access Portal, select 'Social Media Login'
• In 'Social Media Profile' click '+'icon to create the profile

• Name the social media profile and in Social Auth Option turn 'ON' the toggle for Google and click the 'here' button

• If you click on “here” you will be redirect to Google APIs section of your Google account, login, accept terms of service and click on “+ Create Project”

• Enter Project Name and Location and click on Create.

• Once the project has been created, go to the OAuth consent screen, and select External and click Create

• Under App information, complete the following steps:

• For App name, enter the application name.
• For User support email, select an email address from the list.

• For Developer contact information, enter valid email address and click SAVE AND CONTINUE.

• In the Edit app registration > Scopes page, click SAVE AND CONTINUE.
• In the Edit app registration > Test users page, click SAVE AND CONTINUE.
• On the OAuth consent screen, click PUBLISH APP.

• In the Push to production dialog box, click Confirm.

• Under Publishing status, change the status to In production.

• Go to the Credentials page and click CREATE CREDENTIALS and select OAuth client ID.

• For Application type, select Web application and for Authorized redirect URIs, enter https://ap.ruckus.com:9998/googleHandler or http://ap.ruckus.com:9997/googleHandler

• Click Create. If successful, Google displays the Client ID and Client Secret, as shown in the following figure. 

• The Google Client ID and Google Secret would be automatically filled once the above steps are performed              

• Then add these Whitelisted Domains:*.geotrust.com, *.google.com, *.gstatic.com
• The next step is to create a 'Guest Portal Service' by clicking the '+' icon

• Enter the 'Portal name' and 'Save' (It can be modified based on requirement).

For this example, all other settings including VLAN assignment for end-user devices are set to the default values.

Next click 'OK'.

This configuration will be good to go ahead with Social Media login With Google.

Regards,

Leimapokpam Ambika

I work in a small compagny, I manage the network. There are 10 employees.

I need to implement APs. I've done my homework, and I'm going to use lightweight APs with a controller. I don't know the brand yet, but a friend recommended RUCKUS.

How do you choose the right type? I have 200m² to cover, but it's spread over several rooms and not on the same floor. I haven't found any software to help me decide what type of AP to install and where in the building.

I learned with:

- https://www.networkacademy.io/ccna/wireless/lightweight-ap-architecture

- https://pingmynetwork.com/network/ccna-200-301/frequency-bands-and-non-overlapping-channels

ChatGPT tells me Netspot. Has anyone used it?

• In this article, we will look into the steps involved in setting up Self Registration Guest Pass Generation in Smart Zone controller running in 6.1 version

Note: This feature is available  since 6.1 version onwards

Network Environment:  

• SmartZone/Virtual SmartZone [Essentials/High-Scale] (Controller), version 6.1.0.x.x
• R710 (Access Point)

Setup Procedure:

• To create SMTP server in the vSZ/SZ GUI, navigate to ‘System->External Services->SMTP’ and turn on the “Enable SMTP Server” toggle, fill the SMTP server details. In my example, I am using gmail server

• Do the test, once it is successful, click on “OK”

• Once the SMTP server has configured, create a “Guest Access Portal”, navigate to “Services & Profiles”-> “Hotspots & Portal” -> “Guess Access” then select the “Create”

• Fill the details, turn on the “Self-registration” toggle and the “Guest Pass SMTP Server”

• Post Guest Access Portal creation, create the WLAN for the Guest Access
• Navigate to “Wireless LANs”-> Select the Zone then click on “Create”

• Name the WLAN, in my setup I named it as ‘Test, Authentication Type as "Guest Access" and Method as "Open"

• Encryption Options is selected as ‘None' (but it can change based on requirement). 

• Under Guest Access Portal, select ‘Guest
• In 'Guest Portal Service’, select the Guest Access Portal profile which we have created from the drop down then click on “OK”

• All other settings including VLAN assignment for end-user devices are set to the default values in my set up

Regards,

Leimapokpam Ambika

• vSZ-H version : 6.1.2.0.404
• Windows Server 2016

Setup Procedure:

This demo explains the configuration steps to authenticate wireless clients using 802.1x- SZ/vSZ by configuring NPs policy on a Windows server.

1-Make sure if the below features are installed.

2-Navigate to the Network Policy Server tab, access NPS (local), and choose the 'Radius server for 802.1x' option for both wireless and wired connections. Finally, select 'Configure 802.1x'

3-In this step, select 'Secure wireless connections' and customize the policy name to your preference. In this case, append 'DEMO' at the end of the policy name.

4-In this step, you need to configure the Radius Client by providing a friendly name, entering the IP address of the vSZ IP address, and optionally setting a password or using a password generation tool. Remember to save this configuration as it will be used in Step 9.

5-In this step, choose 'Microsoft Protect EAP (PEAP)' as the network access method

6- Next, leave the remaining options at their default settings, and conclude the configuration by clicking on the 'Finish' button.

7-Configure the “Connection Request Policies”

To configure the connection request policy, navigate to the 'Policies' section. Then, access the 'Connection Request Policy' folder and locate the policy is created with the same name. Double-click on it to access its properties. In the 'Properties' window, navigate to the 'Conditions' tab. Remove the 'Current' condition and any others if present. Add the 'Time' condition and select 'Permit all time'. Finally, click 'Apply' and then 'OK' to save the changes.

8-Configure Network policies

To configure the Network Policies access to “Network Policy” folder and locate the policy is created on the folder and locate the policy is created with the same name. Double-click on it to access its properties. In the 'Properties' window for this example, I choose to ignore the user properties dial and proceed to the 'Conditions' section. Here, I add the 'User Groups' option to use the Active Directory users.

In this part, you have the option to either use an existing group and its users or create a new group along with its users.

Optional step

How to create a group and users

Navigate to the Active Directory of users and computers, then left-click on it. Next, select 'New,' followed by 'Group,' and proceed to fill in the required information.

How to create an user

Navigate to the Active Directory of users and computers, then left-click on it. Next, select 'New,' followed by 'user’, and proceed to fill in the required information (username and password ).

In this case, we need to edit the 'Member of' properties of this user. Since I want this user to belong to the earlier created 'DEMO' group, we navigate to the user's properties, specifically the 'Member of' section. Subsequently, we add the group and configure it as the primary group.

Continue with the network policies configuration next, we will select the desired group and proceed to the 'Constraints' tab. Here, we will add CHAP as the authentication method.

9-Smartzone/ Virtual Smartzone configuration

In the SZ/vSZ configuration, navigate to “Security” ->Authentication->Proxy(SZ Authenticator)/ Non-Proxy(AP Authenticator)(I am using ' Proxy(SZ Authenticator) in my example

NOTE: Proxy(SZ Authenticator)  is used when APs send authentication or accounting messages to the controller and the controller forwards these messages to an external AAA server. A non-proxy (AP Authenticator)AAA server is used when APs connect to the external AAA server directly. 

Click on “+Create “ button

Enter the NPS server details and make sure that you enter the same shared secret as you have entered in NPS server

10- WLAN Creation

Navigate to “Network->  Wireless LANs”and select the desire zone and click on “Create” tab . Fill in the necessary information accordingly.

In my demo, I used High scale hence the Realm Proxy profile must be created so that the Realm Proxy profile would show in the drop down under the Authentication Service

How the Realm Proxy profile can be created? please check the below details

Click on First Realm ->“Configure” -> Under “Service”, make sure, you select the right NPS server

11-Wireless Client

After creating the wireless network, it's important to check the connectivity. Connect to the network and when prompted, enter the credentials of the created DEMO-USER along with the corresponding password. If the credentials match, you should be able to connect to the network without any issues.

Regards,

Leimapokpam Ambika

As a Ruckus Technical Assistance Center (TAC) engineer, this knowledge article aims to provide guidance on assigning radio profiles to AP groups within the same venue in the RUCKUSOne platform. This specific tutorial addresses the scenario where a customer wishes to disable the 2.4GHz radio for a WLAN in one particular AP group while allowing clients to connect using both radios in other AP groups.

Customer Environment: The customer's setup comprises 128 APs organized into three AP groups. They seek to disable the 2.4GHz radio for a specific WLAN within one AP group, while maintaining functionality across both radios for the remaining AP groups.

Resolution: Below are the steps to configure radio profiles for WLANs across AP groups:

1. Navigate to the desired Venue within the RUCKUSOne platform.

2. Select the "Networks" tab.

3. Locate and click on the WLAN configured for the Guest network.

4. Within the WLAN settings, click on the highlighted "Radios" option.

5.Select "Specific AP groups" to customize radio settings for individual AP groups.

6. Choose the desired AP group where you wish to disable the 2.4GHz radio for the WLAN.

7. Toggle the radio options to enable or disable as per requirements for the selected AP group.

8. Click "Apply" to save the changes.

9. Hover over the "Radios" option of the specific WLAN to verify that the settings have been successfully applied to the chosen AP group.

Conclusion: By following the outlined steps, users can effectively manage radio profiles for WLANs across different AP groups within the RUCKUSOne platform. This capability allows for granular control over wireless network configurations, ensuring optimal performance and customization based on specific deployment requirements.

If you found this information helpful, please consider clicking on the "KUDOs" button to assist other users.

Regards,

Vasanth Edward || Snr TSE

RUCKUS Networks, CommScope!

On Unleased AP, when we try to create the Guest SSID with Facebook login option, we get the below error when we click on "Register"
"Register guest service [Facebook] to Facebook failed.

Root Cause:
This is due to Facebook has officially announced the discontinuation of the “Facebook Wi-Fi” feature, which took  effect from June 12th, 2023.

Workaround :
We would request you to choose alternate login options available for now.

Solution :
We will be implementing Facebook Oauth 2.0, and this will be available in Unleashed 200.15.
Current ETA is set to January. I will keep the thread updated if there any change.

I don't believe the interference is actually on the primary channel as I've shifted the channels quite a bit and every time the log entry only shows the primary channel.

Is there any way to identify the actual channel/frequency that the interference was on so I can eliminate those channels permanently?

Thanks

Customer Environment

Smart Zone 5.2.2.0.1563 or earlier, 6.0.0, 6.1.0 version

Root Cause

Israel DFS channel support was implemented to Smart Zone 6.1.1.0.359 in May of 2022 and have not yet been ported to Smart Zone 5.2.2.0.1563 or older, 6.0.0. or 6.1.0 releases. Future releases of Smart Zone will include Israel DFS channel selection.

Symptoms

Israel DFS channels are missing in Access Point Zones

Workaround

Please upgrade to the following controller + access point patch combination

Resolution

Upgrade to 5.2.2 patch 3 (5.2.2.0.2122) or 6.1.1.0.359 and newer releases to enable Israel DFS channels.

Customer Environment

Zone Director managed AP network where you would like to blacklist certain channels. This is mainly applies for ZD version below 9.5.

Symptoms

Resource group mapped to a user needed to revisited and modified

Resolution

After logging into the ZD CLI, enter into the ‘enable’ context, then the ‘debug’ context. To enable channel Blacklist feature run the below command:

remote_ap_cli –A “set blacklist [wifi0¦wifi1] [enable¦disable]" – It executes for all the ZD managed Aps.

remote_ap_cli –a MAC address of the AP “set blacklist [wifi0¦wifi1] [enable¦disable]" – It executes on the specifc AP.

Where:

wifi0 = 2.4Ghz radio

wifi1 = 5Ghz radio

Manually Blacklisting channels from channel selection:

To manually specify blacklisted channels use the command:

remote_ap_cli –A “set blacklist [wifi0¦wifi1] <ch> <option>”

Where <option>:

-1 = permanently add to the blacklist (will survive a reboot)

0 = clear channel from blacklist

1 = temporarily add to the blacklist (won’t survive a reboot)

Note : From 9.5 and above firmware version, we can block the channel from the ZD GUI :: Configure :: Access Points, click on the particular AP, under 'Channel Range Settings' you can see that option.