Ruckus schools

[cookie_monster]

Anyone running Ruckus wireless in the Derbyshire/Greater Manchester area?

 

I'd like to see it in action and ask a few questions.

 

Cheers.

[Edu-IT]

Not in that area but would be willing to answer any questions you have.

[cookie_monster]

Hi. I'd like to know about how it might work with RADIUS or if it has it's own method of allowing you to control how clients access the wireless network.

 

I'll give an example of what I mean.

 

1. Allow notebooks that are on our domain to connect to the wireless without needing to enter WPA keys and so on manually.

 

2. Allow students to bring in their own notebooks and connect to the wireless. I'd like to be able to VLAN this traffic straight to our Smoothwall without it seeing our network so they just get internet access.

 

3. Similar to 2. but maybe without the WAP being complety open, would there be a way to allow simple access, basically so with minimum fuss students could get their notebook on the network but people in the car park couldn't

 

Hope that all makes sence.

 

Thanks for the reply.

[Edu-IT]

Hi. I'd like to know about how it might work with RADIUS or if it has it's own method of allowing you to control how clients access the wireless network.

 

I'll give an example of what I mean.

 

1. Allow notebooks that are on our domain to connect to the wireless without needing to enter WPA keys and so on manually.

 

2. Allow students to bring in their own notebooks and connect to the wireless. I'd like to be able to VLAN this traffic straight to our Smoothwall without it seeing our network so they just get internet access.

 

3. Similar to 2. but maybe without the WAP being complety open, would there be a way to allow simple access, basically so with minimum fuss students could get their notebook on the network but people in the car park couldn't

 

Hope that all makes sence.

 

Thanks for the reply.

1. You could have an open SSID and then authenticate by AD? I'm not sure that this would be the most secure thing to do though. There's also an auto setup script that you may be able to utilise in some way to save manual configuration. What we've done here is setup a 'Curriculum' SSID and input the key on the laptops as once it's in, it's in. We then have a seperate SSID for staff laptops and such like where they can generate their own keys through a Ruckus page. Each key is then unique to the staff member and we can disable it at any time.

 

2. You can easily VLAN different SSID's.

 

3. You could do the same as 1. Allow students to request a wireless key through the portal page, this requires AD authentication. Then have them enter this key into their notebook and job done. No AD username/password = no access.

Edited January 20, 2010 by Edu-IT

[cookie_monster]

Would i be able to use example 3 if the student VLAN was seperate from the windows network so the ruckus page could contact AD to authenticate the password and generate the ket but the student still couldn't see to school network once logged on?

 

Thanks.

[Edu-IT]

That one I couldn't tell you as I haven't done it. The Ruckus controller would need to be able to communicate with AD in some way to verify that the login details are correct. As long as it can do that.

[White_Fi]

Would i be able to use example 3 if the student VLAN was seperate from the windows network so the ruckus page could contact AD to authenticate the password and generate the ket but the student still couldn't see to school network once logged on?

 

Thanks.

 

Yes you would you use the ZD to create a Layer3-4 ACL an attache that to the SSDI in question.

 

Regards

Stuart

[mattpant]

I have got a feature request with Ruckus where it will allow you to enter the proxy server (Smoothwall address) VIA the ZoneDirector and do some kind of Auto-Proxy as seen on other Managed Wireless systems so students can bring in their own notebooks like you mention, connect to the "Student" SSID and connect to the net without having to configure anything, at the moment they have to manually enter the proxy server details into Internet Options which is a little messy!

 

Unless anybody has got any other thoughts on how it can be done now.

 

I also beleive that to be able to do "Example 3" and generate a key per student, the students would first need to connect there netbooks up to the school network via a normal CAT5 cable plugged in before it would work.

 

Cheers

 

Matt

[Edu-IT]

That is correct Matt about the cable unless you could somehow have an open SSID that could only go to the key generation page.