RUCKUS SmartZone (ST-GA) Access and Security Services Guide, 7.0.0

This guide provides configuration guidelines for restricting access to wireless clients, implementing client isolation, setting up firewall profiles and access control lists, enabling URL filtering, and defining device policies. It also offers an overview of guest access, hotspots and portals, DPSK (Dynamic Pre-Shared Key) authentication, and AAA (including proxy and non-proxy authentication for wireless clients).

Preface
- 3 Contact Information, Resources, and Conventions
  - 3.1 Contacting RUCKUS Customer Services and Support
  - 3.2 Document Feedback
  - 3.3 RUCKUS Product Documentation Resources
  - 3.4 Online Training Resources
  - 3.5 Document Conventions
  - 3.6 Command Syntax Conventions
- 4 About This Guide
  - 4.1 About This Guide
  - 4.2 New In This Document
- 5 Client Access
  - 5.1 Firewall
    - 5.1.1 Firewall Profile
      - 5.1.1.1 Managing a Firewall Profile
      - 5.1.1.2 Create an L3 Access Control Policy
        
        5.1.1.2.1 Create an L3 Access Control Policy Rule
      - 5.1.1.3 Creating an L2 Access Control Policy
        
        5.1.1.3.1 Creating an L2 Access Control Service
      - 5.1.1.4 URL Filtering
        
        5.1.1.4.1 Viewing a Summary of URL Filters
        
        5.1.1.4.2 Enabling URL Filtering on the WLAN
        
        5.1.1.4.3 Enabling URL Filtering on the Controller
        
        5.1.1.4.4 Managing URL Filtering Licenses
      - 5.1.1.5 Configuring Application Controls
        
        5.1.1.5.1 Viewing an Application Control Summary
        
        5.1.1.5.2 Creating an Application Control Policy
        
        5.1.1.5.3 Implementing an Application Control Policy
        
        5.1.1.5.4 Creating a User-Defined Application
        
        5.1.1.5.5 Application Signature Packages
      - 5.1.1.6 Creating a Device Policy
        
        5.1.1.6.1 Creating the Device Policy Rules
        
        5.1.1.6.2 Summary
  - 5.2 Blocking Clients
    - 5.2.1 Creating Blocked Client
    - 5.2.2 Creating a Client Isolation Whitelist
    - 5.2.3 Creating a Time Based Access Table
  - 5.3 Guest Access
    - 5.3.1 Working with Guest Passes
    - 5.3.2 Guest Pass
      - 5.3.2.1 SmartZone Guest Pass Self Registration
      - 5.3.2.2 Admin Generated Guest Passes
        
        5.3.2.2.1 Step 1: Create a Guest Access Service
        
        5.3.2.2.2 Step 2: Create a Guest Access WLAN
        
        5.3.2.2.3 Step 3: Generate a Guest Pass
        
        5.3.2.2.4 Step 4: Send Guest Passes to Guest Users
        
        5.3.2.2.5 Generating Guest Passes from an Imported CSV
    - 5.3.3 Guest Pass Template
      - 5.3.3.1 Creating a Guest Instruction HTML Template
      - 5.3.3.2 Creating a Guest Instruction SMS Template
    - 5.3.4 Dynamic PSK
    - 5.3.5 Generating Dynamic PSKs
    - 5.3.6 Importing Dynamic PSKs
- 6 Working with Hotspots and Portals
  - 6.1 Creating a Guest Access Portal
  - 6.2 Working with Hotspot (WISPr) Services
    - 6.2.1 Creating a Hotspot (WISPr) Portal
  - 6.3 Working with Hotspot 2.0 Services
    - 6.3.1 Creating a Hotspot 2.0 WiFi Operator Profile
    - 6.3.2 Creating a Hotspot 2.0 Identity Provider
    - 6.3.3 Creating a Hotspot 2.0 WLAN Profile
    - 6.3.4 Creating a Hotspot 2.0 Venue Profile
  - 6.4 Creating a Web Authentication Portal
  - 6.5 Creating a UA Blacklist Profile
  - 6.6 Creating a Portal Detection and Suppression Profile
  - 6.7 Creating a WeChat Portal
  - 6.8 Creating Network Segmentation Profile on the vSZ Controller
  - 6.9 Ethernet Profiles
- 7 AAA
  - 7.1 Authentication
    - 7.1.1 Authentication Support Matrix
    - 7.1.2 Creating Proxy Authentication AAA Servers
      - 7.1.2.1 RADIUS Service Options
      - 7.1.2.2 Testing AAA Servers
    - 7.1.3 RADIUS Service Options
    - 7.1.4 Enabling ECDSA Certificates Support for RADIUS with Transport Layer Security (TLS)
    - 7.1.5 Vendor-Specific Attribute (VSA) Profile
    - 7.1.6 Creating a Vendor-Specific Attribute Profile
    - 7.1.7 Associating a VSA Profile to a WLAN Configuration
    - 7.1.8 Viewing RADIUS Proxy Settings
    - 7.1.9 Creating Non-Proxy Authentication AAA Server
    - 7.1.10 Non-Proxy (Social Login)
    - 7.1.11 Creating Social Media Login Profile
    - 7.1.12 Creating Realm Based Authentication Profile
    - 7.1.13 Fast Initial Link Setup (FILS)
    - 7.1.14 Create Fast Initial Link Setup (FILS) Realm Profile
  - 7.2 Wireless Users and Roles
    - 7.2.1 User Roles
    - 7.2.2 Local Users
    - 7.2.3 Subscription Package
    - 7.2.4 Limitations When Applying Role Policies to Users
    - 7.2.5 802.1X Authentication
    - 7.2.6 Creating a User Role with 802.1x Authentication
    - 7.2.7 Creating a User Role with Active Directory Authentication
  - 7.3 Accounting
    - 7.3.1 Creating Non-Proxy Accounting AAA Servers
    - 7.3.2 Creating Proxy Accounting AAA Servers
    - 7.3.3 Creating Realm Based Proxy
- 8 Wireless Security
  - 8.1 Wireless Intrusion Detection and Prevention Services (WIDS/WIPS)
    - 8.1.1 Wireless Intrusion Detection and Prevention System
    - 8.1.2 Configuring a Rogue Classification Policy
- 9 AP Security
  - 9.1 AP Restricted Access
    - 9.1.1 Creating a Restricted AP Access Profile
    - 9.1.2 Configuring a Restricted Access via Access Point
    - 9.1.3 Configuring a Restricted Access via Templates
    - 9.1.4 Enabling Restricted AP Access Profile
- 10 Appendix for Configuring NPS