Skip to content

Wireless Networking (Ruckus)

Ruckus wireless deployments are typically managed by a controller — a ZoneDirector (smaller/legacy deployments) or SmartZone (larger/newer deployments) — which centrally configures and monitors a fleet of Access Points (APs). Most day-to-day management happens through the web UI; the CLI is mainly used for initial setup, recovery, and low-level diagnostics.

Console Connection

Ruckus console ports run at a higher baud rate than Cisco switches:

RUCKUS CLI   Baud: 115200

ls /dev/*usb*              # Check for TTY port
screen [pasted tty] 115200 # Connect

CLI Modes

Like Cisco IOS, the Ruckus CLI has unprivileged, privileged, and configuration modes:

ruckus> en                  ! Enter privileged (enable) mode
ruckus# conf                ! Enter configuration mode
You have all rights in this mode.
ruckus(config)#

From config mode, sub-modes exist for specific areas (e.g. certificate, wlan, ap) — entering one changes the prompt to reflect it, e.g. ruckus(config-certificate)#.

Initial Setup / Recovery

Restore/Erase SSH Certificate

Useful when the controller's SSH certificate is corrupted or you need to force regeneration:

ruckus> en
ruckus# conf
ruckus(config)# certificate
ruckus(config-certificate)# restore

Factory Defaults

If you need to fully reset a ZoneDirector (equivalent to Cisco's erase nvram + reload), this is normally done via a physical reset button (hold ~10-20s) rather than the CLI, since a corrupted config can make the CLI itself unreachable. Check the specific hardware model's documentation before doing this on a live unit — it will disconnect all managed APs until reconfigured.

WLAN (SSID) Configuration

WLANs are almost always created and managed through the ZoneDirector/SmartZone web UI rather than the CLI, since they involve many interdependent settings (security, VLAN, radio bands, guest access). The general model:

  • WLAN — the logical SSID definition (name, security type, VLAN mapping)
  • AP Group — a set of APs that share the same WLAN assignments and radio settings
  • Each AP broadcasts every WLAN assigned to its AP Group

Typical settings to configure per WLAN:

Setting Purpose
SSID name The network name broadcast to clients
Authentication Open, PSK (WPA2/WPA3-Personal), 802.1X (WPA2/WPA3-Enterprise)
VLAN ID Maps wireless clients into a specific VLAN — mirrors the VLAN design on the wired side
Client isolation Prevents wireless clients on the same SSID from talking to each other (common for guest networks)
Band 2.4GHz / 5GHz / 6GHz (Wi-Fi 6E) steering

AP Management

Access Points "join" a controller automatically once they can reach it on the management VLAN (via DHCP option 43, DNS zonedirector.<domain>, or manual IP entry on the AP itself).

Useful controller-side checks (web UI, or CLI equivalents where available):

show ap all                ! List all APs known to the controller and their status
show ap-group               ! List AP groups and their WLAN assignments

Unverified: unlike the rest of this section (console baud rate, CLI mode structure, and the certificate-restore example), the exact command syntax above was not sourced from a confirmed Ruckus CLI reference — only the general behavior is documented in Ruckus manuals. Confirm exact syntax with ? / tab-completion on your actual ZoneDirector/SmartZone CLI, or the official Ruckus CLI reference guide for your firmware version, before relying on these commands operationally.

Common AP states:

State Meaning
Connected AP is online and managed
Disconnected AP lost contact with the controller (check switch port / DHCP snooping trust settings if APs get power but no IP)
Provisioning AP is downloading firmware/config after first joining
Approval pending New AP awaiting manual approval (if auto-approval is disabled)

Wired-Side Considerations

Ruckus APs are just switch-connected devices from a wired perspective — the same hardening practices from Security Hardening apply:

  • Put APs on a dedicated management VLAN (not the same VLAN as client traffic)
  • If APs are PoE-powered, confirm power inline auto is set on the switchport (see Cisco IOS CLI Reference)
  • Trunk the switchport if the AP needs to tag multiple client VLANs; access port if it's single-SSID/single-VLAN
  • Don't apply switchport port-security maximum 2 to AP-facing ports without accounting for the AP's own MAC plus any wired clients bridged through it