Question 1:
https://support.ruckuswireless.com/documents/5698: "FTP will be disabled after upgrading to ZoneDirector 10.5.1.0.279, regardless of whether it was enabled or disabled prior to the upgrade"
You can check for yourself with e.g. nmap.
$ nmap -sV -p 21 192.168.0.2
PORT STATE SERVICE VERSION
21/tcp closed ftp
Question 2:
From the ZoneDirector CLI:-
ruckus> enable
ruckus# debug
ruckus(debug)# no support-tls 1.0-1.1
Are you sure you want to change whether support TLSv1.0 and TLSv1.1, If yes, it will reboot ZoneDirector.[Y/n]
ruckus(debug)#
After a reboot you will have only TLSv1.2.
You can check this yourself with e.g. nmap.
$ nmap --script ssl-enum-ciphers -p 443 192.168.0.2
PORT STATE SERVICE
443/tcp open https
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| compressors:
| NULL
| cipher preference: server
| warnings:
| Forward Secrecy not supported by any cipher
|_ least strength: A
(I don't show it, but you can also check ports 9998 and 11443 & see they also support only TLSv1.2).
Question 3:
You're out of luck here. You can see in the nmap output from Q2: "warnings: Forward Secrecy not supported by any cipher". This means it is impossible to disable weak KBC algorithms and still use the ZoneDirector.
