We have a problem about the The WLAN device can access the zone director ftp service in the pre-authentication phase under the web / captive portal. Even I disable ftp anonymous but it is a concern about the port is still open and it seem no any alert or event log trigger if anyone access the ftp service.
I submit a case to the Ruckus support and the reply as the following:
The guest device are able to reach the controller before entering the guest pass / web / captive portal . Once the user gets an IP after the DHCP DORA process, the user will be able to ping the controller or FTP into the controller provided he knows the credentials before the authentication. The ACLs are applied post-authentication. Controller can create the policy, but it cannot apply the policy pre-authentication of the user.
Would you have any idea about this case? Because it is a security issue in my view.
WEB authentication isn't secure anyway, so design of network must be secured. One way to do it is to have 2 VLANs, one for AP management and ZD, one for clients, and create ACL on the switch or router, that only port 80 and 443 are allowed from client VLAN to ZD IP (to provide access to Guest portal). That should fix all issues. Even better -- never to use web authentication, as it is entirely insecure.
Hope it helps.
Thanks you eizens putnins. The guest WLAN network id is 192.168.34.0 and VLAN Tag is 34; The Controller management network is 192.168.28.0 and VLAN Tag is 36. We apply the "router on a stack" under a firewall but the issue is still existing in the pre-authentication phase. After the authentication completed, the guest device can't connect the access the management network. We review the Ruckus ICX 7150 that is layer 2 mode and not support layer 3, 4 ACL. Actually, would you know the zone director how to monitor self ftp service such as log or related control? Thanks you!