Using External DPSK with RADIUS Authentication

Using an external AAA server for managing Dynamic Pre-Shared Keys provides several advantages to internal DPSKs stored on the AP or controller.

The external DPSK feature allows customers to exceed the maximum number of DPSKs that can be stored on the controller, and provides the option to store and manage DPSKs on the AAA server for distribution to multiple controllers.

To enable external DPSK using an external authentication server:

  1. Go to WiFi Networks > Create/Edit WLAN > Advanced Options > Zero-IT & DPSK.
  2. In Dynamic PSK, select External.
  3. In Authentication Server, select or create an AAA server entry.
  4. Click OK.

    External DPSK

  5. The controller will send Access-Request messages to the RADIUS server with following attributes: Ruckus-SSID, Ruckus-BSSID, User-Name, Ruckus-Dpsk-Params.
  6. The AAA server sends back a RADIUS Access-Accept or Access-Reject message with the following attributes: Access-Accept: Calling-station-id, Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-Id, MS-MPPE-Recv-Key,Session-Timeout, Ruckus-User-Groups, User-Name. The MS-MPPE-Recv-Key is mandatory.
    Note: If the User-Name attribute is empty in the Access-Accept packet of external Radius server, the column User in the web UI uses the User-name attribute from the Access-Request packet of Unleashed.
  7. The AAA server generates a DPSK key (PMK) for each wireless station. This key is encrypted and entered in the attribute MS-MPPE-Recv-Key: PMK = PBKDF2_SHA1(PassPhrase, Wlan-SSID, Wlan-SSID-Len, 4096, 32). See RFC2548 Chapter 2.4.3.
    Note: The WLAN-SSID attribute will exist in the authentication request. The AAA server can use this value to generate the PSK or the AAA server can be pre-configured with WLAN-SSID value.
  8. The AAA server calculates the wireless station’s Pairwise Transient Key (PTK) from the Ruckus-Dpsk-Params attribute (AKM Suite, Cipher, Anonce, EAPOL-Key-Frame) in the Access-Request message and generates the PMK key, and finally verifies the Key MIC of the station. If it matches, the RADIUS server will send back an Access-Accept message with the MS-MPPE-Recv-Key attribute.
  9. With the DPSK keys generated managed by the AAA server, the controller's internal max DPSK limits are avoided and an unlimited number of DPSKs can be generated.

In this section:

  1. External DPSK RADIUS Attribute Value Pairs
    The RADIUS Attribute Value Pairs (AVP) and Vendor Specific Attributes (VSA) used in external DPSK generation are listed in the following table.
Parent topic: Enabling DPSK for a WLAN