I was working with some wireless bridge the other day that I had never used. I needed to get VLAN tags to pass through this wireless bridge, but for some reason they were not. I thought.. “this is a bridge it should pretty much be plug and play”. I was wrong. These bridges seem to do a great job, and are easy to setup, but I had problems finding out how to do this. I thought I would write up a simple post on how to allow VLAN tags to pass through this bridge.
My first issue was the bridges were on a very old firmware. I was on version 5.3, after finding some documentation I thought it was best that I upgrade. I upgraded all the way to the newest version which is 5.6.
Next I noticed that the WDS was not checked. To give some background on why this is so important:
WDS, which stands for Wireless Distribution System, is a feature that enables single-radio APs to be wirelessly inconnected instead of using a wired Ethernet connection.WDS connections are MAC address-based and employ a special data frame type that uses all four of the (MAC) address fields allowed in the 802.11 standard, instead of the three addresses used in normal AP <-> STA (client) traffic. (In the 802.11 frame header, address 1 is the destination address, address 2 is the source address, address 3 is the BSSID of the network and address 4 is used for WDS, to indicate the transmitter address.)
So that’s the reason that Vlan tags would not pass – WDS was not checked, so basically this was a acting as a switch instead of a transparent bridge.
Here are my settings that in the end fixed my vlan tagging issues. First had to upgrade the firmware, then next enable WDS on both aps, one being a Station (Client) the other being a AP. Last, of course make sure that switches both bridges plug into are trunk ports, and have the vlans created.
Ruckus brought in the Guest Self Service portal in firmware 9.10.0.0 build 218 – so if you are looking to configure it please install this update first (Check release notes for proper upgrade path). After we are on build 218, lets get configuring.
So the Ruckus Guest self service portal is Ruckus’s first step in creating an “on boarding” process. It allows administrators to make sure that there is at least some kind of authentication on their guest WLANs. The portal gives guest users the ability to create their own guest pass, and the admin can set many options of the guest pass such as expiration, amount of devices that can be registered with this pass, and how the pass is given to the user – for example you can send it through text, email, just show it to them on the screen, or a combination of all. So this feature is great, and helps admins authenticate guest users with very minimal intervention.
So how do we configure this?
First we need to create a new Guest access policy. This is located under Configure – Guest Access. Create a new portal.
Lets now configure our portal page. A few options that are very important are:
Enable Zero IT Registration from the Guest Portal – Use this if you are also planning to register devices. I was confused by this at first. As you will see you have the option to use guest pass, or register a device. When you register a device you are just using Zero IT as normal to get on the secured network.
Authentication – Use guest pass for this. Since thats the goal.
Next you have a lot of options such as Terms of service and time out.
The main box you have to check is the “Guestpass Self-Service” box , you will then get a lot of options to do with that process and how to get the guest pass to the user. A few things to note, if you want to txt them, or send the pass through email you will need to configure a mail server and/or SMS server in the settings of the ZD.
If you notice there is a small “Restricted Subnet access” – Its kind of hidden in my opinion. This is very important. If this is used for guest access more than likely you will want to make sure that guests cannot access internal hosts. This is where that is done. This or the Layer 3 access list. Remember Ruckus does the filtering on the AP, so having to have a ACL on the router is not needed. Below if the full Guest access config.
That is about it for the Guest portal. Now we need to create a WLAN and use it for our guest access.
So, lets create a WLAN at configure – WLAN- create a new one.
Things to note – Select “Guest Access” Then select your Guest access Service portal you created.
Great!! All done, so what happens when you connect?
First you will be presented with the on boarding portal that asks if you would like to use Guest Access, or Register a device (Zero-IT).
Select “Guest Access”
On the next screen it will ask you for your Guest pass, but you don’t have one yet. Select the button to create a new pass. Note that you have the option to Query the status. This is a feature if you want to approve guests of getting a Guest pass before they do.
On the next screen you will be asked to fill out your information.
And here you go! you have your guest pass, which is valid for the length of time that you configured in the policy. Copy and keep this key. The ZD will automatically copy the key into the next page for you. Select to go to Guest Access portal.
You can see the the ZD copied the key for you. Just Press submit.
And there we go!! We are online. Ruckus does it again with making getting on Wifi easier. Now we have a built in On boarding portal.
You can view the Guest Pass and its config under Monitor-Guest pass to find out who the GP was assigned to, when it expires, and you can delete them from here as well.
Ruckus has done a great job giving us a simple but effective way to on board users for Guest and/or internal use.
Ruckus has finally built in the ability to use LLDP to find Access points. I was so excited when I found this out, I installed the newest firmware and was ready to be blown away – and alas.. no LLDP. So, what was wrong? LLDP is not enabled by default! You have to go into the AP group via CLI and enable LLDP. No biggie.
This feature comes in software version ZDXXX 9.9.0.0.205 GA Software Release .
To enable LLDP – SSH into the zonedirector
Then after logging in run these commands
enable
config
ap-group “System Default”
LLDP enable
exit
exit
Here are some screenshots:
As you can see, by just doing a “Show” it is disabled:
After running the command: “LLDP enable”
And BAM: now I can find my APs no matter where they are plugged in at
Hello all, I recently was given a strange task. An office needs to have everyone in there office on different vlans. The reason for this is that each user is developing software and they need to test VIA wireless to other wireless devices. Lots and Lots of broadcast, as well as different subnets. So, how can we separate each of these users wirelessly and give each of them their own “play space”? You can accomplish this a couple ways: We can have 100 different WLANs, each with their own Vlans, or use 1 SSID and use Dynamic Vlans to separate them out.
The tools I will be using are – Ruckus Wireless Zondirector, and APs, Microsoft NPS, and Wireshark to take a better look at what is happening at the packet level.
So first lets setup everything. We need to use 802.1x authentication for WLAN Access. I will not walk through all the steps here but definitely do another blog entry on setting that up. So lets assume as of now we have 802.1x working great for authentication.
Our next step is that we need to create new Security Groups in AD and add our users to them. I added groups that reflected the Vlan name. For example WIFI-VLan-150 and then added my user I want to get VLAN 150 to.
Next lets create our Radius Policies.
Create a new Network Policy- match the Group, add your Encryption and other settings. See below:
Then add your Constraints that you would like:
Next the magic happens – we have to add in our Radius attributes . These are Standard radius attributes. We will add 4 802.1x attributes.
Attributes to add:
1. Tunnel-Assignment-ID – String – Vlan ID.
2. Tunnel-Type – Select Virtual Lans (VLANS)
3. Tunnel-Medium-Type – Value – 802 – Commonly used for 802.1x
4. Tunnel-Pvt-Group-ID – Value – String – Vlan ID. Note – I did not add this at first, this attribute is what fixed my issue, and successfully pushed the Vlan ID to my client.
Here is a screenshot of all the attributes:
Make sure this policy is above your default policies. The next screen shot shows my order of policies. Notice I have one for 666 vlan, and 150. Then there is a domain computer, then a catch all for domain users.
That’s it for Radius, now we need to create the WLAN for in Ruckus for our Dynamic Vlans. Remember, we are assuming everything works great with Radius authentication from the get go.
The main thing when creating the WLAN in Ruckus is to use 802.1x for authentication, and then under “Advanced” check the “Dynamic Vlan” box. You will notice I am using “SRV-dir03” For authentication (My Radius Server). Apply this and we should be golden.
To check and make sure you are on the correct vlan/wlan you can always check your ip address or look into Ruckus and see what your info is. You Notice mine –
Ruckus does an amazing job finding traffic to be QoS’d, and using a suite of tools to make sure that traffic is delivered as quickly and reliably as possible. They do this with what they call Smartcast. Smart cast is a group of features:
We were marking our VOIP/Video packets with DSCP values ef and af41 respectively. Ruckus looks at the ToS value instead of DSCP. I logged into the ZD through CLI and could see what was manually being added to the software queues. See below:
From here you can see the ToS classifications in Hex, and the Heuristics used to detect voice/video/data. I wanted to make 100% sure that my video was in the video queue. So I changed from DSCP af41 Decimal 34 to hex 0x88. To add this I just checked to see what the video was already marked for, and added 0x88 (My DSCP value).
As you can see after adding the 0x88 value to the queue all classifications show up. You could also modify your Heuristic interval from here as well.
Ruckus has lots of documentation on all their greatness and features including some great youtube videos.
More info on Smartcast:
Recent Comments