How can I discover the Ruckus ZoneDirector so I can use a Web browser to see the Web UI?

You can always locate the Ruckus ZoneDirector using a UPnP client application, which is available on all Windows XP systems. Go to the ‘My Network Places’ window and make sure the ‘Show icons for networked UPnP devices’ is enabled. Once the Ruckus ZoneDirector icon appears, double-click the icon to start your default browser to connect to the management page. Or, right-click on the Ruckus ZoneDirector icon, select Properties and find the Device Address. And then manually enter the IP address onto the address bar of your browser.

Note that UPnP requires that your administrative PC be on the same IP subnet of the Ruckus ZoneDirector. Also note that in factory default state, and in case the ZoneDirector is NOT connected to a network with a DHCP server, ZoneDirector assigns itself the address of 192.168.0.2.

How can I turn on the UPnP service on my Windows XP system?

On a Windows XP PC, open the ‘My Network Places’ window by clicking Start and choosing ‘My Network Places’. In My Network Places window, Network Tasks column, click Show icons for networked UPnP devices. If a confirmation dialog box appears, click Yes to proceed. Windows will run a wizard to activate the UPnP feature.

In case your Windows XP system doesn’t have the SP2 patch applied, you may need to enable the UPnP by the following steps: Click Start, select Control Panel, and double-click Add/Remove Programs. Click Add/Remove Windows Components in the left-side column. After Windows Components are loaded, scroll down to Networking Services, select Network Services and click Details. Check UPnP User Interface and then click OK.

What browsers are supported by the ZoneDirector Web UI?

• Internet Explorer 6 and later

• FireFox 1.5 and later

How do I know if the access points are up and running?

On the ZoneDirector Web UI click Monitor tab and select Access Points in the left-side column. You can check the Status of all APs.

Do I need to buy a special wireless interface card for my computers/laptops to connect to the Ruckus WLAN?

No. The Ruckus WLAN solution is 802.11b/g standards compliant.

Do I have to connect the AP directly to the Director?

No. Any Layer 2 devices (Ethernet hub and switches) can be used in between Ruckus AP and Director.

Can the AP and the Director be put in different IP subnets?

Not at this point. In this release ZoneDirector and all the APs have to be on the same layer 2 network and the same subnet.

Our network utilizes VLAN tagging. Does the Ruckus Wireless network support VLAN?

Yes. To apply VLAN tags for packets in a WLAN, click Configure tab on the ZoneDirector Web UI, click the WLANs button in the left-side column, and then click Edit for the WLAN. Check the Attach VLAN tag checkbox and specify the desired VLAN number.

How do I configure my switch to work with the Ruckus ZoneDirector?

Specific configuration varies of-course based on the switch vendor. If you do not use VLANs then all you need to do is connect all the APs and the ZoneDirector to the switch(es). If you do use VLANs then make sure the native VLAN on each port (that is connected to the APs and the ZoneDirector) is the management VLAN and also that each port has trunk enabled.

See below for a sample configuration from a Cisco Catalyst 2950 running IOS software version 12.1(14). In this example there are 3 access points and 4 SSIDs. Each SSID is mapped to a different VLAN (11, 21,31, and 41) and the management VLAN is 172.

!

vlan 11,21,31,41,172

!

interface FastEthernet0/13

switchport access vlan 172
switchport trunk native vlan 172
switchport trunk allowed vlan 11, 21,31,41,172
switchport mode trunk
no cdp enable

!

interface FastEthernet0/14

switchport access vlan 172
switchport trunk native vlan 172
switchport trunk allowed vlan 11, 21,31,41,172
switchport mode trunk
no cdp enable

!

interface FastEthernet0/15

switchport access vlan 172
switchport trunk native vlan 172
switchport trunk allowed vlan 11, 21,31,41,172
switchport mode trunk
no cdp enable

!

interface FastEthernet0/16

switchport access vlan 172
switchport trunk native vlan 172
switchport trunk allowed vlan 11, 21,31,41,172
switchport mode trunk
no cdp enable

!

Which networking, security and AAA equipment should I use with ZoneFlex?

The Ruckus ZoneFlex APs and Director integrate seamlessly with a variety of networking, security and AAA infrastructure.

• Linksys SRW2008MP (8 Ports)
• NetGear FS726TP (24 Ports)
• D-Link DES1228P (24 Ports)
• TrendNet TPE-S88 (16 Ports)
• Nortel 470-24T-PWR (24 Ports)

• Cisco Catalyst 3750
• Linksys SRW2008MP
• Nortel Switch 2424-SSL

• FreeRadius
• Juniper (Funk) Steel-Based RADIUS (SBR)

Microsoft ActiveDirectory (AD) – Ruckus ZoneDirector can also authenticate users directly with ActiveDirectory.

How do I set Country Code for ZoneDirector and the ZoneFlex APs?

• ZoneDirectors ship with no country code settings (they have no radios).
• As part of the installation wizard, the admin configures the country code for ZoneDirector and the ZoneFlex system
• Any later configuration change to the country code on ZoneDirector will reboot all APs and will force them to go through the steps below

• ZoneFlex APs are shipped in two formats depending on the country being shipped to:
  • With a fixed US country code setting to the US (fixed country code cannot be change by customers – even through factory default)
  • With country code that is selectable to the country outside of the US

• When an AP tries to join a ZoneDirector the country code is being synchronized as follow:
  • If the country code on the AP matches the one on ZoneDirector then the AP can join the Director
  • If the country code on the AP is not the same as the one on ZoneDirector then the Director will set the country code on the AP
    • If the country code setting was successful the AP will reboot and then join the Director
    • If the AP has a fixed country code already set (e.g. US) then this operation will fail and the AP will not be able to join the Director. This will be logged on ZoneDirector.

My site-survey tool shows a weak signal for the Ruckus APs. What should I do?

Typical site survey tools are assuming Omni antennas on the APs and measure signal strength as opposed to real-life throughput. The Ruckus AP is using a smart directional antenna array that many times perceived as having weak signal or limited coverage. The strength of Ruckus BeamFlex is the focusing the directional antennas only to where traffic is being sent and by that achieving higher performance and reducing interference. So when the site survey tool shows a “weak signal” it’s not really measuring the right thing.

One way to overcome this problem is to use the site survey tool (such as AirMagnet) in “associated mode”. In this mode the tool is expected to associate with the AP to perform the coverage testing and thus will force the Ruckus smart antenna to choose an antenna pattern pointing to the relevant client. In order to truly measure the wireless coverage it is recommended to perform a performance test across the desired coverage area.

Is the Ruckus ZoneDirector sitting on the data path?

Ruckus ZoneFlex is using a “split-MAC” architecture. The AP is handling all control traffic and probe requests/responses as well as the data path. The Director is involved in other management traffic.

In a typical session, the traffic flow would like as follow

What is Zero-IT Wireless Activation?

If Zero-IT Activation is enabled for a WLAN, when a user connects to the Wireless Connection Activation page (https://ZoneDirector IP or URL/activate) using his web browser and enters a valid user name and password, the Ruckus ZoneDirector automatically generates a custom-provisioned configuration installer (including the SSID and a unique passcode), and certificate if needed, for the user to download. Once the user executes the configuration installer, the PC will automatically connect to the provisioned wireless network with the correct policies. By default, Ruckus ZoneDirector has the Zero-IT Activation enabled for the WLAN created on the Setup Wizard.

In this release, Zero-IT Wireless Activation works with Windows XP SP2.

I am using a PC that is not running WindowsXP with SP2. How do I configure it to connect to the wireless network?

If the Zero-IT Activation is enabled on the WLAN, the user can connect to the Ethernet network, either through the intended client station or a different device. From the Wireless Connection Activation page (https://ZoneDirector IP or URL/activate) enter the user name and password. Once the configuration installer downloading page appears, rather than downloading the installer, the user should select the manual configuration button. A browser window with manual configuration instructions for the user will pop up. The user can follow the instructions to configure the wireless device.

I ran the wireless config installer but my PC still doesn’t connect to the wireless network. From my wireless configuration tool I didn’t notice any change made by the installer. What should I do

Make sure that Windows is in control of configuring this wireless interface. You can do so by open Windows Network Connections window, and right-click on the Wireless Network Connection entry, select the Properties button to open the “Wireless Network Connection Properties” window, click the Wireless Networks tab, and check the box of ‘Use Windows to configure my wireless network settings’. You should also disable the wireless adapter vendor’s management software to avoid conflicts in controlling your wireless interface. If you prefer to use the configuration tool provided by the wireless adapter vendor, you may need to follow the manual install instructions as for non-XP systems above.

How can I generate a guest pass for visitors?

Point your web browser to (https://ZoneDirector IP or URL/guestpass). Enter a valid user name with guest pass generation privilege. Then fill the details requested for the guest including name and length of pass.

Which user has the guest pass generation privilege?

Each user account entry has a “role” associated with it. The guest pass privilege is configurable for each role entry.

The system default role has the guest pass generation privilege enabled.

How long is a guest pass valid? Can I set my own time limit?

The time limits are configurable when you generate a guest pass.

Can more than one visitor share the same guest pass?

Yes.

What is Dynamic PSK? Is it secure?

The Ruckus Dynamic PSK mechanism automatically creates a unique pre-shared key (PSK) for each user when he/she activates the WLAN access the first time. The user will immediately lose access when the PSK becomes invalid, either because the PSK entry is deleted or when the internal user account is deleted, by the administrator.

The Dynamic PSK has a configurable lifetime, and the default lifetime is 2 months. Once the key expires, the next time the user tries to access the network, he/she will not be able to access the network. All Web traffic will be redirected to the wireless web portal page on the ZoneDirector and the user has to sign in again to obtain a new dynamic PSK.

Dynamic PSK is easy to manage and solves the security concerns with shared PSK. For example, when a user leaves the organization, the shared PSK would have to be changed (for all users) to maintain network security. A unique dynamic PSK eliminates this hassle.

What is the passphrase used for when I have DynamicPSK?

While it is strongly recommended to use the unique key for all users, sometimes an admin might choose to use a common passphrase/key.

As a security best practice Ruckus recommends to always use the unique key given its length (63 bytes) and the fact it is tied to a specific user and a specific machine (MAC address). An admin should not disclose the generic passphrase to the user community.

However, on endpoints where the automatic download of DynamicPSK is not supported that means the user will need to enter manually a very long key. In these cases an admin might choose to allow the use of the generic passphrase – this is a tradeoff between ease-of-installation and security.

Can anyone get on my Guest wireless network?

The default configuration doesn’t enable any encryption on the Guest wireless network. But all traffic is blocked by ZoneDirector until the correct guest pass or user login information is entered.

What is the difference between WPA and WPA2? Is WPA2 more secure than WPA?

WPA and WPA2 are marketing terms defined by the WiFi Alliance. WPA certification process adopts the early draft of IEEE802.11i, and WPA2 certification follows the 802.11i standard. In terms of security, they are similar.

What is a rogue AP? Why is it a security issue?

A rogue AP is a foreign Access Point within your radio coverage that is not managed by your WLAN system. It can simply be your neighbors’ WLAN device or another AP connected to your internal corporate network providing wireless access. Your neighbors’ AP may cause some corporate clients to connect to it by mistake and reveal confidential information. An unmanaged AP that connects to the internal network can compromise security policies the network administrators have applied. For example, an intruder might be able to connect to the corporate internal network from the parking lot.

My neighbor’s AP keeps showing up as a Rogue AP. Is there a way to change that?

Click the Monitor tab on the ZoneDirector Web UI, and then click Rogue Devices in the left-side column. In the Currently Active Rogue Devices table, click Mark as Known for the desired rogue AP entry. The foreign device won’t be logged or show up on the Map View page as a rogue AP any more.

There are some unknown users repeatedly connecting to my Guest network. How can I stop them from connecting to the network?

Click the Monitor tab of ZoneDirector Web UI, and click Currently Active Clients in the left-side column. Choose the relevant client and click ‘Block’ to stop any AP from forwarding traffic for the specific client.

We choose to use 802.1x EAP as the authentication mechanism for our corporate wireless network. How can the client certificates and/or root certificates be downloaded to the client devices?

If the Zero-IT Activation is enabled for the WLAN, the provisioned configuration installer downloading page contains the generated client certificate and/or root certificate for the user. The user can download the certificates as follows: on a Windows XP system, the user can double click the downloaded certificate and the certificate install wizard will show up. The user then only needs to choose all default settings to have the certificate installed. Afterwards, the user can execute the configuration installer to connect to the wireless network.

Can I utilize the user accounts database stored in a Microsoft ActiveDirectory server?

Accounts in an ActiveDirectory server can be used to authenticate wireless network users. Click the Configure tab, and then click the Authentication Servers button in the left-side column. Create a new AD server and fill in the AD server information. You can also test your configuration at the bottom of the Authentication Servers screen.

Then go to the WLAN configuration page and to your existing or new WLAN. Check the ‘Enable captive portal / web authentication’ checkbox and choose the AD server you just created from the drop-down menu.

How can I utilize the user accounts database stored in a RADIUS server?

Accounts in a RADIUS server can be used to authenticate wireless network users. Click the Configure tab, and then click the Authentication Servers button in the left-side column. Create a new RADIUS server and fill in the RADIUS server information. You can also test your configuration at the bottom of the Authentication Servers screen.

Then go to the WLAN configuration page and to your existing or new WLAN. Check the ‘Enable captive portal / web authentication’ checkbox and choose the RADIUS server you just created from the drop-down menu.

You can also use the RADIUS server for 802.1x authentication. Check 802.1x/EAP and choose the created Authentication Server from the drop-down menu.

How can I have the AD server and the RADIUS server to share the same user account database?

Many RADIUS servers can utilize user accounts stored in an AD server. For example, a computer running both AD server and IAS server can have AD and RADIUS share the same user database. Please refer to the server’s configuration manual for this task.

I removed a user entry from the external authentication server. But the user may still connect to the wireless network. How can I disconnect the client?

From the ZoneDirector Web UI, click the Monitor tab, and then click the Generated PSK/Certs button in the left-side column. Delete any keys or certificates that generated for the user. The user will lose the accessibility immediately.

How many concurrent users are supported when authenticating against AD or RADIUS?

The ZoneDirector supports up to 1,250 concurrent users. This is true also in the case where users are authenticated against AD or RADIUS.

I clicked the Map View button under the Monitor tab, but nothing showed up. What happened?

In most cases the user will be prompted to download the necessary version of Java Runtime Environment (JRE). Alternatively, check your system has JRE 1.5 (or 5.0) or above. If not, you can manually download the latest version from here

How can I use my own floor map on the Map View page?

On the ZoneDirector Web UI, click Configure tab and then click Maps in the left-side column. You can import your own floor map from there.

I have our own floor map imported, how can I let the system know the scale of the map?

On the Map View page under the Monitor tab, the lower right corner contains a ruler which represents the scale of the map. You can stretch or shorten the ruler line for adjustment.

I clicked the Show Rogue button on the Map View page, but the number of rogue devices shown on the map is fewer than the total number detected. Where are the others?

Rogue devices with weak signals may be shown away from center of the map. You can try to zoom in on the map. Some rogue APs may be shown on top of otheres if the relative separation is small. Another reason could be some APs transmit multiple SSIDs.

How can I see the radio coverage of my APs?

On the Map View page under the Monitor tab, you should move all AP icons to the correct location on the map. Choose the closest deployed environment at the lower-right corner. Then you can display the estimated radio coverage by clicking ‘Yes’ in the coverage line at the upper-left corner on the page.

Are event log entries saved over reboot?

The ZoneDirector 1000 stores 500 events internally, and they are preserved over reboot and power loss. The log is circular – new events will overwrite old ones after the 500 events limit has been reached.

How can I export the log entries from the Director?

All the events can be sent to a syslog server. On the ZoneDirector Web UI, click the Configure tab and then click System in the left-side column. In the Log Settings section, choose the desired log level and check the Enable remote syslog box, and provide the IP address. Then click the Apply button.

Which access points are supported by ZoneDirector?

The ZoneFlex 2942 and the ZoneFlex 2925 can both be managed by ZoneDirector. The software release on the APs must be 4.2 or above.

Can I manage a non-Ruckus access point with ZoneDirector?

No.

Can a ZoneFlex access point be managed by a 3rd party controller?

No.

Where can I find the user manual for Ruckus ZoneDirector?

On the ZoneDirector Web UI, click the Help button at the upper-right corner. From there, you will be able to find the detailed task-oriented configuration manual. The Quick Start Guide and instructions for logging into the WLAN as either a new user or a guest can be linked from there too.

I still have questions on the wireless devices. Who should I contact?

On the ZoneDirector Web UI, click the Dashboard tab. Look for the Support section. The support contact information is listed there.

How long does a software upgrade take for a ZoneDirector network?

The entire software upgrade process for the ZoneDirector and all the ZoneFlex APs under its control should take less than 10 minutes, which is ZoneDirector upgrading all APs, and APs rebooting and discovering ZoneDirector. The APs are upgraded concurrently and not serially.

Does the ZoneDirector support failover? If yes, how does it work?

You can have two ZoneDirectors on the network at the same time with one of them acting as a failover for the primary. Current ZoneDirector failover implementation involves manually loading the configuration from the primary to the secondary ZoneDirector. For instance, if “ZD Y” is the failover of “ZD X” then the administrator has to upload the configuration from “ZD X” to “ZD Y” from time to time. Changes made to the ZD X’s configuration since the last configuration upload will not reflect in the wireless system if the “ZD X” ever goes down. Also note that both ZoneDirectors should be operating on DHCP IP address for the configuration upgrade to work.

I am not able to make ZF2925/ZF2942 AP join the ZoneDirector’s network when both of them are connected through a network switch. But when I connected AP directly to the ZoneDirector it joined. Why?

There likely is a problem on the network switch placed between the AP and the Director. If VLAN configuration error can be excluded from the switch, one possibility there is an Ethertype filter configured in the switch. AP and the ZoneDirector communicate using messages with an Ethertype value of “88bb”. Make sure the network switch placed between the ZoneDirector and the APs is not filtering out these packets.

How will the APs pick the ZoneDirector if we have more than one ZoneDirector on our network?

APs send out LWAPP discovery messages before joining the ZoneDirector’s network. All the available ZoneDirectors will respond to these messages. These responses contain the number of APs currently joined on each of them. Based on that information APs will pick the ZoneDirector with least number of APs. If an AP has joined a particular ZoneDirector previously it will re-join again.

Can I discover ZoneDirector on from a Windows 2003 machine?

Windows 2003 server lacks support for UPnP device discovery which is essential to discover ZoneDirector on your layer2 network.

How do I discover ZoneDirector from a Windows Vista machine?

Make sure that “Network Discovery” option is enabled on the Control Panel -> Network and Sharing Center. Then you can click on “View computers and devices” link on the left hand side navigation pane to see the ZoneDirector.

How do I enable external antenna on a 2942 AP that is under ZoneDirector control?

Login to the 2942’s CLI using ZoneDirector’s login credentials and type “set extant wlan0 enable” command.

What external antennas can I use with the ZoneFlex 2942 AP?

For best performance it is recommended to use the internal smart antenna with BeamFlex technology. However, in some cases (e.g. covering an outdoor area through a window) it might be useful to use the external antenna connector on the ZoneFlex 2942 AP.

The ZoneFlex 2942 AP was certified with a 9dBi external antenna. The external antenna connector is RP-SMA (Reverse-Polarized).

Examples include:

External Antenna (Indoor) – 6dBi / 2.4GHz Omni Directional, RP-SMA connector (Laird Technologies part number: IG2450-RS36) – http://lairdtech.thomasnet.com/item/megasphere-8482-and-microsphere-8482-/megasphere-8482-/pn-5255?&seo=110

External Antenna (Indoor) – 9dBi / 2.4GHz Patch, RP-SMA connector (Laird Technologies part number: ID2450-RS36) – http://lairdtech.thomasnet.com/item/megasphere-8482-and-microsphere-8482-/whisper-8482-/pn-5310?&plpver=10&origin=keyword&by=prod&filter=0

9dBi Omni Rubber Duck RP-SMA – http://metrix.net/9dbi-omni-rubber-duck-rpsma-p-51.html

2.4GHZ Mobile Patch, V-POL 8DBI W/Suction Cup Base – http://metrix.net/24ghz-mobile-patch-vpol-8dbi-wsuction-cup-base-p-66.html

I have two buildings connected via two wireless bridges. What do I need to do to manage APs in both buildings via ZoneDirector?

Bridges may not be passing LWAPP traffic which is required to manage APs. In order to pass this traffic, you have to make sure the Point-to-Point connection mode is enabled on the each bridge linking these two buildings. Also sometimes you have to specify the MAC address of other bridge on each bridge.

Are there any mounting options available for ZF2942 and Zf7942 APs?

If you want to mount these APs from a drop ceiling you can use mount kit with part # 902-0156-0000 Most of our resellers carry this item.

Can ZoneDirector send email alerts?

ZoneDirector can send email alerts when a new rogue AP is discovered or when a managed AP is disconnected from the network. You can configure the alert settings by going to Configure -> Alarm Settings page.

Do you have a recommendation for detecting interference in the 2.4 GHz spectrum?

Cordless phones and microwaves are few examples that cause noise in the 2.4 GHz spectrum. It is a best practice to install the APs away from such interfering sources. MetaGeek makes a simple and portable USB tool called Wi-Spy to detect interference. It comes with an easy to use GUI.

Will the ZoneFlex 7942 802.11n AP be compliant with the 802.11n standard when it is ratified?

Yes. The ZoneFlex 7942 802.11n AP is compliant with draft 2.0 of the standard today.

The IEEE 802.11n standard is expected to be ratified in 2009. At that point, a software upgrade will be needed to comply with the standard. However, no hardware change will be required.

Can I disable mesh after it is enabled?

You can enable SmartMesh feature either from Startup Wizard or from the configuration screen. Note that you can not disable this feature once it is enabled via GUI. You have to factory reset and redo the settings to have a non-mesh setup.

How do I set a static IP once a ZoneFlex AP is managed by ZoneDirector?

Once a ZoneFlex AP is managed by ZoneDirector the IP settings can NOT be altered via GUI. You have to SSH to the ZoneFlex AP and login using the same username and password that you would use to login to the ZoneDirector. At the “rkscli:” prompt type “set ipaddr wan 192.168.15.29 255.255.255.0 192.168.15.1” where 192.168.15.29 is the IP address you want to assign, 255.255.255.0 is the subnet mask, and 192.168.15.1 is the gateway. Make sure the IP address assigned to the AP belongs to the same subnet as the ZoneDirector otherwise the AP will not be able to discover the Zonedirector.

What are the default settings to connect to console port on the ZoneDirector?

Baud rate: 115200 Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None

ZoneDirector Spanning Tree considerations

To prevent network loops when connecting both ZoneDirector Ethernet ports to the same wired switch, Spanning Tree (802.3d) is enabled by default on the ZoneDirector. In current releases, Spanning Tree cannot be disabled by the user.

When connecting the ZoneDirector to a Cisco switch port with spanning-tree portfast enabled, the Cisco switch port checks for incoming BPDUs, which will trigger a Spanning Tree topology change.

To prevent this from happening, disable spanning-tree bpduguard on the Cisco switch port.