Ruckus SmartZone

Download this guide ⬇

Introduction

Scope and Purpose

Thank you for purchasing the Trusted WiFi solution. This document is a hardware configuration guide describing how to setup a Ruckus SmartZone WLAN Controller for a Trusted WiFi Passpoint service.

• For more information on how to setup an end-to-end Trusted WiFi Passpoint service, please refer to the Trusted WiFi Passpoint Administration Guide.

• For complete information on how to setup a Ruckus SmartZone WLAN Controller, please refer to the vendor’s original documentation.

Documentation Conventions

Passpoint Overview

Passpoint – also known as Hotspot 2.0 – is an industry-wide next generation approach to public internet access driven by the Wi-Fi Alliance that brings the following benefits:

• Frictionless onboarding and roaming, thanks to a one-time registration followed by automatic access to interconnected hotspots

• More secure and private Wi-Fi connections, compared with general visitor networks

Passpoint is based on the IEEE 802.11u standard, which is a set of protocols enabling cellular-like roaming. Following the initial enrollment, frequent users such as visitors, guests or employees bypass repeated logins, forms and passwords, as their mobile devices automatically join the Wi-Fi subscriber service when they return to a venue or roam between inter-linked Passpoint enabled hotpots and providers, while being better protected against potential cyber threats.

If a device supports 802.11u and is enrolled to a service, it automatically communicates with the Wi-Fi infrastructure via the access points to discover the network SSID and connects securely to it by presenting its access credentials. Upon successful authentication, the device is provisioned with Passpoint standards-based management objects - known as Per-Provider Subscription Management Objects (PPS-MO).

GlobalReach - an ASSA ABLOY company - has been involved with Passpoint since its inception and even contributed to the creation and initial pilot testing of the standard. As a result, it is one of the few trusted worldwide experts on this topic, with a proven platform backed by real-world operational experiences at scale.

The best user experience is to offer Passpoint through a customer/brand mobile app integration, as it further simplifies the onboarding process, while incentivizing app downloads and customer loyalty, leading to further engagement and monetization opportunities. To this effect, Trusted WiFi offers a Software Development Kit (SDK) for easy app integration.

End-to-End Service Components

Implementing an end-to-end Trusted WiFi Passpoint service requires a combination of the following software and hardware components:

• Trusted WiFi Passpoint: the core services are offered and managed centrally via the Trusted WiFi Passpoint Module (hosted and operated by GlobalReach). Following an initial setup performed by the GlobalReach Operations team, Managed Service Providers (MSPs) can then add sites to customer realms and monitor the solution.

• Customer Realm: the service requires connectivity to a realm including domain, security certificate and private key, as well as the database holding the users’ Personally Identifiable Information (PII). It is the responsibility of the Identity Provider – typically the customer/brand – to make this part available.

• Mobile App: the best user experience is to offer Passpoint through a customer/brand mobile app integration. Trusted WiFi offers a Software Development Kit (SDK) for easy implementation. It is the responsibility of the app owner – typically the customer/brand – to perform the integration.

• Local Networks: the local networks must be compliant with Passpoint (Hotspot 2.0). – Most recent   Wi-Fi access points and controllers from major vendors support Passpoint today, however older models or products from more exotic manufacturers might not do. The configuration of the local infrastructure is typically handled by the Managed Service Providers (MSPs).

• User Devices: the subscribers’ mobile devices (belonging to visitors, guests, employees, etc.) must be compliant with Passpoint (Hotspot 2.0) – All recent iOS and Android-based smartphones or tablets support Passpoint today, however older models or products running less popular operating systems might not do. Laptops compatibility is also more erratic. It is therefore essential to maintain a traditional onboarding service in parallel with Passpoint to handle non-compatible devices.

High-Level Topology

The diagram below illustrates the high-level topology for the end-to-end Trusted WiFi Passpoint service:

Glossary

The following is a glossary of the most common terms used regarding this solution.

RUCKUS SMARTZONE CONFIGURATION

Supported Versions

Version 3.62 is the oldest version that supports Passpoint. Ruckus recommends running version 5.22 on the controller and either 3.62 or 5.12 on the APs. This will ensure support for both older and newer APs.

Note

Please refer to the Ruckus Wireless AP-Controller Matrix - January 2022 document for further information on which versions of OS code supports which APs.

Prerequisites

It is assumed the following prerequisites are met before configuring a Ruckus SmartZone WLAN Controller for a Trusted WiFi Passpoint service:

• A supported Ruckus SmartZone running version 5.22 or greater, activated and licensed.

• A Trusted WiFi account with operator permissions.

• A core Trusted WiFi Passpoint service configured and tested.

• A property in Trusted WiFi with deployed Gateway and Passpoint modules.

• A deployed and configured Wi-Fi network.

Note

This document focuses on a specific part of the Ruckus SmartZone configuration only.

• Please refer to the Passpoint Administration Guide for instructions on how to configure the end-to-end Passpoint service.

• Please refer to the original Ruckus documentation for complete instructions on Ruckus SmartZone WLAN Controllers configuration.

Warning

• The Ruckus configuration is focusing on Passpoint v1.0.

• All properties must share the same NAI realm, RADIUS IP / port settings and SSID name for the Passpoint service (CustomerPasspoint).

• Each property requires a separate RADIUS secret and NAS identifier, both generated when a configuration is activated within the Trusted WiFi management platform.

Core Passpoint Settings

• Log into Trusted WiFi, then click on the Properties icon in the left menu to view the properties list.

• Select or search for the property you wish to work on. This will open its deployments page:
  

• Click on the Passpoint tile and then click on the Configuration option in the left menu to display the Passpoint settings summary as per the example below:
  

• Take note of the details for your respective installation as they will be required at a later step.

Ruckus SmartZone Configuration

RADIUS

• Proceed to Security > Authentication > Proxy (SZ Authenticator) > Create to display the page below:
  

• Complete the fields as per the property RADIUS settings and click OK.

  Field	Description
  Name	Enter the name of the Server.
  Friendly Name	Enter the Friendly Name. It should match the SSID name to ensure Passpoint connection is seamless.
  Description	Enter an optional description.
  Service Protocol	Select the RADIUS radio button.
  Primary Server
  IP address	Enter the <Primary RADIUS IP> from Trusted WiFi.
  Port	Enter the < RADIUS Authentication Port> from Trusted WiFi.
  Shared Secret	Enter the < RADIUS Shared Secret> from Trusted WiFi.
  Confirm Secret	Re-enter the <RADIUS Shared Secret> from Trusted WiFi.
  Secondary Server
  Back RADIUS	Enable the Secondary Server toggle.
  IP address	Enter the <Secondary RADIUS IP> from Trusted WiFi.
  Port	Enter the < RADIUS Authentication Port> from Trusted WiFi.
  Shared Secret	Enter the < RADIUS Shared Secret> from Trusted WiFi.
  Confirm Secret	Re-enter the <RADIUS Shared Secret> from Trusted WiFi.

Wi-Fi Operator

• Click on Services> Hotspot & Portals > Hotspot 2.0 to display the page below:
  

• Under the Wi-Fi Operator heading, click +Create to display the page below:
  

• Complete the fields as per the description below and click OK to save the Operator configuration:

  Field	Description
  Name	Enter the desired Name.
  Description	Enter an optional description.
  Domain Name	Enter the first Domain Name as per the Trusted WiFi settings and click +Add to save.
  Language	Select the appropriate language from the pull-down list and add the SSID as the Friendly Name. Click on the +Add to save.

Identity Provider

• This configuration enables authentication and accounting. The table below details the items for the Service Provider setup (listed as Identity Provider in the Ruckus configuration).

  Option	Required	Data Source	Description
  Name	Y	Installer’s own	Name of Identity Provider
  Description		Installer’s own	Description of the Identity Provider
  Realms	Y	Trusted WiFi settings	List of Network Access Identifiers (NAI) realms corresponding to the Service Providers or other entities whose networks or services are accessible via this AP.
  Authentication Realm	Y	Installer’s own	RADIUS realm for “No Match” and “Unspecified”

• Under the Identity Providers heading on the same screen, click +Create to display the page below:
  

• Complete the fields as per the description below and click OK to save the Operator configuration:

  Field	Description
  Name	Enter the desired Name for the RADIUS service.
  Description	Enter an optional description.
  Realms	Configure the first Realm information (NAI in Settings). Enter the Name of the Realm. Enter Encoding values RFC-4282. Enter the EAP method as EAP-TTLS. Click the +Add to save.

• Click the Next button to display the page below:
  

Warning

Since this configuration is designed for Passpoint v1.0, no configuration is required and therefore the user should not Enable Online Signup & Provisioning.

• Click the Next button to display the page below:
  

• Click on No Match Realm and then click on the Configure button to display the page below:
  

• Select the correct RADIUS service for this realm from the drop-down list and click OK to save.

• Repeat the previous steps for the Unspecified Realm and click OK to save.

• Click Next to display the page below:
  

• Select the Accounting tab to configure the accounting ports and toggle the Enable Accounting On, which will allow the default port to be used for this RADIUS service as per the Trusted WiFi settings.

• Click Next to display the page below:
  

• Once satisfied with the configuration, click OK to save.

Passpoint WLAN Profile

• From the menu, go to the Networks > Wireless > Wireless LANs section to display the page below:
  

• Select the appropriate Zone from the side menu and then click on Create. Fill in the screen as follows
  

• Complete the fields, as per the description below:

  Field	Description
  General options
  Name	Enter the name of the Service.
  SSID	Enter the name of the SSID.
  HESSID	Not required.
  Description	Enter an optional description.
  WLAN Group	Default, or can be changed to the installer’s group if required.
  Authentication options
  Authentication Type	Check the Hotspot 2.0 Access radio button.
  Method	Check the 802.1x EAP radio button.
  Encryption Options
  Method	Check the WPA2 radio button.
  Algorithm	Check the AES radio button.
  802.11r	Default is off, but the installer can decide to enabled it if required at the property.

• Scroll down to the Hotspot 2.0 Profile section:
  

• Click on the + to create a new Hotspot 2.0 WLAN profile and display the page below:
  

• Complete the fields, as per the description below:

  Field	Description
  Name	Enter the WLAN profile name.
  Description	Enter an optional description.
  Operator	Select the operator from the drop-down list.
  Identity Provider	Select the identity providers from the pull-down list (which were previously configured) and select Add.

• Click OK to save the configuration.

• Under the Advanced Options section, ensure you configure the VLAN you have setup.

• Click OK to save this WLAN.