Connect APs to SmartZone over the public Internet

You can use SmartZone to manage APs at remote internet-connected locations, and tunnel selected traffic back to your network.

Your SmartZone / Data Plane(s) can be behind a NAT router, but this router requires a static WAN IP address.
Your APs can be behind NAT or double-NAT (e.g. if your ISP uses CGNAT).

You need to NAT incoming SSH and HTTPS traffic to your SmartZone.
You need to NAT one incoming TCP & UPD WAN port to each Data Plane, if you have any.
And you need to configure your APs with the public IP address of your SmartZone.

A complication is that you might already be serving an unrelated website on port 443.
This problem can be addressed by installing a reverse proxy (if you haven't already), and only passing HTTPS traffic if it matches the specific URL which SmartZone AP provisioning requires.

Other Firewalls

This guide configures NAT and HAProxy on pfSense. You will need to adapt the steps to suit other firewalls.

Coexistence with ZoneDirector / Unleashed Dedicated Master

If you also follow the ZoneDirector Guide or Unleashed Dedicated Master Guide then SmartZone can share a single WAN IP with either Unleashed Dedicated Master or ZoneDirector (but not both).

SmartZone configuration steps

Virtual SmartZone High Scale (vSZ-H) with 3 interfaces

I recommend using vSZ-H, with 3 interfaces, for an internet facing SmartZone.
This will only expose control interface SSH accounts to the internet.
This also lets you setup Partner-Managed Domains and gives you a Staging Zone, both of which let your remote location(s) manage their own APs.

vSZ-H network interface order

When you're assigning virtual switches or VLANs to your vSZ-H guest, remember the interface assignments are fixed:-
NIC 1: Control Interface
NIC 2: Cluster Interface
NIC 3: Management Interface

Disable SmartZone's AP certificate checks

We need to turn off SmartZone's AP device certificate checks, since we'll be proxying the AP traffic.
We will configure HAProxy to enforce AP device certificate checks.

ruckus-cli

ruckus> enable
Password: **********

ruckus# config

ruckus(config)# no ap-cert-check
Do you want to continue to disable (or input 'no' to cancel)? [yes/no] yes
Successful operation
% This configuration will take effective in a few minutes.

Firewall (pfSense) configuration steps

Add NAT SSH Port Forward

Firewall > NAT > Port Forward > Add (the down arrow)

Edit Redirect Entry > Protocol: TCP
Edit Redirect Entry > Destination port range > From port: SSH

TIP

If you can apply a Source rule (e.g. an ISP's IP range) then do so

Edit Redirect Entry > Redirect target IP > Address: <SmartZone Control IP>
Edit Redirect Entry > Redirect target port > Port: SSH
Save

Apply Changes

Add Data Plane NAT Port Forward(s), if you have any Data Planes

Multiple Data Planes

If you want to tunnel AP traffic back to your network then you need a vSZ-D/SZ-D for each AP firmware version you're using.
Each vSZ-D/SZ-D will need a unique Data External(NAT) Port.
Visit Network > Cluster and configure each Data Plane with a unique Data External(NAT) Port.

For each Data Plane:-

Firewall > NAT > Port Forward > Add (the down arrow)

Edit Redirect Entry > Protocol: TCP/UDP
Edit Redirect Entry > Destination port range > Custom: <Data External(NAT) Port>

TIP

If you can apply a Source rule (e.g. an ISP's IP range) then do so

Edit Redirect Entry > Redirect target IP > Address: <Data Plane Data IP>

TIP

This is the Primary(Access) IP if you split the Access and Core interfaces

Edit Redirect Entry > Redirect target port > Custom: 23233
Save

Apply Changes

Add CA and Certificate for HAProxy Frontend

Create SSL Offloading CA and Certificate

System > Certificates > Authorities > Add

Create / Edit CA > Descriptive name: internal-ca
Save

System > Certificates > Certificates > Add/Sign

Add Sign a New Certificate > Descriptive name: <external IP>
Internal Certificate > Certificate authority: internal-ca
Internal Certificate > Common name: <external IP>
Certificate Attributes > Certificate Type: Server Certificate
Save

Import AP Client Certificate CA

System > Certificates > Authorities > Add

Create / Edit CA > Descriptive name: RuckusPKI-HaProxy-CAs
Create / Edit CA > Method: Import an existing Certificate Authority
Existing Certificate Authority > Certificate data:-

Add a carriage return to the end of the pasted certificate, or your HAProxy setup may fail.
Save

Install HAProxy

System > Package Manager > Available Packages > haproxy-devel > Install > Confirm

Create HAProxy Backend

Services > HAProxy > Backend > Add

Edit HAProxy Backend server pool > Name: SmartZone
Edit HAProxy Backend server pool > Server list > add another entry (the down arrow)
- Name: SZWsg
- Address: <SmartZone Control IP>
- Port: 443
- Encrypt: tick
Health checking > Health check method > none
Save

Apply Changes

Create HAProxy Frontend

Services > HAProxy > Frontend > Add

Edit HAProxy Frontend > Name: Port443
External adress > Port: 443
External adress > SSL Offloading: tick
Default backend, access control lists and actions > Access Control lists > add another entry (the down arrow)
- Name: SZHost
- Expression: Host starts with:
- Value: <external IP>
Default backend, access control lists and actions > Access Control lists > add another entry (the down arrow)
- Name: SZWsg
- Expression: Path starts with:
- Value: /wsg
Default backend, access control lists and actions > Access Control lists > add another entry (the down arrow)
- Name: SZCert
- Expression: Custom acl:
- Value: ssl_c_used
Default backend, access control lists and actions > Actions > add another entry (the down arrow)
- Condition acl names: SZHost SZWsg SZCert
- backend: SmartZone
Advanced Settings > Advanced pass thru: option h1-case-adjust-bogus-client
SSL Offloading > Certificate > <external IP> (CA: internal-ca) [Server cer]
SSL Offloading > Certificate > Add ACL for certificate CommonName. (host header matches the "CN" of the certificate): tick
SSL Offloading - client certificates > Without client cert: tick
SSL Offloading - client certificates > Client verification CA certificates > add another entry (the down arrow)
- Certificates authorities: RuckusPKI-HaProxy-CAs
Save

Apply Changes

Certificate error when applying changes

If the HAProxy Frontend configuration fails to save then check you included the trailing carriage return when you pasted in the RuckusPKI-HaProxy-CAs certificate.

Add Global Options and Enable HAProxy

Services > HAProxy > Settings

Global Advanced pass thru > Custom options:-

h1-case-adjust server Server
h1-case-adjust content-length Content-Length
h1-case-adjust date Date
h1-case-adjust transfer-encoding Transfer-Encoding
h1-case-adjust content-encoding Content-Encoding
h1-case-adjust connection Connection
h1-case-adjust set-cookie Set-Cookie
h1-case-adjust www-authenticate WWW-Authenticate

General settings > Enable HAProxy: tick
General settings > Maximum connections: 5 (any number here, the # of APs is a safe bet)
Save

Apply Changes (ignore the warnings)

Add Firewall Rule so HAProxy receives traffic

Firewall > Rules > WAN > Add (the down arrow)

Destination > Destination > This firewall (self)
Destination > Destination Port Range > From: HTTPS (443)

TIP

If you can apply a Source rule (e.g. an ISP's IP range) then do so

Save

Apply Changes

AP configuration steps

Install the latest Solo software image onto your AP
SSH into the AP's CLI and configure the SmartZone's static external IP address:-
ruckus-cli
```
rkscli: set scg ip <external IP>
```

Optional: Allow APs with expired device certificates

You probably don't need this!

Ruckus APs manufactured since March 2014 already have valid certificates.

You'll know if you still have APs with expired certificates (also called Old Ruckus PKI Signed) because your SmartZone will be displaying a big red AP certificate is expired banner at the top of every page.

If this is you, then I guess you submitted certificate replacement request(s), but Ruckus refused to help unless you renewed your AP support licenses.

Add expired CA certificates

System > Certificates > Authorities > RuckusPKI-HaProxy-CAs > Edit CA (the pencil)
Existing Certificate Authority > Certificate data

Append extra certificates,or just replace everything

Add a carriage return to the end of the pasted certificate, or your HAProxy setup may fail.
Save

TIP

Don't be tempted to create an extra pfSense CA for these.

I sneak them into the end of the existing Ruckus CA stack so pfSense doesn't spam you every day with expired CA/Certificate notices.

Update HAProxy Frontend

Services > HAProxy > Frontend > Port443 > edit frontend (the pencil)

Advanced settings > Bind pass thru: ciphers DEFAULT:@SECLEVEL=0 ca-ignore-err 10 crt-ignore-err 7

Connect APs to SmartZone over the public Internet ​

SmartZone configuration steps ​

Disable SmartZone's AP certificate checks ​

Firewall (pfSense) configuration steps ​

Add NAT SSH Port Forward ​

Add Data Plane NAT Port Forward(s), if you have any Data Planes ​

For each Data Plane:- ​

Add CA and Certificate for HAProxy Frontend ​

Create SSL Offloading CA and Certificate ​

Import AP Client Certificate CA ​

Install HAProxy ​

Create HAProxy Backend ​

Create HAProxy Frontend ​

Add Global Options and Enable HAProxy ​

Add Firewall Rule so HAProxy receives traffic ​

AP configuration steps ​

Optional: Allow APs with expired device certificates ​

Add expired CA certificates ​

Update HAProxy Frontend ​

Connect APs to SmartZone over the public Internet

SmartZone configuration steps

Disable SmartZone's AP certificate checks

Firewall (pfSense) configuration steps

Add NAT SSH Port Forward

Add Data Plane NAT Port Forward(s), if you have any Data Planes

For each Data Plane:-

Add CA and Certificate for HAProxy Frontend

Create SSL Offloading CA and Certificate

Import AP Client Certificate CA

Install HAProxy

Create HAProxy Backend

Create HAProxy Frontend

Add Global Options and Enable HAProxy

Add Firewall Rule so HAProxy receives traffic

AP configuration steps

Optional: Allow APs with expired device certificates

Add expired CA certificates

Update HAProxy Frontend