ruckus guest connections

[browolf]

I'm confused about the ruckus guest network feature.

 

Having some connectivity issues with the guest and nowhere in zone director can i find information of what ip address the ruckus is using on the guest vlan.... well its making it hard to figure out whats happening. anyone know how to know?

[Haptic]

Where did you buy the equipment from and have you got support with them?

 

I am seeing this more and more - if you have and you bought it from a reputable reseller they will be able to help. Make use of them!

 

Hope it helps.

 

 

Chris

[localzuk]

The IP of the controller is the same all the time for us - on all our WLANs.

 

However, each vlan is on its own subnet, with IP segregation enabled but a few IPs allowed through via ACLs (to get to things like the proxy server).

[browolf]

The IP of the controller is the same all the time for us - on all our WLANs.

 

However, each vlan is on its own subnet, with IP segregation enabled but a few IPs allowed through via ACLs (to get to things like the proxy server).

 

we have the main secured wireless on

 

vlan 1 with address 192.168.x.x / 255.255.0.0

 

the unsecured guest on

 

vlan 5 with address range 10.168.201.x /255.255.240.0 + proxy on this subnet.

 

the known ip of the controller is on the 192.168 range.

[localzuk]

So, what's the problem? The IP for the controller is the normal one, wherever you have it.

[browolf]

i don't get how a device with a 192.168.x.x talks to a proxy with a completely different address/subnet...

[localzuk]

That needs to be handled by stone form of router, to do the inter-vlan traffic. The ruckus device won't do it.

[browolf]

That needs to be handled by stone form of router, to do the inter-vlan traffic. The ruckus device won't do it.

 

the ruckus controller is attached to a switch port that is tagged on both vlans. could that be how?

[localzuk]

No. There still needs to be a layer 3 router to pass traffic between the 2 subnets. Otherwise, they are effectively 2 separate networks sharing the same switch.

 

What switch do you have at your core?

[neilmac]

Switching and VLANS occur at layer 2. If you want to go from one IP range to another, you need to do this at layer 3, usually via the router / default gateway.

 

Why would you want to access the Zone Director from a guest SSID anyway ?

[browolf]

Switching and VLANS occur at layer 2. If you want to go from one IP range to another, you need to do this at layer 3, usually via the router / default gateway.

 

Why would you want to access the Zone Director from a guest SSID anyway ?

 

 

not as such but we have a connectivity issue between devices on the guest wireless and the guest proxy and it would be useful to be able ping from the proxy to the ruckus controller. the guest wireless is tunnelled from the APs to the controller. however it appears that the setup is perhaps not as I imagine it to be.

 

 

re core switch. its a 3com fibre switch but cant remember the model.

[neilmac]

Traffic isn't normally tunnelled back to the controller, it normally is distributed directly out of the switch port.

 

Can you describe the problem in any more detail ?

 

When troubleshooting, begin at layer 1, then layer 2, then layer 3. You can also run connection tests from the zone director, also check the controller logs. You should run a test to something on the same VLAN before going to a different subnet. If you can, set up iPerf or use the zapperf in the zone director. As pointed out, if you suspect the wifi, the first port of call is always the guy who sold it to you. Discuss the problem with your reseller.

 

By the way, what encryption settings do you have on the problem SSID ?

 

NM

[catch21]

I'm confused about the ruckus guest network feature.

 

Having some connectivity issues with the guest and nowhere in zone director can i find information of what ip address the ruckus is using on the guest vlan.... well its making it hard to figure out whats happening. anyone know how to know?

 

That's because the Ruckus ZD doesn't care what IP range you are using on your guest vlan.

[browolf]

Traffic isn't normally tunnelled back to the controller, it normally is distributed directly out of the switch port.

 

Can you describe the problem in any more detail ?

 

When troubleshooting, begin at layer 1, then layer 2, then layer 3. You can also run connection tests from the zone director, also check the controller logs. You should run a test to something on the same VLAN before going to a different subnet. If you can, set up iPerf or use the zapperf in the zone director. As pointed out, if you suspect the wifi, the first port of call is always the guy who sold it to you. Discuss the problem with your reseller.

 

By the way, what encryption settings do you have on the problem SSID ?

 

NM

 

because not all the switches the APs are connected to are enabled with the guest vlan, the guest config in zone director is set to "tunnel mode".

 

it seems to be zone director merely acts as a gate between guest devices and the guest vlan and doesnt have an actual presence on the guest vlan.

 

there is no encryption on the guest ssid.

 

the problem is the login page which is supposed to auto redirect to google doesn't. it just hangs on redirecting. makes the guest a bit pointless if the internet doesnt work

[IrritableTech]

I've just taken the following from a support document... https://support.ruckuswireless.com/documents/187-zoneflex-9-3-release-notes/download

 

VLAN, Dynamic VLAN, and Tunnel Mode

5.2.41 If the VLAN, Dynamic VLAN, and Tunnel Mode features are all enabled and they have

conflicting rules, ZoneDirector prioritizes and applies these three features in the following order:

1. Dynamic VLAN (top priority)

2. VLAN

3. Tunnel Mode

 

So if your guest WLAN is tagged with a VLAN, tunneling might not work. May not apply in this case, but worth noting perhaps.

 

I'd guess the redirection isn't working, because the clients can't find your proxy - due to the fact their is no routing going on?

 

Out of interest, if you have the guest wireless use tunneling, and you configure your zone director second nic in your guest ip range / vlan - Is the ZD able to route the traffic over? Just thinking out loud here - I've never tried it.

 

If I've got the wrong end of the stick could you perhaps clarify everything? IP ranges - vlans - what is tagged where - a diagram might help too.

[browolf]

I've just taken the following from a support document... https://support.ruckuswireless.com/documents/187-zoneflex-9-3-release-notes/download

 

 

 

So if your guest WLAN is tagged with a VLAN, tunneling might not work. May not apply in this case, but worth noting perhaps.

 

I'd guess the redirection isn't working, because the clients can't find your proxy - due to the fact their is no routing going on?

 

Out of interest, if you have the guest wireless use tunneling, and you configure your zone director second nic in your guest ip range / vlan - Is the ZD able to route the traffic over? Just thinking out loud here - I've never tried it.

 

If I've got the wrong end of the stick could you perhaps clarify everything? IP ranges - vlans - what is tagged where - a diagram might help too.

 

dynamic vlan is not enabled.

 

the strange thing is, if I turn off auto-logon on ios, I can get connected to the guest network, the phone gets an ip from the proxy box dhcp and I can see the proxy using fing network scanner app.

[browolf]

I've managed to sort out the problem.

 

basically by making a new guest network that doesn't use the type "guest access" . Just a standard usage with no security. This is the same as how we had the guest on the pre-ruckus wireless. Not sure why the other guest mysteriously stopped working.