![](http://volkanbaksi.com/wp-content/uploads/2021/02/Ruckus_Wireless.jpg)
Merhaba,
Bu yazımda sizlere Windows Nps Sunucu üzerinde Ruckus ZoneDirector ile 802.1x ve Dynamic Vlan yapısını oluşturacağız.
Mevcut yapımda ihtiyaç duyulan ürün ve sunucu rolleri;
- Windows Server 2016 : Active Directory , CA, DHCP
- Windows Server 2016 : NPS
- Ruckus ICX 7150 POE Switch
- Ruckus ZoneDirector 1200
- Ruckus ZoneFlex R710
![172.18.0.7
ZoneDirector 1200
VLAN 240
172.18.40.0124
VLAN 220
172.18.20.0124
172.18.0.0124
172.18.2.0124
SSID : TEST
DHCP
172.18.0.3
172.18.2.100
R710
'CX 7150
172.18.40.10
172.18.0.8
172.18.2.101
172.18.20.10](http://volkanbaksi.com/wp-content/uploads/2021/02/image-7.png)
Bu yapıyı oluşturmamızdaki amaç, kablosuz bir ağa kimin hangi yetkilerle bağlanması gerektiğini belirliyoruz. Oluşturulan dynamik vlan yapısı ile kullanıcı sayıları, trafik ve broadcast değerlerini kontrol altına almış oluyoruz.
Ilk olarak switch yapımızı oluşturarak işe başlıyoruz.
Switch içerisine vlan databaselerini oluşturuyoruz. Daha sonra oluşturulan vlan databaselerinin içerisine Controllerin bağlı olduğu portu tagged yapıyoruz. Buradaki amaç , bir porttan birden çok vlanın geçebilmesidir.
vlan 200 name
tagged ethe 1/1/13 lag 1 to 2
untagged ethe 1/1/1
!
vlan 202 name
tagged ethe 1/1/13 lag 1
untagged ethe 1/1/1 to 1/1/12
!
vlan 220 name
tagged ethe 1/1/13 lag 1
!
vlan 240 name
tagged ethe 1/1/13 lag
ZoneDirector içerisine AP’lerimizi ekleme işlemine geçebiliriz. Ekleme işlemi için aşağıdaki link’den yardım alabilirsiniz.
Ruckus ZoneDirector ‘e R710 Wirelless Cihaz Ekleme – Web Sitesi
Zone Director içerisine öncelikli olarak AAA Servers eklemesi yapılması gerekmektedir.AAA Servers içerisine NPS server bilgilerini gireceğiz.
Services & Profiles – AAA Servers – Create diyerek Nps Server bilgilerini giriyoruz.
![Create New
• Name
Type
Encryption
Auth Method
Backup RADIUS
• IP Address
• Port
Shared Secret
Confirm Secret
Retry Policy
Request Timeout
Max Number of Retries
NPS
C) AD forweb Portal
D TLS
PAP C) CHAP
C) LDAP @ RADIUS C) RADIUS Accounting
x
0 TACACS* C) ADfor802.1x
Enable Backup RADIUS supguyrt
1721808
1812](http://volkanbaksi.com/wp-content/uploads/2021/02/image-8.png)
Aynı işlemi NPS Server – Radius Clients içerisine de yapmamız gerekiyor.
![NPS (Local)
RADIUS Clients and ser.
i RADIUSCr,ents
Remote RADIUS Server
Policies
Connection Request P
Network Policies
Accounting
Templates Management
RADIUS Clients
RADIUS clierts you to the rework access severs that nvide access to your network
172.18.0.7 RADIUS EnaHed
Ruckus_ZoneDirectory Properties
>åvarced
Ena&ths RADIUS cliett
Sect an eistina templ*e:
Flier-db' n —re :
AÆress (IP or DNS):
Sect an eisting St—ed
To manuab'tpe a shared secrg cb=k Man" To aucmabzalty gener*e a *area
secret. You the RADIUS same
are
@M&tuS
C)](http://volkanbaksi.com/wp-content/uploads/2021/02/image-11.png)
Shared Secret ve Confirm Secret şifreleri NPS server Radius Clients alanına girilen şifre ile aynı olmalıdır.
Daha sonra ZoneDirector içerisine SSID Tanımlama işlemine geçiyoruz.
Bu işlem için Wireless LANs – Create WLAN diyerek SSID tanımlamasına başlıyoruz.
![RUCKUS
The Support Service will expire in [13] days
ZoneDirector Z01200
Edit
Clone
2021/01/25
View Mode:
Search
c
List
admin
Group
Dashboard
Access Points
Vireless LANs
Troubleshooting
Services & Profiles
Administer
Wireless LANs
— System
WG Default
+ create
Name
Delete
ESSID
Description
TYPe
No data available](http://volkanbaksi.com/wp-content/uploads/2021/02/image-9.png)
![Create WLAN
General
'ESSID:
WLAN Usages
Type :
Authentication
Method:
Fast BSS Transition:
Web Authentication:
Authentication Sewer:
Zero-IT Activation w:
x
Standard Usage (FW netwrk
C) Guest *ice y nd b.
C) Hotspot Service (WISPr)
C) Hotspot 2.0
C) Autonomous
@ open C) 802.1xEAP C) MACAddress C) 802.1xEAP+MACAddress
Enable 802.1% FT Roaming 802.11k Neight.-list Reportor
D Enable captive portal,'Web authentication
(l_Ä-s will to Web trey
Local Database v
Enable Zero-IT Activation
pmwZed with inst3Ä they Eg in)](http://volkanbaksi.com/wp-content/uploads/2021/02/image-10.png)
Bu bölümde dikkat edilmesi gereken alan Authentication bölümüdür.
Method: 802.1x EAP – Authentication Server Nps sunucusu olmalıdır.
![](http://volkanbaksi.com/wp-content/uploads/2021/02/image-21.png)
Encryption alanında Method- WPA2 , Algorithm – AES olmalıdır.
![Encryption
Method:
Algorithm:
802.11w MFP:
@ WPA2 C) WPA3 C) WPA-Mixed C) WEP-64(40bit) C) WEP-128(104bit) C) None
@ AES C) Auto (TKIP+AES)
@ Disabled C) Optional C) Required](http://volkanbaksi.com/wp-content/uploads/2021/02/image-13.png)
Oluşturulan SSID ile birden çok Vlan geçeceği için Zone Director içerisinde Enable Dynamic VLAN seçeneği mutlaka işaretli olmalıdır.
![Edit WLAN
Accounting Sewer:
Access control:
Application Recognition & Control:
URL Filtering:
Call Admission Control:
Rate Limiting:
SSIO Rate Limiting:
Multicast Filter:
VLAN Pooling:
Access V LAN:
Hide SSID:
Tunnel Mode:
Proxy ARP:
Disabled v +
L2/MAC No ACLs v
L3/4/IP address
Device Policy
Send Interim-update every
No ACLs v +
None v +
10
minutes
Precedence Policy
Default v
Enable Role based Access Control Policy
Enable Application Recognition & Control
Enable URL Filtering
D Enforce CAC on this WLAN when CAC is enabled on the radio
Per Station Uplink Disabled
UpLink Enable O
DmvnLink Enable O
Per Station Dovmlink Disabled
mbps 1-200)
mbps 1-200)
Per STA rate limiting will not work SSID rate limiting is enabled
D Drop multicast packets from associated clients
VLAN Pools List None v +
set VA' Fcding, Must *icy)
VLANIDL 1
Enable Dynamic VLAN
D Hide SSID in deacon Broadcasting (Closed System)
Tunnel WLAN traffic to ZoneDirector
fw 'Jets PDA dues J
Enable Proxy ARP](http://volkanbaksi.com/wp-content/uploads/2021/02/image-12.png)
Nps sunucusuna giriş yapılır. Policy- Connection Request Policies-Secure Wireless Connections alanına giriş yapılır.Add seçeneği tıklanır.
![Cm-vnection
Cornection rewe pobes you to deignate connection rewe—s are processed loco or to renote RAD I US serv
P Name
Secu-e Wireless Corned ons
Ena bled
Secure Wireless Connections Properties
Condions Sethgs
the conditions for neva* polo.
f ccndtions match the connection NPS uses this pole,' to at.ti-onze the ccnnecbon reque— f cordtjcns nM match he
cmnecb•n reque— NPS skös this pcicy ard evSuates other pobzies. i addtjcnal pcicies are ccnfgured
Conditon description
NAS P ott Type condtjcn species the type of media b'/ the access cliert such as analog phone hes. ISDN tin-es or Mud
pnv*e IEEE 802.11 wireless. ane Ethernet switches.](http://volkanbaksi.com/wp-content/uploads/2021/02/image-14.png)
Access Client IpV4 Address alanı üzerinde Add seçeneği tıklanır.
![Secure Wireless Connections Properties
Condions Sethgs
Cc-iwre the cmåtOns for pobzy
f ccn6t6ns match the connection NP S uses this polo to at_tl-onze the connect6n reque— f cordtims 00 not match he
ccnnect6n reque— NPS skös pcicy and evSuates otter poldes, i addtjcr€ pcicies are ccnfwred
Select condition
Select a conation tlzn click Add
User Name
The use narne that is used access clent in RADIUS message This attrbuteis a ch&ö3ter string the
tyøcalb' contans a realm n«ne and a user accol_nt name
Ccnnatjon Plopeties
A ccets Client IPv4 A die.
The Access Client IPv4 Address condiOn specifet the IPv4 address of the Access C•nt that teqtzsting scess
Client IPvG
T lie Access Client IPVE Address the IPV6 the
RADIUS
OtOCd
T he Framed the framing
packets. such PPP o' SLIP.](http://volkanbaksi.com/wp-content/uploads/2021/02/image-15.png)
Access Client IPv4 Address içerisine ZoneDirector cihazının ip adresi yazılır.
![Secure Wireless Connections Properties
Condions Sethgs
Cc-iwre the cmåtOns for
f ccn6t6ns match the connection reg-leg. NPS uses this polo to at_tl-onze the cmnect6n reque— f condoms do not match fie
cmnect6n reque— NPS skös pcicy ard evSuates gobses. i addticr€ pcicies are ccnfwred
Select condition
Seled a tlzn click Add
Name
Use Name
The use narne
Ccnnecbon Plopeties
Client
The Access Cliel
Access Client IPv4 Address
IPv4 address of the Access Chet. You can Be p*ten-. m&ching
X
from RADIUS
72.180
Client I
The Access cli
from RADIU
Oto
Framed Pr
packets, such PPP o' SLIP.
string the
Letting access
Sting](http://volkanbaksi.com/wp-content/uploads/2021/02/image-18.png)
Daha sonra Network Polices işlemine geçilir.Network Policy içerisinde ilgili policy Enable edilir. Conditions alanı içerisinde NAS Port Type Wireless -IEE 802.11 olarak işaretlenir.
İsteğe bağlı olarak Machine Groups yada User Groups seçilir. Burada alan ile sisteme giriş sırasında Computer yada user bazlı erişim yetkisi tanımlanmış olur.
![VLAN220 (Domain Computers] Properties
Co&cns Cm<rans Setinß
Ccnfqure the ccndbons for this newc& policy
f match the connection NPS 'Bes tHs policy to author•ze the connection rewe< f condtjcns do not match the
cmrecbon NPS this ev*Jates are
NAS Pot T
Cmåtbn description
OR -Cther
NAS Type condition specifes the type of media used b,'the access clien such as analog phcne hes- ISDN. t'.nr— or
pnväe networks. IEEE 802. I I '"ireless. ard switches.](http://volkanbaksi.com/wp-content/uploads/2021/02/image-17.png)
Authentication Methods içerisinde MS-CHAP-v2 seçeneğini işaretliyoruz.
![Setings
Ccrfgure the contrairts for tris network poicy
f constraints are re n*ched by the connection reque* network access is detied
Authenticaton M ethods
Ide
Session Tirneou
called Station ID
Day resbidions
NAS Pott Type
Alow access orb to th•se '%-tts alihe-tteate whh specifed m*ods
EAP types are neqobated beween NPS the c:ie-d in in they
Microsoft Protected EAP (PEAP)
Sncr,pted version 2 (MS-CHAP
LISE Change aft&
LIZ can clunge
Û S-,cty-pted (CHAF)
(P AP SPAP)
cielts to comea œgdi*ing authelteation mebod](http://volkanbaksi.com/wp-content/uploads/2021/02/image-19.png)
Tunnel-Medium-Type : 802.1x olarak seçilecektir.
Tunnel-Pvt-Group-ID : Vlan ID seçilecektir.
Tunnel-Type : Virtual Lans (Vlan) seçilecektir.
![VLAN220 (Domain Computers] Properties
Co&ms Cm—rans Setings
Ccnfqure the *tings for poicy
con&iors and constr*-ts match he connection rewe— and the pcicy grans access. *tings are apok•d
RADIUS
Standard
Verd01 Spectic
R otling and Remote
IBA p I
IP Settings
To sera ad&ional attr%ües to RADIIJS cients, sect a RADIUS stardard attribute.
then cick at. you not cot-figure an attribute. it not sett to FADIUS clierts_ Se
pur 9ADIUS cliett docurzntation for required
• •Tpe
uro-PvtGwp-ID
al 02 fr _
220
LANs (VLAN)](http://volkanbaksi.com/wp-content/uploads/2021/02/image-20.png)
kalemine sağlık, teşekkürler hocam
Yeni makaleler istiyoruz