You can create a network that authenticates users against a remote authentication, authorization, and accounting (AAA) server. Before you create a network, write down the IP address, port number, and shared secret of the primary and secondary (if any) RADIUS servers that you want to use to authenticate network users.

1. On the navigation bar, click Wi-Fi > Wi-Fi Networks > Wi-Fi Networks List.
   The Wi-Fi Networks page is displayed.
2. Click Add Wi-Fi Network. Alternatively, select an Enterprise AAA (802.1X) from the network list by clicking the radio button next to the Name column, and then click Clone.
   The Create New Network page is displayed.
3. Complete the following settings in the Network Details page.
   • Network Name: Enter a name (2 to 32 characters) for a network. By default, this name is also used as the SSID.
   • Set different SSID: (Optional) Click Set different SSID to configure an SSID different from the network name.
     The SSID field is displayed.

     • SSID: Enter an SSID name (2 to 32 characters).
   • Description: Enter a description (up to 64 characters) to help you identify the network.
   • Network Type: Choose Enterprise AAA (802.1X).
     A structure diagram of an Enterprise AAA (802.1X) is displayed.

     Note: If you used the Clone option, the Network Type is already set to Enterprise AAA (802.1X).

   

4. Click Next.
   The AAA Settings page is displayed.

   

5. Security Protocol: Select the security protocol from the drop-down list. The options are:
   • WPA2 (Recommended) (Default)
   • WPA3
   Note: WPA2 provides strong Wi-Fi security and is supported on all mobile devices manufactured after 2006, making it the recommended choice unless there is a specific need for an alternative. Devices with 6 GHz radios require WPA3, which offers the highest level of Wi-Fi security but is only supported on devices manufactured after 2019. WPA2/WPA3 mixed mode allows devices to connect using either WPA3, the most secure standard, or WPA2, which remains widely compatible.
6. Encryption Type: This field appears only when WPA3 is selected. Choose an encryption type from the drop-down list:
   • AES (default)
   • AES-GCMP-256

     

     Note: 11ac Wave 1 APs do not support the AES-GCMP-256 encryption type, and therefore cannot operate on SSIDs that use this encryption.

     Note: When AES-GCMP-256 encryption is selected, the 802.11r Fast BSS Transition option does not appear in the Networking section under Show more settings

     Note: According to WPA3 Specification (version 2 or later version), AES-GCMP256 only support following cipher suites. Depending on the client type and OS, some clients may may reject to connect to the WLAN if your RADIUS server does not use one of these required cipher suites:

     • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: CDHE and ECDSA using the 384-bit prime modulus curve P-384.
     • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: ECDHE using the 384-bit prime modulus curve P-384 and RSA ≥ 3072-bit modulus.
     • LS_DHE_RSA_WITH_AES_256_GCM_SHA384: RSA ≥ 3072-bit modulus and DHE ≥ 3072-bit modulus.
7. By default, Use External AAA Service is selected.
   If you want to use a certificate authority, select Use Certificate Auth and select up to five certificate templates from the Certificate Template drop-down or click Add to add a certificate template. Refer to Adding a Certificate Template for instructions on how to add a certificate template.
8. Identity Group: Select an identity group from the drop-down or click Add to add an identity group. Refer to Adding an Identity Group for instructions on how to add an identity group. To view details about the identity group, click View Details.
   The Identity Group sidebar is displayed.
   Note:

   • When an identity group is selected, all devices joining the network will automatically become an identity within that group, as displayed on the Identity Group page.
   • Users have the option to either select an existing identity group from the list or create a new one.
   • During network editing, the originally selected identity group cannot be removed, but it can be changed to a different identity group.
9. Authentication Service: Select the existing RADIUS Server from the drop down list or complete the following steps to add a new RADIUS Server.
   1. Click Add Server and configure a new RADIUS Server. Refer to Adding and Managing a Radius Server Profile.
10. Proxy Service: Toggle switch to ON to enable the proxy service.
    Note: Use the controller as proxy in 802.1X networks. A proxy AAA server is used when APs send authentication/accounting messages to the controller and the controller forwards these messages to an external AAA server.
11. Accounting Service: Toggle the switch to ON to enable this option and select the existing RADIUS Server from the drop down list or complete the following steps to add a new RADIUS Server.
    1. Click Add Server and configure a new RADIUS Server. Refer to Adding and Managing a Radius Server Profile.
12. MAC Authentication: Toggle the switch to ON to enable the MAC Authentication feature and select a MAC Address Format from the drop-down.
    In the 802.1X and MAC Authentication method, MAC authentication is the first layer of security—a list of authorized MAC addresses is configured on the network device first. Devices with MAC addresses that are not on the list are denied access to the network. The 802.1X authentication method uses a RADIUS server to verify the user’s identity (for example, username, password) before granting access to the network. A RUCKUS AP grants access to UE only after both the MAC authentication and 802.1X authentication are successful.

    • External MAC Auth: Select the MAC Address Format from the drop down options to enable external MAC authentication.

      Supported MAC address format are:

    Supported MAC address format are:

    • Upper case MAC address separated by colons: 70:EA:5A:78:A1:A0
    • Upper case MAC address separated by hyphens: 70-EA-5A-78-A1-A0
    • Upper case MAC in a continuous string: 70EA5A78A1A0
    • Lower case MAC address separated by colons: 70:ea:5a:78:a1:a0
    • Lower case MAC address separated by hyphens: 70-ea-5a-78-a1-a0
    • Lower case MAC in a continuous string: 70ea5a78a1a0

    Note:

    • MAC Authentication provides an additional level of security for corporate networks. Client MAC addresses are passed to the configured RADIUS servers for authentication and accounting.
    • By default, the MAC Authentication is disabled.
    • Changing the MAC Authentication option requires you to re-create the Enterprise AAA (802.1X) network.​ Currently, there is no edit option for this feature.
13. External MAC Auth: Select the MAC Address Format from the drop down options to enable external MAC authentication.
14. Click Show more settings.

    By default, the VLAN sub-tab is displayed. Each sub-tab includes additional Wi-Fi configuration options to configure the settings of your preference. Refer to Configuring Additional Settings for a Wi-Fi Network to configure each of the available settings.

    Note:

    Demonstration of Advanced Settings for a Wi-Fi Network. This video explains advanced settings for a Wi-Fi network and walks you through the process of configuring them.

    Click to play video in full screen mode.

15. Click Next.
    The Venues page is displayed.

    

16. Select one or more venues where you want to activate this network by clicking the checkbox next to the Venue column, and then toggle the switch below the Activated column.
    The details in the APs, Radio, and Scheduling columns are displayed for all the activated venues. By default, this network configuration is applicable for All APs and their applicable radio bands, and is scheduled to be available 24/7.
    1. Click on the All APs hyperlink in the APs column or the list of radios in the Radios column of the Venues section on the Create New Network page to configure APs and radio frequency bands for the selected venue.
       The Select APs dialog box is displayed. Select one of the following options:

       • All APs: Select All APs to activate this network on all current and future APs in this venue. Choose a radio band from the drop-down list. You can choose one or more of the supported radio bands.

         

       • Select specific AP groups: Select Select specific AP groups to activate this network on specific AP groups including any AP that is added to the selected AP groups in the future. The APs not assigned to any group option is displayed.

         After APs not assigned to any group are selected, VLAN and Radio Band options are displayed:

         

       • In the VLAN option, by default VLAN-1 is selected. Click the icon and select VLAN or pool from the dropdown list. Depending on the selection, enter the VLAN ID or select the pool option from the drop-down list.
       • In the Radio Band option, select one or more of the supported radio bands from the drop-down list for the selected AP group.
       • Click Apply.
    2. Click on the 24/7 hyperlink in the Scheduling column of the Venues section on the Create New Network page to customize the schedule.
       The Schedule for Network <network-name> in Venue <venue-name> dialog box is displayed.

       

       • Click Custom Schedule.
       • Customize the network schedule as per your requirement. You can configure the schedule for Monday through Sunday and from midnight to midnight (00:00 hours through 23:59 hours). Click the See tips hyperlink for information on how to set up a custom schedule. The Network Scheduler Tips dialog box is displayed.

         

       • Review the tips and click OK to close the Network Scheduler Tips dialog box.
       • Click Apply. The hyperlink updates to ON now. When hovered over, displays the time until which the scheduler will remain active (<Day> <Time>).
    3. Toggle the Network Tunneling switch on to enable this feature. This feature defines how network traffic is tunneled at the venue. When you enable the switch, a Tunnel: <venue-name> sidebar is displayed.
       Select a Tunneling Method from the drop-down list. Selecting SoftGRE allows you to choose a SoftGRE profile and optionally enable and configure IPsec (Refer to Creating a SoftGRE Profile and Adding an SD-LAN Service). The SD-LAN option is available only for networks that include RUCKUS Edge devices. Click Add to save and apply your changes.

       Note: The Network Tunneling switch appears only when the venue is Activated.
17. Click Next.
    The Summary page is displayed.
18. Review the settings that you configured and click Finish.