Ruckus, Smoothwall & Radius

[stgoodyeara]

Ive been told that i can use my Smoothwall UTM 1000 as a radius server for my WIFI as long as the Smoothwall is providing DHCP & DNS for the wireless network and the wireless network is on its own VLAN. All these things are the case for me. The issue im having is that the clients connect to the WIFI are given an appropriate IP address but are never challenged for credentials and can't browse.

 

Heres what ive done:

 

Added My smoothwall as a radius server on my ruckus controller:

 

Created an SSID using 802.1x as authtication method choosing the smoothwall setting created above as the authentication server. Selecting VLAN2 as this is the vlan the smoothwall hands out DHCP & DNS for.

 

Added my ruckus controller to the WPA enterprise section of the smoothwall using the same shared secret as that i used on my ruckus controller

 

Any ideas what ive missed?

[truebluesteve]

I have the same setup and it works perfectly but I'm not at work at the moment to compare it with yours. It could be a vlan issue but the first place to look is the Smoothwall logs.

 

There is a really good guide to setting it up somewhere on Edugeek so do a quick search for Smoothwall and BYOD. If you can't find it then let me me know as I downloaded it.

[stgoodyeara]

Thanks, ill see if i can find it.

 

The VLAN config works fine if i setup a standard ssid without the radius, i just have to use SSL login pages in browser which isn't fantastic for APP based data access and it annoying

 

Where in the smoothwall logs would i find the radius related stuff?

[rob_coles]

I assume smoothwall is configured to auth against your ad? Ours is set just like yours except for encryption.

[stgoodyeara]

Smoothwall Can auth against AD. I checked the VLAN by setting up a standard SSID and using and SSL login page that accepted AD credentials

[stgoodyeara]

If i put a garbage Ip address in for the Radius server in ruckus it acts exactly the same. So this would suggest either the radius server on smoothwall doesn't work?? Is there an easy way to test the radius function?

[rob_coles]

Does your shared secret have any symbols in?

[truebluesteve]

If you think its the RADIUS then the Smoothwall Logs -> Logs and reports » Realtime » System and select Authentication Service, you should be able to see what's going on when a device connects

[stgoodyeara]

No shared secret is just 8 standard letters

[stgoodyeara]

Nothing related to the test device in the authentication logs. But id expect this as the issue is that its not asking me to authenticate.

[rob_coles]

All that is different on mine is Encryption and we've set the accounting up in AAA.

 

Stick encryption on and set your accounting server up. Just the same setup as the first just on accounting.

[rob_coles]

All that is different on mine is Encryption and we've set the accounting up in AAA.

 

Stick encryption on and set your accounting server up. Just the same setup as the first just on accounting.

 

We also seem to have an extra option in.

 

Attached.

[stgoodyeara]

our Zonedirector is one of the original 1000 units running on a pretty old firmware. This could be the problem. Ive ordered an 1100 controller and 6 more AP's so this might fix it?

[rob_coles]

can it not be upgraded?

[stgoodyeara]

nope, im on the latest firmware you can get for a 1000 controller im running 9.1.2.0 build 8 which was release October 2011.

 

To give ruckus credit they have do me a pretty smart upgrade deal

[rob_coles]

Fingers crossed.

[stgoodyeara]

Between removing the proxy.pac for the wifi network and upgrading my ZD1000 to a ZD1100 ive got this working.

 

Only thing that i'm struggling with is windows laptops wont connect without manually importing the WPA enterprise CA Certificate from the smoothwall. This is a BYOD headache, the easiest option would be to purchase a legitimate CA trusted certificate im struggling to find were to do this??

[timbo343]

@stgoodyeara ive tried this and failed with the smoothwall and ruckus to get authentication obto the ssid.

 

If it set ruckus to look at the smoothwall as a radius server (cant remember exacy what the options weee but tried all sorts before today) and try to put say year2008 into the post16 group so they can only access the post16 ssid or only allow the staff group from ad to access the staff ssid and test the authentication, the test fails had reports that the members are in the default group.

 

Ive been onto smoothwall about this and they say that an update is been tested for this problem.

[stgoodyeara]

@timbo343 I've achieved the authentication I'm looking for, sounds like your system is mentally complicated. I just have a single ssid that any student can authenticate with, they are then filtered according to the ad credentials supplied to the radius server.

 

My remaining issue is that windows 7 laptops are very strict when it comes to 802.1x authentication. Windows 7 won't even entertain a connection to a radius server that isn't providing a valid ssl certificate, you can work around this on domain controlled PCs by using GP to add the smoothwall 802.1x certificate into the trusted authority on the computer. Even then it still moans abit when you connect for the 1st time. The issue is on a BYOD model I don't want to be messing around pushing certs onto student devices that we don't manage. Smoothwall have provided a guide on doing this, it's page 305 of this guide but as you can image a standard user isn't gonna achieve this

 

http://www.smoothwall.com/media/114580/AdvancedFirewall-admin.pdf

 

So my remain query if anyone can answer it is: can I replace the 802.1x cert in the WPA enterprise section of the smoothwall for a purchased trusted CA cert to appease Bill Gates and his cronies

[timbo343]

Ahhh i see, at the moment im only wanting post16 to access the wireless so dont want the rest of the students to gain access.

 

As to your question, i guess so yeah but maybe @CJF or @tom_newton might be able to help)

[stgoodyeara]

That seems achievable to me. I'd just put a web filtering rule to block all students except post 16 when they are connecting on the ip range that assigned to the ssid.

[truebluesteve]

@timbo343 I've achieved the authentication I'm looking for, sounds like your system is mentally complicated. I just have a single ssid that any student can authenticate with, they are then filtered according to the ad credentials supplied to the radius server.

 

My remaining issue is that windows 7 laptops are very strict when it comes to 802.1x authentication. Windows 7 won't even entertain a connection to a radius server that isn't providing a valid ssl certificate, you can work around this on domain controlled PCs by using GP to add the smoothwall 802.1x certificate into the trusted authority on the computer. Even then it still moans abit when you connect for the 1st time. The issue is on a BYOD model I don't want to be messing around pushing certs onto student devices that we don't manage. Smoothwall have provided a guide on doing this, it's page 305 of this guide but as you can image a standard user isn't gonna achieve this

 

http://www.smoothwall.com/media/114580/AdvancedFirewall-admin.pdf

 

So my remain query if anyone can answer it is: can I replace the 802.1x cert in the WPA enterprise section of the smoothwall for a purchased trusted CA cert to appease Bill Gates and his cronies

 

I have the same problem, and its a proper pain in the backside so I would like to know the solution too. Adding it manually works but is hardly convenient!

[stgoodyeara]

@truebluesteve

 

My LA support our smoothwall for us. They have reported that smoothwall themselves can put a real-world certificate onto the radius for us. They have created me a server certificate request and email it to me with the instruction to use it to purchase a real-world cert and send it back to them and they will import it for me.

 

ill report back if it works.

[truebluesteve]

That would be great - had a student with a Windows laptop yesterday and while it didn't take long to install, it seems a long winded way of doing it!

[howartp]

@stgoodyeara, @timbo343,

 

Does this give you visibility of what wifi-connected device is owned by which AD user, and who was viewing a particular site on a particular device at a given time? (Assuming they hadn't given their friends their personal iPhone etc)

 

Our student wifi is off because I broke it - about ready to turn back on on Monday, but we don't want 800 kids coming with non-Apple devices to register onto the network on Monday morning. Our current method (which Tim is familiar with) is supposed to be DIY, but only Apple and latest Androids work - old Androids, Windows, Blackberries, don't work)

 

If I can get student's online without having to manually do things for them, whilst still tracking who is doing what on which device, when and where, then I'd love to implement this.

 

Peter