Ruckus DPSKs and Smoothwall RADIUS accounting

[Rilot]

I've recently switched my BYOD WiFi over to DPSKs for our boarding school. Each student has their own DPSK that they can use to add their devices to the network.

Ruckus identifies the username via DPSK and ties it to an IP address. I can see each user's activity in the Ruckus console.

 

The problem is that Smoothwall cannot identify the user, only the IP address.

 

I have set up Smoothwall as a RADIUS accounting server and have Ruckus vSz forwarding accounting to the Smoothwall but I cannot get this to identify the users. I can see accounting traffic coming in to the Smoothwall on 1813 and being accepted.

 

I feel like I'm missing something here.

[TechMonkey]

I think our supplier set up a policy that resolved this, as well as something to allow Entra groups to work.

Having taken a look, in the policy our Radius Attribute Group is set to a specific set of variables, but this is a drop down so I'm not sure where that is set. The one i think it is is

User-Name: 'DOMAIN\${USERNAME}'

Where DOMAIN is your AD domain.

 

EDIT: Found it. In policies of CloudPath there is a second tab that is for RADIUS Attribute Groups. Set one up and you can create additional Attributes.

Edited January 30 by TechMonkey
Add findings

[Rilot]

Thanks buy no joy. I think something else must be going on.

Are the vendor specific strings documented anywhere for Smoothwall? I can't find anything about them on their documentation.

[tom_newton]

Should be fairly permissive as to what we accept... I'd say fire in a support ticket as, it sounds like you;ve done everything right so far.

 

Have you got the auth set to "core auth" on the web filter that you're using? 

 

Only further diag I would do is a bit of packet capture on the smoothie to see if the usernames are in the packet, and maybe a bit of snooping in the logs to see if theres anything super obvious.

 

Techmonkey has a point up there that will become germane if we get to the stage of usernames but no groups.. but we are a step behind that.

[Rilot]

Thanks Tom. Core Auth is set up. I'll send in a ticket once I've cleared this week's backlog of iPad issues......... it never stops.

[tom_newton]

Did you ever submit a ticket for this? Have you got it resolved?

[dhicks]

On 30/01/2026 at 14:38, Rilot said:

Are the vendor specific strings documented anywhere for Smoothwall? I can't find anything about them on their documentation.

 

As far as I could figure out, you just need "UserName" and "FramedIPAddress", as defined in RFC2865. Some example code that might come in handy:

 

https://github.com/dhicks6345789/radius-user-client/blob/main/client.go

 

The above is for a client application to pick up the username from the local machine and send it to the Smoothwall server. We seemed to be able to get the client sending user details via RADIUS, but for some reason the Smoothwall server would seem to treat each new RADIUS message as needing to expire / log out all other RADIUS-athenticated users - if you checked on the "User Activity" screen you could see users listed, but only one at a time could be live. We never did get to the bottom of what the issue was.

[mtaylor1]

I'm running into this same problem on my network now. Were you able to get this resolved in the end?

 

Thanks