Working with SmartZone

Parent topic: Appendix for Configuring NPS

Configuring the Authentication Services and Creating a WLAN

Configure an authentication server in the controller to be used as a RADIUS server within the IEEE 802.1X WLAN settings. Wireless clients attempting to connect to the WLAN will be prompted for username and password credentials that will be checked against the Active Directory (AD) by the Network Policy Server (NPS).

Complete the following steps in your SmartZone controller UI to configure a WLAN with IEEE 802.1X authentication that uses an NPS as the RADIUS server:

Note: This task describes the configuration parameters to configure SZ as proxy.

  1. Create the proxy authentication server.
    1. Navigate to Security > Authentication > Proxy (SZ Authentication).
    2. Click Create to create a new authentication service.
      The Create Authentication Service window opens.

      Creating a Proxy Authentication Service

    3. Type a name.
    4. For Service Protocol select RADIUS.
    5. Type the IP address of the NPS.
    6. Type the shared secret that you entered when you configured the RADIUS client on your NPS (as descibed in Configuring the NPS for IEEE 802.1X Wireless Connections .
    7. Keep default selections for the remaining options and click OK.

      Create Authentication Service Window

      The authentication service is created.
  2. Test the authentication service. Use the AAA test option to verify that the controller can contact the NPS and the authentication settings match the network policies. Select from the list the authentication service you created and click Test AAA.
    Configure the following parameters.
    1. In the Name field, keep the default selection.
    2. For Protocol, select PAP.
    3. For User Name, type the logon name as configured in AD.
    4. For Password, type the password configured in AD for this user.
    5. Click Test.

    Successful AAA Test

    Attention: The AAA test in the controller UI uses a low-level security mechanism. After the test, disable the Unencrypted authentication (PAP, SPAP) encryption mechanism via the Network Policies folder to ensure only secure encryption methods are allowed.
  3. Create a realm-based proxy authentication profile. Navigate to Security > Authentication > Realm Based Proxy and click Create.
    The Create Authentication Profile window opens.
    1. Type a name.

      Realm Based Proxy Authentication Profile

  4. Double-click the No Match row to edit it using the following settings:
    1. For Service, from the drop-down list, select the proxy authentication service created in the step number 1.
    2. For Auth Method, select Non-3GPP Call Flow.
    3. For Dynamic VLAN ID, keep this field empty.
    4. Click OK.
  5. Double-click the Unspecified row to edit it using the following settings:
    1. For Service, from the drop-down list, select the proxy authentication service created in the step number 1.
    2. For Auth Method, select Non-3GPP Call Flow.
    3. For Dynamic VLAN ID, keep this field empty.
    4. Click OK.
  6. Click OK.
    The realm-based proxy authentication profile is created.
  7. Configure a WLAN for 802.1X authentication. Navigate to Network > Wireless > Wireless LANs. Select the zone where you want to create the WLAN. Click Create.
    The Create WLAN Configuration window opens.
    1. Type a name and, optionally, a description.
    2. For Authentication Type, select Standard usage (For most regular wireless networks).
    3. For Method, select 802.1X EAP.
    4. Scroll down to Authentication & Accounting Service.
    5. Toggle the Use the controller as proxy option to enable.
    6. Select from the list the realm-based proxy authentication profile created in step 3.
    7. Click OK.
      Note: The settings provided in these steps describe a quick configuration set to enable the 802.1X WLAN. Refer to the RUCKUS SmartZone Network Administration Guide for further details about the configuration options available for each WLAN type.

      Create WLAN Configuration Window

    You have successfully created a WLAN that authenticates the wireless clients using 802.1X with an NPS as the RADIUS server. You are ready to test the configuration.

Testing the Configuration

The following steps guide you in verifying the configurations, checking the network connectivity, and identifying the locations to troubleshoot authentication issues.
  1. Verify from SmartZone that AP is broadcasting the SSID. Navigate to Network > Wireless > Access Points, locate and select the AP, then select the General tab. Scroll down to the WLANs section. The WLAN you created must be listed.

    Verifying the AP Broadcasting the SSID

  2. Connect the testing client to the SSID. Enter the credentials configured in AD when prompted for username and password. Click OK. The wireless client will connect to the SSID. Use the CMD command ipconfig to make sure the testing client got an IP address.

    Connecting a Wireless Client to the SSID

  3. Verify from SmartZone that the client shows authorization status shows as AUTHORIZED. Navigate to Network > Wireless > Access Points, locate and select the AP and select the Clients tab. Locate the testing client. The authorization status should be listed.

    Verifying the AP Client List in the Controller

  4. Review the event logs in the NPS. In the Server Manager UI, click Tools in the upper-right corner and then select Event Viewer. In the Event Viewer, expand Custom Views > Server Roles > Network Policy and Access Services. Select the newest log to review the latest authentication details (which should correspond to the access authentication for your testing client).

    Viewing the NPS Events