Configuring PEAP on Cloudpath to Integrate with the Ruckus Controller

Once you configure a PEAP WLAN on your controller, you need to add a corresponding PEAP configuration to a workflow on your Cloudpath system.

This procedure in this section includes steps for:

Note: The concept of workflows and how to create one is described in detail in the Cloudpath Deployment Guide and the Cloudpath Quick Start Guide. Therefore, the purpose of the procedure in this section is to demonstrate how to add a PEAP branch to an existing workflow. The same steps included below could also be used to create a new workflow with a PEAP plugin.

Adding a PEAP Branch to Your Workflow

  1. Log in to the Cloudpath user interface.
  2. Go to Configuration > Workflows.
  3. Click on a workflow to which you want to add a PEAP branch. An example of a very simple workflow before adding a PEAP branch is shown below:

    Workflow Before Adding PEAP Branch

  4. Click the + button to create a new branch in your workflow.
    The Webpage Display Information screen is displayed, as shown below, and you add the necessary information.

    Webpage Display Information Screen is Displayed When You Add a Branch to a Workflow

    Enter a Short Name and Display Title, and, optionally, Display Text, then click Save.

  5. On the next screen (Configuration > Workflows > Modify Step), click Done.
    The PEAP tab has been added, as shown in the following screen.

    Workflow After Adding Tab for PEAP

Adding a PEAP Device Configuration to Your Workflow

  1. In the workflow, with the PEAP tab highlighted, click the pencil icon to the right of the Result line to "Assign a device configuration and/or certificate."
    The following screen appears:

    Device Configuration Selection Screen

  2. Select "A new device configuration," then click Next.
    The Create Device Configuration screen is displayed. Enter a descriptive name. The name does not need to be the same as the SSID; however it can be, as shown below.

    Create Device Configuration Screen

    Click Next.

  3. The Connection Type screen is displayed; required fields are described below the screen:

    Connection Type Screen

    Click Next.

Configuring Cloudpath to Communicate with the External RADIUS server

  1. For the screens you are presented with next, you can keep all the default values and continue to click Next to progress through the screens, until you get to the following screen:

    RADIUS Server Information

    With the "Client will authenticate to an external RADIUS server" option selected, be sure that the RADIUS Server value is *New RADIUS Server, then, click Next.

  2. On the screen that appears next (below), use the Choose File button to upload the root CA and any intermediates certificates to allow the Cloudpath system to communicate with the external RADIUS server. The following illustration is an example of the RADIUS Server Information screen after the root CA and its intermediate certificate have been uploaded.

    RADIUS Server Information Screen After Uploading Certificates

    The Reference Name is an internal name (typically a name for the external RADIUS server) and is not obtained from the certificate, but the RADIUS Common Name is obtained from the certificate. Both these fields can be left blank if you wish. Click Next.

  3. On the Additional Options screen, which is displayed next, leave the default values and click Next.
  4. On the "What certificate template should issue the certificate?" screen, select "Do not issue a certificate to the user."

    What certificate template should issue the certificate?

    Click Next.

  5. You are returned to the workflow. Make sure the Result step has been added successfully, as shown below:

    Workflow After Completing the Device Configuration "Result"

Publish the workflow by clicking the Publish icon to the left of the workflow name at the top of the Configuration > Workflows screen.

Testing the PEAP User Experience

  1. Test the Enrollment process by clicking on the enrollment portal URL for the workflow at the top of the Configuration > Workflows screen.
  2. When are you presented with the with the Welcome screen, click Start.
  3. When you are presented with various branches of your workflow, click the "PEAP" branch:

    Testing the Workflow - PEAP Branch

  4. Follow any prompts to continue.
  5. The user is presented with a screen similar to the one shown in the following figure to enter username and password.

    PEAP User Credentials Screen

    Enter the credentials for the external RADIUS server, then click Next.

  6. Proceed with the enrollment. If enrollment is successful, you will receive some status screens indicating the following status as the process is in progress:
    • "Configuring this device"
    • "Attempting to connect to the network"
    • "Congratulations! You are now connected to the network."

Troubleshooting Tips

If an error occurs during the workflow-publishing or enrollment process, check the following:

  • Make sure that you have selected Password (PEAP) as the Authentication Style in the Cloudpath Connection Type screen.
  • Make sure that you have added the correct Cloudpath PEAP SSID to the final result step in your workflow.
  • Verify that the shared secret configured of your external RADIUS server matches the shared secret on the Create AAA Authentication Server configuration screen on your controller.
  • Verify that the Cloudpath server can ping the external RADIUS server, and vice versa.
  • Verify that you have the correct Root and any Intermediate CAs for the external RADIUS server.