topic Re: MAC address authentication on Ruckus Smartzone-E 3.6 in SmartZone and Virtual SmartZone

MAC address authentication on Ruckus Smartzone-E 3.6

deepak_kumar_1 — Wed, 03 Oct 2018 06:03:46 GMT

I am looking a solution as MAC address authentication on Ruckus Smartzone-E 3.6 with Radius server. Is it possible Version 3.6?

Regards,
Deepak Kumar

Re: MAC address authentication on Ruckus Smartzone-E 3.6

deepak_kumar_1 — Wed, 03 Oct 2018 08:42:15 GMT

Yes, it is possible. It's confirmed.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

thomas_carter_4 — Wed, 03 Oct 2018 14:22:34 GMT

Yes, we do this with PacketFence with a vSZ running 3.6.1.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

eightohtwoeleve — Wed, 03 Oct 2018 16:55:01 GMT

We authenticate users for MAC authentication using AD servers and CloudPath (vSZ 5.0). Works like a charm.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

deepak_kumar_1 — Wed, 03 Oct 2018 16:59:02 GMT

HI,
Is it possible to share NPS and AD server's configuration guide? I implemented AD username and password authentication many times but MAC authentication is the first time. If it is possible. Any URL.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

eightohtwoeleve — Wed, 03 Oct 2018 17:35:33 GMT

This is basically our setup:

Hotspot (WISPr) wireless LAN in vSZ (auth method MAC, no encryption), linked to hotspot portal
Hotspot portal setup in vSZ to point to CloudPath
AD server auth setup in CloudPath
Workflow in CloudPath for register MAC address using AD auth servers

A lot of it is self-explanatory. And we don't use RADIUS for MAC auth, as it's not needed. We just use RADIUS for PEAP/TLS with certificates.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

diego_garcia_de — Wed, 03 Oct 2018 20:45:47 GMT

Hi Thomas,

Which version of PF are you using? I also have a few sites with Packet Fence and had to tweak it quite a bit

Re: MAC address authentication on Ruckus Smartzone-E 3.6

thomas_carter_4 — Wed, 03 Oct 2018 21:48:03 GMT

We're running 5.4 and just transitioned to Ruckus this year. I believe I did have to make a small change to the Ruckus "switch" code in PF that I believe is resolved in the latest version of PF. We actually would have migrated to a newer PF but wanted to make one big change (migration to Ruckus) at a time.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

diego_garcia_de — Wed, 03 Oct 2018 23:40:43 GMT

Thanks! Im on 8.1 and 7.5 on different schools. Using ZoneDirector (on 7.5) and 8.1 with SmartZone 3.6.0. It would be good to talk off-line. Im at dgarcia(at)mediatel.com.ar

Cheers!

Re: MAC address authentication on Ruckus Smartzone-E 3.6

claudinir_carfa — Wed, 05 Dec 2018 18:42:55 GMT

Hello! I need help. I am using virtual smartphone 3.6.1 with packetfence 8.1.0. after authentication I get the error:

Dec 5 16:07:50 packetfence pfqueue: pfqueue(4096) ERROR: [mac:9c:4e:36:9d:15:10] Failed to contact Ruckus for deauthentication: 500 Can't connect to xxx.xxx.xxx.xxx:9443 (certificate verify failed) (pf::Switch::Ruckus::SmartZone::deauthenticateMacWebservices)

even after running the no-encrypt command on the smartzone controller

Re: MAC address authentication on Ruckus Smartzone-E 3.6

scott_lu — Thu, 22 Aug 2019 21:34:39 GMT

We are running PacketFence/SZ with AD, SMS, local username/password works perfect, but we have email issue, PF/SZ couldn't "deauth" when time is up, PF unregistered the client but SZ still authenticated the client, here is error message from PF "According to rules in fetchRoleForNode this node must be kicked out. Returning USERLOCK (pf::Switch::handleRadiusDeny)".

Thanks,

Re: MAC address authentication on Ruckus Smartzone-E 3.6

diego_garcia_de — Fri, 23 Aug 2019 11:10:07 GMT

Are you trying to do radius de-auth or using web-services? the error you're seeing seems to be tied to not having a proper cert on smartzone. You can use port 9080 instead of 9443 for non-TLS channel.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

diego_garcia_de — Fri, 23 Aug 2019 11:13:14 GMT

do you know if you're using RADIUS based de-auth or web-services? If using radius, you have to use smartzone as RADIUS proxy and not do RADIUS directly from the APs. I am using RADIUS directly from the APs and de-auth via web-services from PF to SZ. I had to do some small changes to PF but nothing huge.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

eizens_putnins — Thu, 03 Oct 2019 19:40:07 GMT

Hello, dear Diego,
As I understand, you have working combination of vSZ and PF.

I am stuck with combination of vSZ v.5.1.2 and PF 9.0.1. Users get to captive portal and get through registration steps, even get PF confirmation, but authentication on vSZ doesn't happen, and connection to Internet is not established.
Seems that PF isn't enabling user through WEB-service. We use guest access without password.
MAC and IP encryption in requests is disabled on vSZ.
Status of user in vSZ is unauthorised. Any ideas will be appreciated. You can reach me on eizens (at) e-meter.lv It would be great to have off-line conversation about this.

Thanks in advance,
Eizens

Re: MAC address authentication on Ruckus Smartzone-E 3.6

diego_garcia_de — Thu, 03 Oct 2019 20:05:06 GMT

just sent you an email. let me know

Re: MAC address authentication on Ruckus Smartzone-E 3.6

eizens_putnins — Fri, 04 Oct 2019 18:56:46 GMT

Received first e-mail, sent info, but haven't got any farther communication - may be mails are not going and I need to switch to gmail?
Thanks in advance,
Eizens

Re: MAC address authentication on Ruckus Smartzone-E 3.6

hayder_al_windi — Sun, 31 May 2020 05:50:07 GMT

Hi EightOhTwoEleven
can you please share the WF step of setting up CloudPath for register MAC address using AD auth servers

Re: MAC address authentication on Ruckus Smartzone-E 3.6

rafael_rocha_i5 — Fri, 04 Sep 2020 14:44:44 GMT

I am having the same issue using PF 10.1.
Can you please share how you guys are able to resolve this ?

Using a ssid with hotspot, based on what I understand it should use the Northbound Portal Interface to communicate with the pf server about the auth user status, but I didn't see any place where there is a exchange message been sended.
any help is appreciate. Thanks in advance.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

diego_garcia_de — Fri, 04 Sep 2020 15:06:14 GMT

hi Rafael,

in my case i was using a "patched" version of packetfence (since I was using non-proxy radius mode and the packet fence was installed locally on the same lan as the APs. I was not using the captive portal hosting by smartzone (wispr style/hotspot) but rather everything on the packetfence side.

I noticed there is a new version of PF which has different modes for smartzone but I havent looked into it yet.

Re: MAC address authentication on Ruckus Smartzone-E 3.6

rafael_rocha_i5 — Fri, 04 Sep 2020 17:08:43 GMT

I want and I am trying to have the same thing, the portal and the radius on the pf side, however in my situation I cannot use the in-line config, so I am trying to do the 3 layer auth/role ''layout''. On SZ, guest and web auth type of ssid, can only use internal portal, so its only give us the hotspot/wispr and hotspot 2.0 types to work with.