Technical Use Cases for Schools and Multi-Tenant Deployments In this virtual RUCKUS Technical Family Distributor Day will focus on RUCKUS solutions for Schools and Multi-tenant deployments, helping you to deliver the best Wi-Fi experience for network users. We present technical use cases with practical tips and tricks on how to leverage the latest features within the RUCKUS portfolio complete with live demos of the platforms. Agenda: • RUCKUS Introduction • RUCKUS Portfolio o LAN o WLAN o Control & Management • Primary Education Best Practices o RUCKUS products for Education o Unleashed vs Cloud vs SmartZone as WaaS o Cloudpath features often deployed in Education • Multi-Tenant Best Practices o MDU and Wi-Fi design (separate SSIDs per tenant vs one SSID for all) o RUCKUS Cloud and DPSK o SmartZone as WaaS using internal and external DPSK o Cloudpath MDU features • Demo of RUCKUS Cloud with DPSK and SmartZone/Cloudpath with the MDU portal • Q&A For more information on Purdicom RUCKUS visit https://purdi.com/vendors/ruckus-netw...​ Or for more articles on the blog, please check https://purdi.com/blog/​

1. Technical use cases for
Schools and Multi-
Tenant Deployments
Simon Williams - Sr. SE – UK&I

2. Agenda
• Primary Education Challenges
and Best Practices
• RUCKUS products for Education
• RUCKUS solutions for Education
• Cloudpath in Education
• Multi-Tenant Best Practices
• MDU and Wi-Fi design (separate
SSIDs per tenant vs one SSID for
all)
• RUCKUS Cloud and DPSK
• SmartZone as WaaS using
internal and external DPSK
• CloudPath MDU features
• Demo
• RUCKUS Cloud with DPSK
• SmartZone and CloudPath using
E-DPSK
• Q&A
2

3. Primary Education:
Challenges and Best Practices
10

4. 11

5. eSports are the New Athletics
12

6. The 5 Phases of Digital Learning Transition

7. 14
Back to School Checklist:
Network and Broadband Scaling
Teacher/Student Safety and
Wellness
Reliable Networks for Digital Learning
1
2
3

8. 15
New requirements for wireless communication
Low Latency
Energy Efficient
High User Density - Capacity
Faster connection
Resilient

9. Wireless Technologies to Scale
16
• Wi-Fi 6 (802.11ax)
• Capacity and speed advancements
• IoT
• Smart classrooms, energy saving, safety
• Flexible deployment options
• Adapt while retaining your investment in APs
• Reducing management touch points
• Centralised and mobile management
• MSP managed
• Network controllers
• No controller (standalone or Cloud-managed)
• Controller capacity

10. Switching Technologies to Scale
17
• Scalable design - Stackable vs. Chassis
• No more rip-and replace
• Upgrade uplinks 1Gb-10Gb-40Gb-100Gb
• Flexible deployment options
• Easily change without hardware replacement
• Reducing management touch points
• Stacking/Long-distance stacking
• Optimised network underlay for Wi-Fi + IoT
• Unified management - Unified security and policy
management
• PoE technologies
• PoE, PoE+, 802.3bt (90W)
• Multigigabit technologies
• 2.5/5/10GbE

11. 18
How does this fit in my classroom?
Access point serves:
• Chromebooks, laptops and tablets
• VR headsets
• Smartphones
• Smartboard
• Display
• Printer
• BYOD (phones, etc.)
Classroom switch serves:
• Access points
• Surveillance Cameras
• IP Phone
• 3D printer
• TV Set-top box
• Wired headsets
• High-performance computing

12. Primary Education:
Best Building Blocks
19

13. RUCKUS Products for Education
ICX Switches
• Classroom-ideal fan-less switch
• Leading PoE density
• Uplink scaling 10/40GbE
• Stacking
• Hitless failover & ISSU
• SmartZone/Cloud-managed
Cloud Managed
• Easy to deploy & manage
• Scales with 1:1 deployments
• Anywhere learning
• Fully-featured mobile App
• Rich, long-term reporting
Access Points
• Everyone connected everywhere
• Fewer APs per deployment
• R510/R610/R710 – Wi-Fi 5
• R550/R650/R750 – Wi-Fi 6
• BeamFlex+ - World-class Wi-Fi
• Multigig – Wi-Fi 6
SmartZone
• Centralised management APs + ICX
• Fast troubleshooting with VCD
• Support for legacy + latest APs
• Built-in resilience
• Hardware + Virtual
• Ruckus Analytics Support
Cloudpath
• Easy Chromebook onboarding
• HTTPS inspection
• No password tyranny
• BYOD and 1:1 policies
• DPSK or Certificates
• Guest access w/granular policy
Unleashed
• Instant Networking
• Easy to deploy and manage
• APs and Switches
• Highly Resilient
• Mobile App

14. Good Better Best
Outdoor
Indoor
Specialty
T750 O/SE
802.11ax
4x4:4
GPS, SFP+, IoT
PoE Out
T610
Wave 2
4x4:4
R510
Wave 2
2x2:2
H510
Wave 2
2x2:2
4-port switch
R610
Wave 2
3x3:3
C110
Wave 2
2x2:2
2-port switch
R320
Wave 2
2x2:2
H320
Wave 2
2x2:2
2-port switch
T310c/d/s/n
Wave 2
2x2:2
M510
Wave 2
2x2:2
4G Backhaul
E510
Wave 2
2x2:2
Ext. BeamFlex+ Antenna
R720
Wave 2
4x4:4|2.5GbE
R850
802.11ax
4x4:4|5GbE
8x8:8|IoT
R750
802.11ax
4x4:4|2.5GbE
IoT
R550
802.11ax
2x2:2|IoT
H550
802.11ax
2x2:2|2xIoT
4-port switch
Wi-Fi
6
Wi-Fi
6
T710
Wave 2
4x4:4
SFP, PoE Out
T350c/d/SE
802.11ax
2x2:2|IoT
Future
R350
802.11ax
2x2:2|IoT
Future
H350
802.11ax
2x2:2|IoT
2-port switch
R650
802.11ax
2x2:2|2.5GbE
4x4:4|2x IoT
Future
Wi-Fi
6
An 802.11ac or .11ax Access Points for Education

15. ICX Switch Portfolio for Education
23
Optical Modules and Cables
ICX 7250
Access
ICX 7450
Access-Aggregation
ICX 7750
Aggregation-Core
Access
Aggregation/Core
ICX 7650
Premium
Access-Aggregation
ICX 7850
Premium Aggregation-Core
ICX 7150 Z-Series
Multigigabit Entry-Level Access
ICX 7150
Entry-Level Access
ICX 7550
Access-Aggregation

16. © 2020 CommScope, Inc
24
AP Coverage Mainstream
• Mostly 1Gb APs
• With some 2.5/5Gb APs
• 1/10Gb Uplinks
• Mostly 2.5Gb APs
• With some 5/10Gb APs
• Multi-10Gb Uplinks
R750
R550/R650
ICX7150-24P/48P Stack with
ICX7150-C10ZP for Mulitgig APs
R850
R750
ICX7150-48ZP Stack with
ICX7150-C10ZP for 5 GigE APs
RUCKUS ICX MultiGig – APs + Switches Use Case #1

17. © 2020 CommScope, Inc
25
RUCKUS ICX MultiGig – APs + Switches Use Case #2
Mainstream Premium
• Best flexibility of low-ratio
1Gb and 2.5/5/10 Gb
• All 5 Gb APs
• 10 Gb for other or future
R750/R850
R550/R650
ICX7550-24P/48P Stack with
ICX7550-24/48ZP for Mulitgig APs
R850
R850
ICX7650-48ZP Stack

18. RUCKUS Solutions for Primary Education
Flexible Learning
• Indoor + Outdoor Wi-Fi 5/6 APs
• Extended temp PoE switches
• Powered fibre
• Fibre backpack
• SZ DataPlane + Ruckus GRE
• M510 with 4G for temporary/mobile
1:1 Learning
• Reliable classroom connectivity
• Wi-Fi 6 access points
• Stackable PoE switches
• Cat6 and Cat6A cabling
• Fiber to the classroom
Securing Devices
• Donated devices need securing
• DPSK, Certificates, URL filtering
• BYOD
• Guest-access
Securing Campus
• Monitor lock-down of campus
• CCTV, lighting, motion detection
• Cloudpath for device security
• ICX high-power PoE for cameras (PTZ)
IoT - Environment
• IoT controller manages solution
• Monitor energy, heat, light,
moisture, CO, movement
• Monitor toilets, locker/cloak rooms
• CCTV tied in
• PoE powered from ICX switches
Outdoor APs
• Outdoor Wi-Fi 5/6 APs
• Place in library parking/grounds
• Place in school parking/grounds
• School bus
• Powered fibre furthers reach

19. 27
Cloudpath for Secure Device and User Onboarding
Password
Hell
Help Desk Purgatory
IoT
Explosion
BYOD
Breaches
Malicious
Users
• One-time-only sign-in
with certificates, the
gold standard in device
security
• DPSK for easy
deployment – more
secure than MAC
white-listing
• No passwords means
no password-related
trouble tickets
• Users can self-
onboard any device
using a 24x7 portal. IT
doesn’t need to take
care of each user
• Any device, regardless
of OS, can be secured
using certificates (if
device can support) or
Ruckus Dynamic
PSK™, which is far
more secure than PSK
• Enable granular policy
control rules to
establish network
access privileges for
classes of people and
devices - even for
individuals and specific
devices
• Performs automatic
device posture check
and remediation
• Associates every
device with a user
• Policy-based access
control limits potential
damage

20. Security and policy functionality reduce the threat
Secure over-the-air traffic
with encrypted
WPA2/WPA3-Enterprise
Let users see only what
they should see
with policy-based access
Deny unapproved access
with digital certificate-based
authentication
Ensures devices are safe
with up-front posture
check
Increase IT control
with device visibility
and access revocation
© 2020 CommScope, Inc.

21. Multi-Tenant Best Practices
MDU and Wi-Fi design (separate SSIDs per tenant vs one SSID for all)
29

22. 30
What is an MDU?
• Multi Dwelling Unit
• A place where people
can stay and live for a
longer or shorter
periode.
• Student Housing
• Senior (Assisted) Living
• Luxury Appartments
• Services accomodation
• Condominium

23. MDU – Challenges
• More IOT devices in the MDU space; from light switches that can share your
WPA2/PSK network password from your phone/tablet during setup
• What is a MAC Address and where is it located?!
• Flat layer 2 networks, no prevention for bonjour/cast segmentation
• Streaming of services, not just Netflix, Apple, Disney but now streaming of
Games via services
• Streaming of classes to tablets in dorms
• Streaming between devices that a customer/student owns
• At home experience (for students a temporary MDU space)

24. MDU – Solution - DPSK
- Possible single WLAN to Manage
- No asking for MAC Address
- Tenant use their own PSK on all their own devices
- Remove Captive Portal
- Reduce Onboarding calls
- Fencing via VLAN
- All devices can use it; headless; headful; etc…

25. RUCKUS solutions available
• SmartZone High-Scale
• Multi tenant Wi-Fi controller
• Multiple Zone/Domain
• Onboard DPSK solution
• Limited to 500 DPSK
• Cloudpath
• Onboarding portal/solution for
802.1x and WPA-Enterprise
• MDU Portal using E-DPSK
• Virtually unlimited DPSK
33

26. Separate SSIDs per tenant vs one SSID for all
• What is needed in a MDU deployment
• Every tenant want’s to have their own Wi-Fi network
• Networks needs to be seperated per tenant
• What about guest access?
• Wi-Fi coverage and access in shared space like gym, garden, lobby etc
• No hassle adding headless devices
34

27. Separated SSID/AP per tenant
35
• 15 Room building
• One AP per room/area
• 2 Shared areas
• 3 Office spaces
• +Guest SSID per room/tenant
• Result: 35 SSIDs being broadcasted
over 20 APs
Room101
Room102
Room103
Room104
Room105
Room201
Room202
Room203
Room204
Room205
Room301
Room302
Room303
Room304
Room305 Playground
Library
Office1
Office2
Office3

28. Details
• Every room has one AP with it’s own SSID/PSK and VLAN to separate network
traffic
• For guests every room has a second SSID on the AP in a different VLAN for guest
access
• Public Wi-Fi in the shared areas for everybody
• Pros:
• Visible to the attendee, every room has a device in their room
• Cons:
• Only Wi-Fi coverage in your own room
• No roaming
• Need to connect to public Wi-Fi in shared areas
36

29. Shared SSID per tenant
37
• 15 Room building
• Two APs per floor
• 2 Shared areas
• One AP per area
• 3 Office spaces
• One AP per office/floor
• +Guest SSID over whole bulding
• Result: 3 SSIDs being broadcasted
over 11 APs
Room
Room
Room
Office
Office
Office
Room
Room
Room
Room
Room

30. Details
• AP are placed in the building for coverage, no need to have them in every room >
less APs
• Every tenant has their own PSK and VLAN preset centrally by building owner
• Only 3 SSIDS:
• One SSID for the tenants including shared areas
• One separate SSID for the offices
• One SSID for guests
• Pros:
• Every tenant has access to their own network everywhere in the building and shared areas
• Central management by the building owner
• Cons:
• No management options for the tenants
• Guests/PSK are managed by the building owner
38

31. Shared SSID per tenant including Guests
39
• 15 Room building
• Two APs per floor
• 2 Shared areas
• One AP per area
• 3 Office spaces
• One AP per office/floor
• +Guests on same SSID
• Result: 2 SSIDs being broadcasted
over 11 APs
Room
Room
Room
Office
Office
Office
Room
Room
Room
Room
Room

32. Details
• AP are placed in the building for coverage, no need to have them in every room >
Less Aps
• Every tenant has their own VLAN
• PSK and guest is managed by the tenant using CloudPath
• Only 2 SSIDS:
• One SSID for the tenants including shared areas
• One separate SSID for the offices
• Pros:
• Every tenant has access to their own network everywhere in the building and shared areas
• Guest access is managed by the tenant for their own guests
• Central management by the building owner
• Cons:
• None
40

33. MDU Room MDU Device Examples:
1. Phones
2. Tablets
3. Lighting
4. Gaming Machines
5. Desktops
6. Speakers
7. Printers
8. Thermostat
9. Hydroponics
10. Wine Chillers
11. Smartplugs
12. Cameras
How do we connect these
devices, give them a secure
network and ensure
communication between these
devices?
How do we solve headless
devices?

34. Why is External DPSK needed for customers
3/29/2021
WLAN
WPA2-PSK Network
PSK – room3232-xya – VLAN 3
PSK – room3232-xya – VLAN 3
PSK – Q3@3R123X
VLAN 300
PSK – Q3@3R123X
VLAN 300
PSK – abEcE33421
Cloudpath
EDPSK Server
PSK – Ruckus123! – VLAN 9
Provide unique keys,
dynamic polices, dynamic
VLANS, Firewall rules, for
each key connecting to a
common WPA2-PSK WLAN
Employee
VoIP Handsets
PSK-VoIP1234
MDU Room 2
PSK – &3ac#df12
MDU Room 1
MDU Room 3
MDU Room 4
PSK – #ab93ac@31 – VLAN 42

35. External DPSK Flow
3/29/2021
Controller
authentication
association
4 Way - Frame 1
Radius Access
Request
Access Accept
Access Accept
4 Way - Frame 2
4 Way - Frame 3
4 Way - Frame 4
Radius Access
Request
Cloudpath

36. Access Tenant Portal
Via QR Code/URL

37. Demo
- Schools: RUCKUS Cloud using DPSK
- MDU: RUCKUS SmartZone with E-DPSK and Cloudpath tenant portal
45

38. Setup WLAN – step 1/4
• Specify Network Name
• Network Type
• Dynamic Pre-Shared Key
46

39. Setup WLAN – step 2/4
• Set Passphrase options
• Format:
• Most Secure
• Keyboard Friendly
• Number Only
• Length
• Expiration
• Unlimited, 1 day to 6 months
47

40. Setup WLAN – step 3/4
• Select the Venue(s)
• Select AP group
• Radios
• Scheduling
48

41. Setup WLAN – step 4/4
• Check the summary
• Set “Advanced Network Settings”
• VLAN
• Max rate
• Client Isolation
49
Advanced Network
Settings
Summary

42. Add DPSK under “Users”
50

43. Generate Passphrase
• Select the correct WLAN
• If there are more than one
• Set number of devices
• Set username and VLAN
51
passphrase type and length
are shown here.

44. Show all DPSKs
• Passphrases are visible under “Users”
52

45. Demo
- Schools: RUCKUS Cloud using DPSK
- MDU: RUCKUS SmartZone with E-DPSK and Cloudpath tenant portal
53

46. Terminology
• Property
• Building
• Location
• Unit
• Room
• Area
• Tenant
• Person
• Owner

47. Demo
• Prepare
• Setup Radius policies (without default radius policy there is no VLAN-override)
• Setup DPSK Pool
• Setup Portal
• Setup Units
• Modify portal look and feel
• Setup API key to enable portal
• User Experience
55

48. Demo
1. Setup Radius policies (without default radius policy there is no VLAN-override)
2. Setup DPSK Pool
3. Setup Portal
4. Setup Units
5. Modify portal look and feel
6. Setup API key to enable portal
56

49. 57
RADIUS Attributes
Configuration
/Policies
/RADIUS Attribute group
• Attributes to be used in
the default policy.
• Set a default policy.
Without a default policy
(VLAN) override options
are not possible.
Set optional
attributes
Additional Attributes,
including vendor specific
Reference name

50. 58
RADIUS Policy
Configuration
/Policies
/Policies
• Set the default policy.
Without a default policy
(VLAN) override options
are not possible.
Set conditions.
For the default policy use a
“catch all” condition like “all
usernames”
Select the previous created
RADIUS Attribute group.
Reference name

51. DPSK Pool
Configuration
/DPSK Pools
/Add DPSK Pool
• Create one (or more)
DPSK pools in Cloudpath
Passphrase
length and type
SSID matching
this DPSK pool
Additional
options and
limitations
Give the pool a
name
RADIUS Policy

52. Setup MDU portal
Configuration
/Managed Access
/Property Management
• Setup PROPERTY
DPSK Pool
Enable guest DPSK
(note: licenses!)
Property details
Owner details

53. Setup property with Units and Tenants
61

54. Setup 1st Unit
Configuration
/Managed Access
/Units
• Setup 1st UNIT
Other options
DPSK, if not set, one
will be generated
Unit details
Unit owner

55. Confirmation email
• After the unit is created there is a confirmation including the (generated)
DPSK sent to the unit owner by email and/or SMS
63

56. Setup 2nd Unit
Configuration
/Managed Access
/Units
• Setup 2nd UNIT
Other options
DPSK, if not set, one
will be generated
Unit details
Unit owner

57. Setup property Look & Feel
65

58. Look and Feel
Configuration
/Managed Access
/Property Management
/Look & Feel
• Modify as needed.
• Announcements
• Help Text
Text shown in
portal to alle
tenants
Customize
colors and logo

59. Setup API Key for portal access
• To enable acces to the portal there is an API key needed. This needs to be
generated and attached.
Configuration
/API Keys
/Create
67
Name
Enable Key and set
Expiration Date

60. Check is Key is available and Portal is enabled
Configuration
/Property Management
/Property
68
Prtal support
enabled ?

61. DEMO
User Experience
69

62. Accessing the portal
• There are two options to give a
tenant access to their portal
• Share the URL
http://cphost/tenant?&auth=tenant-
id&property=property-id&api=api-key
• Share or print the QR code
70

63. Accessing the portal
71

64. Checking and changing DPSK
72

65. Accessing the network as tenant
• Elmo, tenant of room 10, should be in VLAN10 (ip range 192.168.10.x)
73

66. Accessing the network as guest
• All guests should be in VLAN30 (ip range 192.168.30.x)
74

67. DEMO
Maintaining DPSKs
75

68. Maintaining DPSKs by the Tenant
• Tenant can maintain the devices registered to the network.
• Especially usefull when limitations are set per Unit/Tenant
76
List of all devices and guest devices
Delete device
Modify device Name or
Description

69. Maintaining DPSKs by the administrator
• Admin can see and maintain the DPSKs in the CloudPath GUI
Dashboard
/DPSKs
/Active DPSKs
77
See details of DPSK
and option to
“Revoke” the device

70. Q&A
78

71. Links and references
• What is MDU: https://tinyurl.com/wikimdu
• MDU Best Practise Guide: https://www.tinyurl.com/bpgmdu
79