Learn how to create a network that allows users to access the network through a third-party captive portal, authenticated by a RADIUS server.

1. On the navigation bar, click Wi-Fi > Wi-Fi Networks > Wi-Fi Networks List.
   The Networks page is displayed.
2. Click Add Wi-Fi Network. Alternatively, select a Third-Party Captive Portal (WISPr Feature) network setting that you want to copy and click Clone at the top of the table.
   The Create New Network page is displayed.
3. Complete the settings on the Network Details page.
   • Name: Type a name (up to 32 characters) that you want assign to the network.
   • Set different SSID: Use this option to configure the SSID different from the network name.
   • Description: Enter an optional description to help you identify the network using up to 64 characters.
   • Type: Click Captive Portal.
   When the network type is selected, a structure diagram of a Captive Portal type of network displays.
4. Click Next.
   The Portal Type page is displayed.
5. Click 3rd Party Captive Portal (WISPr).
   To access the network, users connect through a 3rd party captive portal, authenticated by a RADIUS server.
   The 3rd-Party Captive Portal type of network diagram appears.
6. Click Next.
   The Settings page is displayed.
7. In the Portal Provider field, select a name of the provider from the drop down list.
8. Based on Portal Provider selection, the Captive Portal URL or Region field is displayed.
   • Captive Portal URL: Enter the vendor's complete URL for the above selected the Portal Provider. It is recommended to copy URL from the vendor's configuration.
   • Region: Select a region for the above selected the Portal Provider from the drop down list.
9. Select the Redirect Users to check box and enter a valid URL.
   You can redirect users to your company website or another URL after they log in successfully. If the check box is not selected, users are sent to the page they originally requested.
10. In the Integration Key box a password is displayed. Click Copy Key to copy this password to your vendor's configuration to allow it to connect to RUCKUS Cloud.
11. For the Secure your network option, select Pre-Share Key (PSK) or OWE encryption.
12. Select the Enable Pre-Shared Key (PSK) check box and enter the Passphrase minimum eight characters in the Passphrase field that you want users to provide before they can access the network.
13. In the Security Protocol select the security protocol that you want this network to use. The default security protocol is WPA2, Other options include WPA3, WPA3/WPA3 mixed mode, WPA, and WEP. This option is displayed only if the Enable Pre-Shared Key (PSK) option is enabled.
14. Select the MAC auth bypass check box to enable MAC base authentication method.
15. Check the Enable RUCKUS DHCP service check box to automatically create and assign a new DHCP-Guest Service and DHCP Pool for those Guest WLAN releated venues that do no have a specified DHCP Service. Please refer to the DHCP Service at each Venue for more information.
16. In the Walled Garden: box, enter the network destinations (URLs or IP addresses) that users can access without going through authentication. A walled garden is a limited environment to which an unauthenticated user is given access for the purpose of setting up an account. After the account is established, the user is allowed out of the walled garden.
    A walled garden is a limited environment to which an unauthenticated user is given access for the purpose of setting up an account. After the account is established, the user is allowed out of the walled garden.
    Enter each destination in a new line. The following are the accepted formats for destinations:

    • IP address (e.g. 10.11.12.13)
    • IP address range (e.g. 10.11.12.13-10.11.12.15)
    • CIDR (e.g. 10.11.12.13/28)
    • IP address and mask (e.g. 10.11.12.13 255.255.255.0)
    • Website FQDN (e.g. www.ruckus.com)
    • Website FQDN with a wildcard (e.g. *.amazon.com;*.com)
17. In the Authentication Service section automatically the selected Portal Provider primary and secondary servers are filled.
18. Check the Accept All Connections option to enable the Accept All Connections feature.
    By default, the Accept All Connections features is disabled. You must disable Enable MAC auth bypass to enable he Accept All Connections feature.
19. In the Accounting Service section automatically the selected Portal Provider primary and secondary servers are filled.
20. Click Show more settings.

    

    Note:

    Demonstration of Advanced Settings for a Wi-Fi Network. This video explains advanced settings for a Wi-Fi network and walks you through the process of configuring them.

    Click to play video in full screen mode.

21. By default, the VLAN tab is selected. Complete the following VLAN settings:
    • VLAN Pooling: Toggle switch to ON to enable the VLAN pooling.
    • Select VLAN Pooling: Select a VLAN pool from the drop down list or complete the following steps to add a new VLAN pool.
      1. Click Add Pool and configure a new VLAN pool. Refer to Creating a VLAN Pool.
    • VLAN ID: Type the VLAN ID number (default is 1) that you want to assign to this network. The valid range is from 1 to 4094. VLAN ID option is not available if VLAN Pooling is enabled. VLAN ID option is disabled if you enable the Enable RUCKUS DHCP service option.
    • Dynamic VLAN: By default, Dynamic VLAN is enabled.
    • Proxy ARP: Toggle the switch to ON to enable the proxy ARP.
22. Complete the following User Connection settings:

    

    1. Complete the following fields:
       • Allow the user to stay connected for: Select Minutes, Hours, or Days from the drop down list and then enter the duration or use the up/down arrows to select the number of minutes, hours, or days of connection time after which the client is disconnected.
       • Do not redirect to the portal when reconnecting within: By default, the check box is selected and default value is four. Select Minutes or Hours from the drop down list and then enter the duration or use the up/down arrows to select the number of minutes or hours. You can set the grace period which sets the number of minutes during which previously authenticated clients that disconnect from the network can rejoin the network without going through the authentication process again. The default grace period is 60 minutes, but this time cannot be longer than the allowed user connection period.
23. Select the Network Control tab and complete the following services settings:

    

    • DNS Proxy: Toggle switch to ON to enable the DNS proxy.

      

      1. Select a DNS Proxy from the table or add a new DNS proxy.
      2. Click Add Rule to add a new DNS proxy. The Add DNS Proxy Rule dialog box is displayed.

         

      3. Complete the following fields:
         • Domain Name: Enter a domain name for the DNS proxy rule.
         • IP Addresses: Enter an IP address.
      4. Click Add, to add the domain name and IP address to the table.
      5. Click Save.
      6. Click OK.
    • Wi-Fi Calling: Toggle switch to ON to enable the Wi-Fi Calling.

      

      1. Click Select Profiles. The Select Wi-Fi Calling Profiles dialog box is displayed.

         

      2. Select the profiles in the Available Profiles table and click Add to move the selected profile to the Selected Profiles table. To remove the profiles from the Selected Profiles table, select the profiles in the Selected Profiles table and click Remove.
      3. Click Save.
    • Client Isolation: Toggle switch to ON to enable the client isolation.

      

      1. Complete the following fields:
         • Isolation Packets: Select Unicast, Multicast/broadcast, or Unicast and Multicast/broadcast.
         • Automatic support for VRRP/HSRP: Set the switch to ON to enable the automatic support for VRRP/HSRP.
         • Client Isolation Allowlist by Venue: Set the switch to ON to enable the client isolation allowlist by venue.
    • Anti-spoofing: Toggle switch to ON to enable the anti-spoofing.

      

      1. Complete the following fields:
         • ARP request rate limit: Enter the ARP request rate limit.
         • DHCP request rate limit: Enter the DHCP request rate limit.
    • Enable logging client data to external syslog: Enable the Enable logging client data to external syslog.
    • Under DHCP, enable the Force DHCP feature. This feature is disabled if you enable the Anti-spoofing feature.
    • Under DHCP, enable the DHCP Option 82 feature. DHCP Option 82 allows a DHCP Relay Agent to insert circuit−specific information into a request that is being forwarded to a DHCP server. This option works by setting two sub-options: Circuit ID and Remote ID. The insertion of DHCP Option 82 information is now supported for wireless clients in RUCKUS One. By default, this feature is disabled.

      

    • Access Control: Toggle the Access Control switch to ON to enable the access control policy feature.

      

      • Complete the following steps to enable the create a new access control policy:
        1. Toggle the Access Control switch to enable the access control feature. By default this feature is disabled.

           

        2. (Optional) Select a policy from the Access Control Policy drop-down.
        3. (Optional) Click Add to add an access control policy.
        4. (Optional) Click Select Separate Profiles to select another access control policy. For more information, refer to Creating an Access Control Policy.
        5. (Optional) Click Save as AC Policy to display the Add Access Control Policy dialog box and create a new access control policy.

           

        6. For Policy Name, enter a name.
        7. For Description, enter a short description for the policy.
        8. Configure Layer 2, Layer 3, Device & OS, Applications, and Client Rate Limit. For more information, refer to Creating an Access Control Policy.
        9. Click Save as AC Profile to create a new Access Control policy.
        10. If you want to cancel the Access Control Policy selection, click Select separate profiles to exit from the Select Access Control Profile.

24. Select the Radio tab and complete the following radio settings:

    

    1. Complete the following fields:
       • Hide SSID: Select this feature to hide SSID.
       • Load Control: Complete the following fields:
         • Max Rate: Choose one of the following options from the drop-down list:
           • Unlimited—no limits on bandwidth allocation.
           • Per AP—The max bandwidth allocation limit of all connections to that specific network on the AP. If selected, two other options appear, Upload Limit and Download Limit. If either (or both) boxes are checked, a sliding scale appears and you can drag your cursor along the line to choose the Mbps limits.
         • Max clients per radio: Limit the number of clients that can associate with this network per AP radio (default is 100).
         • Enable load balancing between all radios: Select this check box to enable load balancing for all radios. Load balancing helps improve network performance by helping to spread the client load between the radios on the AP.
         • Enable load balancing between APs: Select this check box to spread the client load between nearby access points, so that one AP does not get overloaded while another sits idle.
       • OFDM only (Disables 802.11b): Select the check box to enable this option. Enabling this option disables CCK rates of 1, 2, 5.5, and 11 Mbps, so no 802.11b-only clients can connect. Beacons and probe responses will be transmitted at 6 Mbps, and data frames at 6, 9, 18, 24, 36, 48, and 54 Mbps. Enforcing higher minimum data rates increases overall network throughput capacity, but reduces the distance at which clients are able to remain connected.

         

       • Data Rate Control (2.4 GHz & 5 GHz): Configure the following:
         • BSS Min Rate: Select None, 12 Mbps, or 24 Mbps from the drop-down list. Use this option to configure the minimum transmission rate supported by the network. If OFDM Only is enabled, the only valid options are 12 Mbps and 24 Mbps, with Mgmt Tx frames fixed at 6 Mbps. This option can also be used to prevent 11b clients from connecting, and to allow greater client density with higher data rates.
         • Mgt Tx Rate: Select 1, 2, 5.5, 6, 9, 11, 12, or 18 Mbps from the drop-down list. This option is only available if both Enable OFDM only and BSS Min Rate are disabled. (Otherwise, the Mgmt Tx Rate is defined by those settings.) Use this setting to configure the rate at which management frames are sent. The default is 6 Mbps.
25. Select the Networking tab and configure the following.

    

    • Enable Agile Multi-Band (AMB): Introduced by the Wi-Fi Alliance, Agile Multiband is a collection of features designed to improve resource utilization, balance Wi-Fi load, increase capacity, and provide the best possible Wi-Fi experience. AMB configures WLANs to send IE Multi Band Operation announcements that include beacon reporting, channel non-preference, cellular capability, and association disallow. It interoperates with existing load balancing protocols including 802.11k and 802.11r.
    • Enable 802.11k neighbor reports: Select the check box to enable this option. Enhances roaming by providing a list of neighbor APs to the client device.
    • Enable 802.11d: Select the check box to enable this option. Allows the AP to support multiple regulatory domains by the addition of a country information element to beacons, probe requests, and probe responses.
    • Enable 802.11r Fast BSS Transition: 802.11r Fast BSS Transition fast roaming protocol that reduces the number of frame exchanges required for roaming and allows the clients and APs to reuse the master keys obtained during a prior authentication exchange.
    • Client Inactive Timeout: Enter the duration in seconds. This option disables the client if the client is inactive for the configured duration.
    • Directed MC/BC Threshold: Enter the number of counts. The point at which an AP stops converting group addressed data traffic to unicast is indicated by the number of radio client counts.
    • Airtime Decongestion: Set the switch to ON to activate the airtime decongestion feature.
    • Join RSSI Threshold: Set the switch to ON and then enter the threshold value. This option is disabled if you enable the Airtime Decongestion option.
    • Transient Client Management: Set the switch to ON and the configure parameters for Join Wait Time, Join Expire Time, and Join Wait Threshold.

      

    • Optimized Connectivity Experience (OCE): Set the switch to ON and then and configure parameters for Broadcast Probe Response Delay and RSSI-Based Association Rejection Threshold.

      

    • Select the AP Host Name Advertisement in Beacon check box to enable the feature. When this feature is enabled, the AP will take the configured host name and insert it as a separate vendor specific IE in beacon and probe response frames, which will be used by our partners to identify the AP by name.
    • Enable the GTK Rekey option. This feature helps period generation of the new group key for secure musticast and broadcast traffic.
    • Enable the Multicast Filter feature. By default, this feature is disabled. When the Multicast Filter option is enabled on an AP, it will drop all IPv4 and IPv6 multicast and broadcast from associated wireless clients except for the below which forms into "multicast filter bypass" list. Note that the downstream multicast is unaffected.
      • ARP Request
      • DHCPv4 Request
      • DHCP v6 Request
      • IPv6 NS
      • IPv6 NA
      • IPv6 RS
      • IGMP
      • MLD
      • All unicast packets

      Multicast Filter and Multicast Rate Limiting are mutuaally exclusive features. From the RUCKUS One web interface, you cannot enable them at the time.

    • Enable the Multicast Rate Limiting feature. Multicast rate limiting and Multicast filtering are mutually exclusive features, SSID rate limiting will always take precedence if Multicast rate limiting is also configured. Multicast downlink rate limiting should not be greater than 50% of BSS min rate.
    • Under RADIUS Options, configure the following settings.
      • NAS ID: Identifies clients to a RADIUS server. Select an option from the list.
      • MAC Delimiter: Select Dash or Colon.
      • NAS Request Timeout: Enter the timeout period (in seconds) after which an expected RADIUS response message is considered to have failed.
      • NAS Max Retries: Enter the number of failed connection attempts after which RUCKUS One will failover to the backup RADIUS server.
      • NAS Reconnect Primary: Enter the number of minutes after which RUCKUS One will attempt to reconnect to the primary RADIUS server after failover to the backup server.
      • Called Station ID: Allows NAS to send the ID, which is called by the user. Select an option from the list.
26. Select the Advanced tab and configure DITM, QoS Mirroring, and QoS Map set.
    1. Set the DTIM (Delivery Traffic Indication Message) Interval by dragging the slider between Lower latency to Longer client battery life. The valid range is from 1 through 255.
    2. Toggle the QoS Mirroring switch to enable the feature and configure the QoS mirroring scope. From the QoS Mirroring Scope drop-down, select one of the following options:
       Note: QoS Mirroring allows an AP to use a client's uplink Quality of Service (QoS) classification (voice, video, best effort, or background) to classify the client device's downlink packets in the mirrored (reverse direction) stream. The AP assigns the downlink packets to the same QoS category as the uplink packets. By default, this feature is enabled. This QoS Mirroring is supported only on the APs that are running RUCKUS One AP firmware version 7.0 or higher.
       • MSCS requests only: When selected, QoS mirroring is enabled only for clients that send mirrored stream classification service (MSCS) requests. This is the default setting.
       • All clients: When selected, QoS mirroring is enabled for all clients.

       

    3. Toggle the QoS Map Set switch to enable QoS Map Set and configure the feature. The QoS Map Set feature reprioritizes downlink packets based on the configured mappings. When an AP receives a downlink packet, it checks the existing DSCP (Layer 3 QoS) marking, compares it to this map set, and changes the user priority (Layer 2 QoS) values for transmission by the AP. QoS map settings can be customized and applied per WLAN. From the Priority list, select a priority and click Next. To edit the QoS Map Set, select a priority from the list and click Edit. In the Edit QoS Map page, configure the DSCP Range and Exception DSCP Values. You can enter multiple exception DSCP values separated by commas.

       

27. Click Next.
    The Venues page is displayed.
28. Complete the following steps to configure a venue:
    1. Select the venues in which you want to activate this network:
       • To activate the network in all of your venues, select the check box beside Venue at the top of the table and click Activate.
       • To activate the network in a specific venue, locate the venue from the list, and set the switch to ON in the Activated column.

       The APs, Radio, and Scheduling of the selected venue is displayed in the table.

       

    2. By default, this network configuration is applicable for all APs and with Radio Band of 2.4 and 5 GHz. To select specific AP groups and modify Radio Band, complete the following steps:
       1. Click All APs in the APs column. The Select APs dialog box is displayed. To activate this network on all current and future APs at this venue. You can also choose a radio band of 2.4 GHz, 5 GHz, or both.

          

       2. Click Select specific AP groups to activate this network on specific AP groups including any AP that is added to selected AP groups in the future. The APs not assigned to any group option is displayed. After APs not assigned to any group is selected, VLAN and Radio Band options are displayed:

          

       3. In the VLAN option, by default VLAN-1 is selected. Click Edit (pencil icon) icon and configure the VLAN or VLAN pool for the selected AP group.
       4. In the Radio Band option, select 2.4 GHz, 5 GHz, or both 2.4 and 5 GHz from the drop down list for the selected AP group.
       5. Click Apply.
    3. By default, this network configuration is scheduled for 24/7. To configure the Scheduling, complete the following steps:
       1. Click 24/7 in the Scheduling column. The Schedule for Network <network-name> in Venue <venue-name> dialog box is displayed. You can also choose a schedule of 24/7 or follow below steps to customize the schedule.

          

          1. Click Custom Schedule.
          2. Network schedule is customized as per the your requirement. You can configure the schedule for Monday through Sunday and from midnight to midnight (from 00:00 hours through 23.59 hours). For more information, click See tips. The Network Scheduler Tips dialog box is displayed.

             

          3. Click OK to close the Network Scheduler Tips dialog box.
          4. Click Apply.
29. Click Next.
    The Summary page is displayed.
30. Review the settings that you configured.
31. Click Finish.