Skip to main content

Ruckus SmartZone / Virtual SmartZone

Integrate Ruckus SmartZone and Virtual SmartZone (vSZ) controllers with IronWifi's RADIUS authentication and external captive portal. This guide covers RADIUS authentication and accounting configuration, Hotspot (WISPr) portal setup, walled garden configuration, WPA-Enterprise deployment, and optional RadSec (RADIUS over TLS) for enhanced security.

info

Requires SmartZone v3.0 or above.

Prerequisites​

In Ruckus SmartZone:​

  • SmartZone controller version 3.0 or higher
  • Administrative access to SmartZone web interface
  • Public IP address for SmartZone (for IronWifi to communicate with)
  • Northbound API access enabled

In IronWifi Console (complete these first):​

  1. Create a Network

    • Navigate to Networks and click Create Network
    • Note the RADIUS server details:
      • Primary RADIUS Server IP
      • Backup RADIUS Server IP (optional)
      • RADIUS Authentication Port (1812)
      • RADIUS Accounting Port (1813)
      • Shared Secret

  2. Create a Captive Portal

    • Navigate to Captive Portals and click Create Captive Portal
    • Select Vendor: Ruckus
    • Enter your SmartZone Public IP Address
    • Enter your Northbound Password (API password)
    • Note the Splash Page URL provided
    • Copy the Walled Garden domains list

SmartZone Configuration​

Step 1: Configure RADIUS Authentication​

  1. Navigate to Services & Profiles → Authentication
  2. Click Create
  3. Configure:
    • Name: IronWifi
    • Type: Proxy (SZ Authenticator)
    • Service Protocol: RADIUS
    • Primary Server IP: {Primary IP from IronWifi}
    • Port: 1812
    • Shared Secret: {Secret}
  4. Add backup server if using redundancy

Step 2: Configure RADIUS Accounting​

  1. Navigate to Services & Profiles → Accounting
  2. Click Create
  3. Configure:
    • Name: IronWifi-Accounting
    • Server IP: {Primary IP from IronWifi}
    • Port: 1813
    • Shared Secret: {Secret}

Step 3: Configure Hotspot Portal​

  1. Navigate to Services & Profiles → Hotspot
  2. Click Create
  3. Configure:
    • Name: IronWifi-Portal
    • Login URL: {Splash Page URL}
    • Redirect Method: HTTP
  4. Click Save

Step 4: Configure Walled Garden​

In the Hotspot Portal settings:

  1. Navigate to Walled Garden section

  2. Add the following required entries:

    • 107.178.250.42
    • *.ironwifi.com
    • *.ironwifi.net
    • splash.ironwifi.com

  3. If using social login providers, add their domains:

ProviderRequired Entries
Google*.google.com, *.googleapis.com, *.gstatic.com, accounts.google.com
Facebook*.facebook.com, *.fbcdn.net, connect.facebook.net, facebook.com
LinkedIn*.linkedin.com, *.licdn.com, linkedin.com
Twitter/X*.twitter.com, *.twimg.com, twitter.com, *.x.com, x.com
Apple*.apple.com, *.icloud.com, appleid.apple.com
Microsoft/Azure AD*.microsoft.com, *.microsoftonline.com, *.msftauth.net, login.microsoftonline.com
Stripe*.stripe.com, js.stripe.com
PayPal*.paypal.com, *.paypalobjects.com
Twilio (SMS)*.twilio.com

Step 5: Create WLAN​

  1. Navigate to Wireless LANs → Create
  2. Configure:
    • Name: Guest-WiFi
    • SSID: Guest-WiFi
    • Zone: Your zone
    • Authentication Type: Hotspot (WISPr)
    • Hotspot Portal: IronWifi-Portal
    • Authentication: IronWifi
    • Accounting: IronWifi-Accounting

RadSec Configuration​

For RADIUS over TLS (enhanced security):

  1. In IronWifi Console, enable RadSec for your network
  2. Download certificate bundle
  3. In SmartZone:
    • Navigate to Services & Profiles → Authentication
    • Edit the IronWifi authentication service
    • Enable RadSec
    • Upload certificates
    • Configure port 2083

WPA-Enterprise​

For 802.1X authentication without captive portal:

  1. Create WLAN
  2. Set Authentication Type: 802.1X EAP
  3. Configure:
    • Auth Service: IronWifi
    • Encryption: WPA2-AES (or WPA3)
    • Accounting: IronWifi-Accounting

Testing​

Once configuration is complete, verify everything is working properly:

Verify WLAN Status​

# Check WLAN status
show wlan

# Check authentication servers
show auth-servers

# Check connected clients
show station

Test Captive Portal​

  1. Connect a test device to the Guest WiFi network
  2. Open a web browser
  3. You should be automatically redirected to the IronWifi splash page
  4. Complete the authentication process
  5. Verify internet access is granted after authentication

Test Enterprise Authentication​

  1. Connect a device to the WPA-Enterprise network
  2. Enter valid credentials when prompted
  3. Verify successful connection
  4. Check authentication logs in IronWifi Console

Troubleshooting​

If you encounter issues during setup or operation, use this reference to diagnose and resolve common problems:

SymptomPossible CauseSolution
Portal not appearingIncorrect Hotspot Portal URLVerify the Splash Page URL in Hotspot Portal settings matches IronWifi Console
Portal not appearingMissing Walled Garden entriesAdd all required IronWifi domains to Walled Garden
Portal not appearingAuthentication service not configuredConfirm authentication service is properly linked to WLAN
RADIUS authentication failuresServer connectivity issueTest connectivity: ping {RADIUS IP} from SmartZone
RADIUS authentication failuresIncorrect shared secretVerify shared secret matches exactly in both systems (case-sensitive)
RADIUS authentication failuresSmartZone IP not whitelistedCheck that SmartZone public IP is added in IronWifi Console
RADIUS authentication failuresFirewall blocking trafficEnsure ports 1812 and 1813 are open between SmartZone and IronWifi
Client authorization issuesIncorrect Northbound passwordVerify Northbound password in IronWifi captive portal settings
Client authorization issuesAPI access disabledCheck that SmartZone Northbound API is enabled and accessible
Client authorization issuesCertificate errorsReview IronWifi captive portal logs for SSL/TLS errors
Social login not workingMissing provider domainsAdd all required domains for the social provider to Walled Garden
RadSec connection failingCertificate mismatchEnsure correct certificate bundle is uploaded to SmartZone
RadSec connection failingWrong port configurationVerify RadSec is configured to use port 2083

For detailed error information:

  1. Review SmartZone logs: Monitoring → System Logs
  2. Review IronWifi logs: Analytics → Authentication Logs
  3. Check client connection logs: Monitoring → Client Sessions