topic Re: Unleashed AP approval issues with 200.2.9.13.186 in Unleashed

Unleashed AP approval issues with 200.2.9.13.186

JJW2009 — Tue, 18 Oct 2016 22:49:23 GMT

With previous firmware versions I could enable/disable automatic approvals. I just updated to 200.2.9.13.186 and it seems the approval option is permanently enabled, you are not able to click the option. Has anyone else noticed this? It's caused some minor headaches when running multiple APs on the same network that I did not want to be connected together.

Re: Unleashed AP approval issues with 200.2.9.13.186

michael_brado — Tue, 18 Oct 2016 23:11:26 GMT

Unleashed is designed to run on one flat VLAN, and automatically upgrade/update new APs seen.
You cannot run two Unleashed networks on the same VLAN.
You have a choice when to Upgrade the entire network, following a new Unleashed release.

Re: Unleashed AP approval issues with 200.2.9.13.186

JJW2009 — Tue, 18 Oct 2016 23:19:39 GMT

Thanks Michael, I could have sworn I was able to select or un-select the approval option with the previous firmware, I thought it was strange I couldn't do it with this release... but I could be wrong. Thanks for the update.

Re: Unleashed AP approval issues with 200.2.9.13.186

michael_brado — Tue, 18 Oct 2016 23:25:44 GMT

Glad to get your feedback. Keep testing.

Re: Unleashed AP approval issues with 200.2.9.13.186

daniel_m — Fri, 02 Dec 2016 19:14:24 GMT

Hey Jeff. I have the same problem and I’m running the same version. Approval is checked and greyed out and I cannot uncheck it, which I’d like to do. The UI even says “To enhance wireless security, deactivate this option. This means you must manually “allow” each newly discovered AP.”

Did you ever get this resolved?

Re: Unleashed AP approval issues with 200.2.9.13.186

ruben_trucon — Mon, 30 Jan 2017 10:02:23 GMT

Hi Jeff

You are definitely not mistaken: after setup last year, we disabled the automatic approval. Since upgrading to the latest firmware on friday, the feature is enabled again, and grayed out.

From a security point of view, it's bad that someone can plug in an AP and it just joins the AP to your network without any approval requests...

Is there a workaround for this issue?

Michael Brado: I'm not sure if you're not talking about the automatic upgrade of firmwares? Unless I'm mistaken, what Jeff, Daniel (and I) mean is the automatic approval of new access points on your network.

Re: Unleashed AP approval issues with 200.2.9.13.186

daniel_m — Wed, 01 Feb 2017 21:13:10 GMT

This problem still exists with the latest 200.3.9.13.228.

Re: Unleashed AP approval issues with 200.2.9.13.186

michael_brado — Wed, 01 Feb 2017 22:10:28 GMT

Hello Jeff, Daniel,

Your first Unleashed AP on a network will have a startup wizard that asks "Would you like to join the Cloud" or
"Would you like to create an Unleashed network." It is a design *feature* that all subsequent Unleashed APs on
this same LAN/VLAN are intended to be part of the Unleashed network that was created, so up to 24 more APs
will be automatically recognized, upgraded if necessary, and configured with WLANs to start service asap. You
would need to convince our Product line manager that this is not a good idea... =:^)

Re: Unleashed AP approval issues with 200.2.9.13.186

daniel_m — Wed, 01 Feb 2017 22:23:02 GMT

While I understand the reason behind it and I’m certain it leads to fewer support calls, the last thing I need is for someone to put a rogue AP on the network that can automatically join the existing Unleashed network. While it simplifies things to have this enabled by default, it is a security concern. If you plan to leave this feature permanently broken, which is a shame, you should probably remove it from the product and documentation at http://docs.ruckuswireless.com/unleashed/200.3/index.html#c-Others.html.

Re: Unleashed AP approval issues with 200.2.9.13.186

ruben_trucon — Thu, 02 Feb 2017 08:02:37 GMT

Hi Michael,

You say it's by design, but why in versions prior to 200.2 could we disable the auto join then? And as Daniel says, why would it ever be visible in the configuration (grayed out or not)?

Before version 200.2.9.13, we disabled the auto-join, because in some environments it's just ridiculously insecure to allow AP's to join wether they are plugged in by someone working at the company, or a random person with less good intentions...

Like Daniel says, if the feature won't be enabled anymore, remove it from the UI and the documentation. But also expect lots of criticism.

Re: Unleashed AP approval issues with 200.2.9.13.186

ruben_trucon — Mon, 06 Feb 2017 10:36:37 GMT

Is it possible to remove an "Answered"-tag from a thread, or should I make a new thread for this issue?

Re: Unleashed AP approval issues with 200.2.9.13.186

michael_brado — Mon, 06 Feb 2017 18:43:02 GMT

No, but you can contact Tech Support or your SE and ask for a Field Request (FR) with your business case for PLM to consider.

Re: Unleashed AP approval issues with 200.2.9.13.186

john_d — Tue, 07 Feb 2017 05:42:56 GMT

FWIW, I was able to use the Unleashed CLI's faux ZoneDirector mode to disable AP auto-approval much in the same way that one uses the ZD CLI to do so....

Of course, if Ruckus's official position is that this is not a supported feature, I would not recommend doing so.

(Don't ask who may have gotten in a bit of trouble for hijacking a test rack of Ruckus AP's once because he had a controller plugged in :D)

Re: Unleashed AP approval issues with 200.2.9.13.186

ruben_trucon — Tue, 07 Feb 2017 08:04:25 GMT

Good thinking!

And good to know that tinkering through the CLI can get you in to trouble when plugging in a controller 😛 Definitely putting that in our documentation 😛

Re: Unleashed AP approval issues with 200.2.9.13.186

john_d — Tue, 07 Feb 2017 17:12:27 GMT

It's more bringing in a controller with auto-approval enabled on a subnet I did not own. Little did I know, someone on the subnet was trying to set up some Ruckus AP's and his controller was losing the race to mine, so I kept accidentally stealing his AP's.

That taught a valuable lesson to turn off auto-approval unless I really know I want it on a network.

Re: Unleashed AP approval issues with 200.2.9.13.186

jesper_bach1 — Fri, 09 Feb 2018 08:29:30 GMT

Couldn't find any other threads on this subj, so adding my own comment.
In this way it is virtually impossible to pre-provision Unleashed at home, if you have Unleashed AP's of your own. I'm on 200.5.10.1.291 and (still) cannot disable 'Auto Approval' on my exisitng Unleashed, causing my new AP's to be 'stolen' too. Besides, my new AP's still have this label inside the plastic wrapping....

Re: Unleashed AP approval issues with 200.2.9.13.186

michael_brado — Fri, 09 Feb 2018 17:49:34 GMT

Hi Jesper,

By design you cannot pre-configure an Unleashed network, nor set it up remotely.
We have a knowledge base article with setup details that can be shared with remote
admins if needed.

https://support.ruckuswireless.com/answers/000005204

Re: Unleashed AP approval issues with 200.2.9.13.186

jesper_bach1 — Mon, 12 Feb 2018 10:36:55 GMT

After harassing over this for a couple of days, i ended up managing my two Unleashed networks, by adding the corresponding switchports untagged to different VLANS and different IP subnets and got it done that way.

Thanks,