Ruckus Zone Director 9.12 (GA) User Guide Rev C 20151222

2016-02-05

• Copyright Notice and Proprietary Information
• About This Guide
  • Document Conventions
  • Related Documentation
  • Documentation Feedback
  • Online Training Resources
• Introducing Ruckus Wireless ZoneDirector
  • Overview of ZoneDirector
  • ZoneDirector Physical Features
    • ZoneDirector 1200
      • Buttons, Ports, and Connectors
      • Front Panel LEDs
    • ZoneDirector 3000
      • Buttons, Ports, and Connectors
      • Front Panel LEDs
    • ZoneDirector 5000
      • Front Panel Features
      • Front Panel (Bezel Removed)
      • Control Panel
      • Rear Panel Features
  • Introduction to the Ruckus Wireless Network
  • Ensuring That APs Can Communicate with ZoneDirector
    • How APs Discover ZoneDirector on the Network
    • How to Ensure that APs Can Discover ZoneDirector on the Network
      • Option 1: Perform Auto Discovery on Same Subnet, then Transfer the AP to Intended Subnet
      • Option 2: Customize Your DHCP Server
        • Configuring the DHCP Server for ZoneDirector-AP Communication
          • For ZoneDirector information (sub-option code 03)
          • For FlexMaster information (sub-option code 01)
        • Configure Vendor Class Identifier and Vendor Specific Info sub-options on Microsoft DHCP server
      • Option 3: Register ZoneDirector with a DNS Server
        • Step 1: Set the DNS Domain Name on the DHCP Server
        • Step 2: Set the DNS Server IP Address on the DHCP Server
        • Step 3: Register the ZoneDirector IP Addresses with a DNS Server
    • Firewall Ports that Must be Open for ZoneDirector Communications
      • NAT Considerations
  • Installing ZoneDirector
  • Accessing ZoneDirector’s Command Line Interface
  • Using the ZoneDirector Web Interface
    • Navigating the Dashboard
    • Using Indicator Widgets
      • Adding a Widget
      • Removing a Widget
    • Real Time Monitoring
      • Real Time Monitoring Widgets
    • Stopping and Starting Auto Refresh
  • Registering Your Product
• Configuring System Settings
  • System Configuration Overview
    • Changing the System Name
  • Changing the Network Addressing
    • IPv6 Configuration
    • Enabling an Additional Management Interface
  • Creating Static Route Entries
    • Static Route Example
  • Enabling Smart Redundancy
    • Configuring ZoneDirector for Smart Redundancy
    • Forcing Failover to the Backup ZoneDirector
    • Managing Smart Redundancy AP License Pools
  • Configuring the Built-in DHCP Server
    • Enabling the Built-in DHCP server
    • Viewing DHCP Clients
  • Controlling ZoneDirector Management Access
  • Setting the System Time
  • Setting the Country Code
    • Channel Optimization
    • Channel Mode
  • Changing the System Log Settings
    • Reviewing the Current Log Contents
    • Customizing the Current Log Settings
      • Configuring Syslogs for Firewall Integration
        • Log format
        • Examples
      • Configuring Remote Syslog Advanced Settings
  • Setting Up Email Alarm Notifications
    • Customizing Email Alarms that ZoneDirector Sends
  • Configuring SMS Settings for Guest Pass Delivery via SMS
  • Enabling Login Warning Messages
  • Enabling Network Management Systems
    • Enabling Management via FlexMaster
      • Monitoring ZoneDirector Performance from FlexMaster
    • Enabling Northbound Portal Interface Support
    • Configuring SNMP Support
      • Enabling the SNMP Agent
        • If your network uses SNMPv2
        • If your network uses SNMPv3
      • Enabling SNMP Trap Notifications
        • Trap Notifications That ZoneDirector Sends
    • Enabling Telnet
  • Configuring DHCP Relay
  • Enabling Bonjour Gateway
    • Creating a Bonjour Gateway Rule - ZD Site
    • Creating a Bonjour Gateway Rule - AP Site
    • Applying a Bonjour Policy to an AP
    • Example Network Setup
  • Configuring SPoT Location Services
• Configuring Security and Other Services
  • Configuring Self Healing Options
    • Automatically Adjust AP Power
    • Automatic Channel Selection
      • ChannelFly
        • Benefits of ChannelFly
        • Disadvantages of ChannelFly
      • Background Scanning
    • Load Balancing
    • Band Balancing
    • Radar Avoidance Pre-Scanning
    • AeroScout RFID Tag Detection
    • Ekahau Tag Detection
    • Active Client Detection
    • Tunnel Configuration
    • Packet Inspection Filter
  • Configuring Wireless Intrusion Prevention
    • DoS Protection
    • Intrusion Detection and Prevention
    • Rogue Access Points
    • Rogue DHCP Server Detection
  • Controlling Network Access Permissions
    • Creating Layer 2/MAC Address Access Control Lists
    • Creating Layer 3/Layer 4/IP Address Access Control Lists
    • Configuring Device Access Policies
    • Configuring Precedence Policies
    • Blocking Client Devices
      • Monitoring Client Devices
      • Temporarily Disconnecting Specific Client Devices
      • Permanently Blocking Specific Client Devices
      • Reviewing a List of Previously Blocked Clients
    • Configuring Client Isolation White Lists
    • Application Recognition and Filtering
      • Configure User Defined Applications
      • Configure Application Port Mapping
        • Well-Known Service and Destination Port Mappings Defined in Application Visibility
      • Configure Application Denial Policies
        • Notes:
        • When using Port based rules:
        • Applying an Application Denial Policy to a WLAN
  • Using an External AAA Server
    • Active Directory
      • Single Domain Active Directory Authentication
      • Multi-Domain Active Directory Authentication
    • LDAP
      • Advanced LDAP Filtering
      • Group Extraction
    • RADIUS / RADIUS Accounting
      • Configuring a Backup RADIUS / RADIUS Accounting Server
      • MAC Authentication with an External RADIUS Server
      • Using 802.1X EAP + MAC Address Authentication
      • Using 802.1X with EAP-MD5
      • RADIUS Attributes
        • RADIUS Authentication attributes
        • RADIUS Accounting attributes
      • Configuring Microsoft IAS for PAP Authentication
      • TACACS+
      • Testing Authentication Settings
• Managing a Wireless Local Area Network
  • Overview of Wireless Networks
  • About Ruckus Wireless WLAN Security
  • Creating a WLAN
    • General Options
    • WLAN Usage Types
      • Autonomous WLANs
    • Authentication Method
    • Fast BSS Transition
    • Encryption Options
      • Method
        • Algorithm (Only for WPA2 or WPA-Mixed encryption methods)
        • WEP Key/Passphrase
        • Options
    • Advanced Options
  • Creating a Copy of an Existing WLAN for Workgroup Use
  • Customizing WLAN Security
    • Reviewing the Initial Security Configuration
    • Fine-Tuning the Current Security Mode
    • Switching to a Different Security Mode
    • Using the Built-in EAP Server
    • Authenticating with an External RADIUS Server
    • If You Change the Internal WLAN to WEP or 802.1X
      • If Switching to WEP-based Security
      • If Switching to 802.1X-based Security
  • Working with WLAN Groups
    • Creating a WLAN Group
    • Assigning a WLAN Group to an AP
    • Viewing a List of APs That Belong to a WLAN Group
  • Deploying ZoneDirector WLANs in a VLAN Environment
    • Tagging Management Traffic to a VLAN
    • How Dynamic VLAN Works
      • Priority of VLAN, Dynamic VLAN and Tunnel Mode
      • How It Works
      • Required RADIUS Attributes
    • Working with VLAN Pools
  • Working with Hotspot Services
    • Creating a Hotspot Service
    • Assigning a WLAN to Provide Hotspot Service
    • Common WISPr Attribute Abbreviations
  • Creating a Hotspot 2.0 Service
    • Create a Service Provider Profile
      • Create an Operator Profile
      • Create a Hotspot 2.0 WLAN
      • Setting the Venue Name for a Hotspot 2.0 AP
  • Working with Dynamic Pre-Shared Keys
    • Enabling Dynamic Pre-Shared Keys on a WLAN
    • Setting Dynamic Pre-Shared Key Expiration
    • Generating Multiple Dynamic PSKs
    • Creating a Batch Dynamic PSK Profile
  • Bypass Apple CNA
• Managing Access Points
  • Adding New Access Points to the Network
    • Connecting the APs to the Network
    • Verifying/Approving New APs
  • Working with Access Point Groups
    • Modifying the System Default AP Group
    • Creating a New Access Point Group
    • Modifying Access Point Group Membership
    • Modifying Model Specific Controls
      • Configuring AP USB Ports
  • Configuring AP Ethernet Ports
    • DHCP Option 82
      • DHCP Option 82 Sub-Options
    • Designating Ethernet Port Type
      • Trunk Ports
      • Access Ports
      • General Ports
    • Using Port-Based 802.1X
      • AP Ethernet Port as Authenticator
      • AP Ethernet Port as Supplicant
    • Viewing AP Ethernet Port Status
  • Reviewing Current Access Point Policies
    • Using Limited ZD Discovery for N+1 Redundancy
  • Importing a USB Software Package
  • Managing Access Points Individually
    • Configuring Hotspot 2.0 Venue Settings for an AP
  • Optimizing Access Point Performance
    • Assessing Current Performance Using the Map View
    • Improving AP RF Coverage
    • Assessing Current Performance Using the Access Point Table
    • Adjusting AP Settings
    • Prioritizing WLAN Traffic
• Monitoring Your Wireless Network
  • Reviewing the ZoneDirector Monitoring Options
  • Importing a Map View Floorplan Image
    • Requirements
    • Importing the Floorplan Image
    • Placing the Access Point Markers
  • Using the Map View Tools
    • AP Icons
  • Evaluating and Optimizing Network Coverage
    • Moving the APs into More Efficient Positions
  • Reviewing Current Alarms
  • Reviewing Recent Network Events
    • Clearing Recent Events/Activities
  • Moniting WLAN Status
  • Reviewing Current User Activity
    • Viewing Application Usage Statistics
      • Viewing Application Usage by Client
      • Viewing the Top 10 Clients by Usage
    • Active Clients
    • Inactive Clients
    • Events/Activities
  • Monitoring Individual Clients
    • Monitoring Client Performance
    • Monitoring Wired Clients
  • Monitoring Access Point Status
    • Using the AP Status Overview Page
      • Currently Managed APs
        • Export to CSV
      • Currently Managed AP Groups
      • Events/Activities
  • Monitoring Individual APs
    • RF Pollution FAQ
    • Spectrum Analysis
    • Neighbor APs
    • Access Point Sensor Information
      • Orientation
      • Temperature
  • Monitoring Mesh Status
  • Detecting Rogue Access Points
  • Monitoring System Ethernet Port Status
  • Monitoring AAA Server Statistics
  • Monitoring Location Services
• Managing User Access
  • Enabling Automatic User Activation with Zero-IT
    • Clients that Support Zero-IT
    • Self-Provisioning Clients with Zero-IT
    • Self-Provisioning Clients without Ethernet Ports
    • Provisioning Clients that Do Not Support Zero-IT
  • Adding New User Accounts to ZoneDirector
    • Internal User Database
  • Managing Current User Accounts
    • Changing an Existing User Account
    • Deleting a User Record
  • Creating New User Roles
    • Role Based Access Control Policy
  • Managing Automatically Generated User Certificates and Keys
  • Using an External Server for User Authentication
  • Activating Web Authentication
    • Captive Portal Redirect on Initial Browser HTTPS Request
• Managing Guest Access
  • Configuring Guest Access
  • Creating a Guest Access Service
    • Using Guest Pass Self-Service
      • Accessing a Self-Service Guest WLAN
      • Requiring Sponsor Approval for Self-Service Guest Pass Authentication
    • Configuring Guest Subnet Restrictions
  • Creating a Guest WLAN
  • Using the BYOD Onboarding Portal
  • Working with Guest Passes
    • Configuring Guest Pass Generation
      • Controlling Guest Pass Generation Privileges
      • Creating a Guest Pass Generation User Role
      • Assigning a Pass Generator Role to a User Account
    • Generating and Delivering a Single Guest Pass
    • Generating and Printing Multiple Guest Passes at Once
      • Creating a Guest Pass Profile
    • Monitoring Generated Guest Passes
    • Customizing the Guest Login Page
    • Creating a Custom Guest Pass Printout
      • Guest Pass Printout Tokens
    • Delivering Guest Passes via Email
    • Delivering Guest Passes via SMS
• Deploying a Smart Mesh Network
  • Overview of Smart Mesh Networking
  • Smart Mesh Networking Terms
  • Supported Mesh Topologies
    • Standard Topology
    • Wireless Bridge Topology
    • Hybrid Mesh Topology
  • Deploying a Wireless Mesh via ZoneDirector
    • Step 1: Prepare for Wireless Mesh Deployment
    • Step 2: Enable Mesh Capability on ZoneDirector
      • Optional Mesh Configuration Features
    • Step 3: Provision and Deploy Mesh Nodes
    • Step 4: Verify That the Wireless Mesh Network Is Up
  • Understanding Mesh-related AP Statuses
  • Using the ZoneFlex LEDs to Determine the Mesh Status
    • On Single-band ZoneFlex APs
      • WLAN LED
      • Signal/Air Quality LED
    • On Dual-band ZoneFlex APs
      • Outdoor ZoneFlex APs
      • Indoor Dual Band APs
  • Using Action Icons to Configure and Troubleshoot APs in a Mesh
  • Setting Mesh Uplinks Manually
  • Troubleshooting Isolated Mesh APs
    • Understanding Isolated Mesh AP Statuses
    • Recovering an Isolated Mesh AP
      • Step 1: Obtain the Mesh SSID and Passphrase
      • Step 2: Ensure that the AP’s Mesh Mode is set to Auto
      • Step 3: Locate the AP’s Mesh Recovery SSID
      • Step 4: Connect to the AP and update its Mesh settings
  • Best Practices and Recommendations
• Setting Administrator Preferences
  • Changing the ZoneDirector Administrator User Name and Password
    • Setting Administrator Login Session Timeout
  • Changing the Web Interface Display Language
  • Upgrading ZoneDirector and ZoneFlex APs
    • Performing an Upgrade with Smart Redundancy
  • Working with Backup Files
    • Backing Up a Network Configuration
    • Restoring Archived Settings to ZoneDirector
      • Restoring AP Configuration Settings Only
  • Restoring ZoneDirector to Default Factory Settings
    • Alternate Factory Default Reset Method
  • Working with SSL Certificates
    • Basic Certificate Installation
    • Generating a Certificate Signing Request
    • Importing an SSL Certificate
    • SSL Certificate Advanced Options
      • Wildcard Certificate Installation
        • Wildcard Certificates In Smart Redundancy With Captive Portals
  • Using an External Server for Administrator Authentication
  • Upgrading the License
  • Support Entitlement
• Troubleshooting
  • Troubleshooting Failed User Logins
  • Fixing User Connections
    • If WLAN Connection Problems Persist
  • Measuring Wireless Network Throughput with SpeedFlex
    • Using SpeedFlex in a Multi-Hop Smart Mesh Network
    • Allowing Users to Measure Their Own Wireless Throughput
      • How to Measure the Speed of Your Wireless Connection
  • Diagnosing Poor Network Performance
  • Starting a Radio Frequency Scan
  • Using the Ping and Traceroute Tools
  • Generating a Debug File
  • Viewing Current System and AP Logs
  • Packet Capture and Analysis
    • Local Capture
    • Streaming Mode
      • Using Ruckus Custom Indicators
  • Importing a Script
  • Enabling Remote Troubleshooting
  • Restarting an Access Point
  • Restarting ZoneDirector
• Smart Mesh Networking Best Practices
  • Choosing the Right AP Model for Your Mesh Network
  • Calculating the Number of APs Required
  • Placement and Layout Considerations
  • Signal Quality Verification
  • Mounting and Orientation of APs
    • Indoor APs - Typical Case: Horizontal Orientation
    • Indoor APs - Vertical Orientation
    • Outdoor APs - Typical Horizontal Orientation
    • Elevation of RAPs and MAPs
  • Best Practice Checklist
• Appendix: Zone 2 APs