RUCKUS® Cloudpath® Enrollment System
Let BYOD and guest users connect to the network quickly, easily and securely with RUCKUS Cloudpath Enrollment System

Overview:

RUCKUS® Cloudpath® Enrollment System is a cloud service (or on-premises software) that delivers secure network access for any user, and any device, on any network.

Cloudpath secures every connection with WPA2/WPA3-Enterprise, protecting data in transit between the device and the access point with powerful encryption. You gain visibility and control over which devices are on the network, and can define and manage policies so every user sees only the network resources they should see. The Cloudpath service checks the security posture of devices during onboarding to ensure they comply with your organization’s security policies. The system redirects users with noncompliant devices to remediate them before granting access. It associates every device with a user, and you can easily revoke access at any time—for example, when a BYOD user leaves the organization. The service supports any Wi-Fi enabled device, including headless and IoT devices.

Intuitive self-service workflows streamline network onboarding—users gain network access simply and securely without IT intervention. The service lets you deliver a great onboarding experience while dramatically reducing helpdesk tickets related to network access. Internal users can easily self-provision any device for network access using their existing login credentials. Cloudpath installs a digital certificate for network authentication so that, after the initial connection, users don’t need to re-enter credentials when they connect again. Guest users access a self-service login portal and receive credentials in the form of a CommScope-patented Dynamic PSK™ via email or SMS. Dynamic PSKs remove the need to install a certificate on the device, and offer similar security benefits. They are intuitive for users and much more secure than conventional PSKs because every user/device gets a unique key.

The Cloudpath service interoperates via its APIs with thirdparty products to further enhance security and improve user experience. It works flawlessly with any vendor’s wired and wireless infrastructure. Unlike leading competitors, the Cloudpath service offers a unique combination of cloud-based or virtualized on-premises deployment, built-in multi-tenancy, cost-effective per-user licensing, and superior ease of use.

Secure multi-vendor network access

The Cloudpath service delivers secure network access for every user, and every device, on any vendor’s network.

• Secure connections with WPA2/WPA3-Enterprise via 802.1X authentication
• Powerful encryption for data in transit over the air
• Support for BYOD, guest and IT-owned devices—including headless and IoT devices
• Up-front-posture check with remediation
• Visibility and control over devices on the network—with the power to revoke access

Digital certificates and Dynamic Pre-Shared Keys

The Cloudpath service includes a built-in, comprehensive certificate authority (CA) that lets you create and manage your own public key infrastructure (PKI). Dynamic PSKs are a great alternative for guest users and devices that don’t support certificates. They provide similar security benefits to digital certificates without the need to install a certificate on the device.

• Built-in RADIUS server and user database
• Integration with external certificate authorities and user database infrastructures
• Certificate-based authentication, authorization and accounting (AAA)
• CommScope patented Dynamic PSKs improve security because, unlike conventional PSKs, each user gets a unique key—revoke a user’s access at any time without affecting other users

Self-service onboarding and device enablement

Easy self-service onboarding ensures that users gain network access quickly and securely—without helpdesk involvement.

• Customizable workflows—entirely self-service or with internal sponsors—to tailor the user experience
• Optional pre-boarding lets users set up their devices for secure access before arriving at a given location
• Device provisioning capability can prompt users to install specific software during onboarding
• Customizable onboarding portal for guest access—including optional social login with Google, Facebook, LinkedIn and other popular identity providers
• Guest credentials via email, SMS or printed voucher
• Management portal and resident portal for multi-dwelling units help residents and their guests connect quickly, easily and securely
• Automated IT-managed onboarding via integration with thirdparty endpoint management products

Policy management

The Cloudpath service lets you define and manage policies that govern network access for all users. It works with your network infrastructure to enforce policies for role-based access.

• Granular per-user, per-device policies, including bandwidth management and application-based access0
• Role-based access—users get only the appropriate level of access
• Private per-user networks via VLANs, VXLANs or access policies—users see only their devices and traffic

Third-party product integration via API

The Cloudpath service integrates via its APIs with third-party products to enhance security and user experience. It works with any product that can consume its APIs.

• Web content filters—lets these products filter encrypted content and apply role-based filtering rules (technology partnerships: iBoss® and Lightspeed Systems®)
• Next-generation firewalls—enables per-user and per-device policies (technology partnership: Palo Alto Networks®)
• Mobile device management—works with MDM products to support both managed and unmanaged devices with appropriate policies (technology partnership: AirWatch®)
• eduroam®—facilitates inter-campus roaming
• Google Chromebooks™—IT can onboard devices directly through the Google console, eliminating the need for users to onboard their own devices

Features and Benefits:

Cloudpath® Enrollment System is a cloud service (also available as on-premises software) that delivers secure wired and wireless network access for BYOD, guest users and IT-owned devices. It streamlines getting devices on the network and secures every connection with powerful encryption. The Cloudpath service gives you granular policy control over what network resources users can access. It lets you deliver a great end-user experience and virtually eliminates helpdesk tickets related to network access. Choose from cloud-based or virtualized on-premises deployment. Cloudpath supports any user, any device, and any network.

Increase Security for Users, Devices, Data and the Network:
The Cloudpath service secures network connections with WPA2/WPA-3 Enterprise. The system encrypts data in transit between the device and Wi-Fi access points for maximum security. It lets you define and manage polices for network access so that users see only what they should see. You gain visibility and control over what devices are on the network, and the power to revoke access at any time. A device posture check with remediation during onboarding ensures that only devices with appropriate security safeguards in place gain access.

Streamline Network Access for BYOD Users:
The sheer volume and diversity of devices that require network access can cause headaches for IT departments. What if BYOD users could self-provision their devices with intuitive self-service workflows? With the simple onboarding portal in the Cloudpath service, they can. Users get a great experience without IT intervention. BYOD users initially gain access with existing login credentials. The system installs a digital certificate on the device so that users authenticate seamlessly from that point forward—without having to re-enter a Wi-Fi password.

Give Visitors Easy, Self-service Guest Wi-Fi:
No matter what the environment—schools, colleges, hotels, public venues, or anywhere, really—the first thing visitors ask is “How do I get on the Wi-Fi?” The Cloudpath service delivers secure guest access for visitors without involving the IT helpdesk. Guest users simply self-register for internet access via an intuitive portal and receive login information via SMS, email, or printed voucher. You can customize the login portal, guest workflows, terms and conditions, and more for a trouble-free and secure user experience.

• Secure every connection for BYOD, guest, and IT-owned devices (including IoT) with enterprise-grade encryption
• Perform up-front security posture check with remediation during network onboarding
• Gain visibility into what devices are on the network, with the power to revoke access at any time
• Associate every device with a user for greater control over your IT environment
• Streamline network onboarding with intuitive self-service workflows
• Tailor the user experience with customizable onboarding workflows and self-service portal
• Manage your own Public Key Infrastructure (PKI) with built-in certificate authority—or use external certificate authorities
• Use the built-in RADIUS server and user database—or third-party platforms
• Create and manage granular policies for network access based on each user’s role—they only see the network resources that they should see
• Segment the network using VLANs or VXLANs to increase network security and improve user experience

Specifications:

Deployment options	Cloud-based deployment	On-premises virtualized deployment (VMware or Hyper-V)
Redundancy and Multitenancy	VM-based Cloudpath Enrollment System can be deployed as a standalone server or as a cluster in both active-active mode or as a star-hub for data replication and redundancy	Multi-tenant mode enables MSPs to host multiple tenants within a single instance
Certificate Infrastructure (PKI)	Built-in Certificate Management System Unique CA for every tenant within the multi-tenant mode. Ability to connect to external PKI Standalone or subordinate to integrate with existing PKI	Certificate templates that integrate with policy Supports OCSP with automatic revocation Automatic deployment of certificates and secure networks using Group Policy Objects, MSI and SCEP calls
RADIUS	Supports Dynamic VLANs, ACLs, and more Streamlined support for EAP-TLS and MAC filtering Client-based support for PEAP	Built-in RADIUS server Ability to connect to an external RADIUS infrastructure RADIUS accounting
Onboarding	Self-service onboarding with customizable workflows Support for wired/wireless infrastructure from any standards-based vendor	Unified wired or wireless access
Visibility and Reporting	Per-device and per-user visibility and control Association between user, device, certificate and policy	RADIUS accounting
Authentication and Protocol	802.1X (EAP methods: EAP-TLS, PEAP/MSCHAPv2, EAPSIM, EAP-AKA, EAP-AKA’) Dynamic PSK Web authentication Non-802.1X (MAC authentication)	Support for Passpoint 2.0 R1 and HS2.0 R2 via OSU (online signup server) RADIUS CoA DPSK configuration for RUCKUS WLAN
User Identity Support	Microsoft® Active Directory® RADIUS via PAP Any LDAP-compliant directory LDAP/S Novell®	Google Azure OAuth2.0 SAML Internal user database
Device Support	Android™ 6.0 and higher iOS® 9 and higher Chromebook™ Windows® 7 and higher Mac OS X 10.7 and higher	Linux Ubuntu® 16.04 and higher Fedora® 18 and higher Windows Phone® 8.1 BlackBerry®
SMS and Email	Native integration with Twilio® and CDYNE® Ability to configure any custom SMS gateway	Built-in SMTP server or configure SMTP server
Third-party integrations via API	Next-generation firewalls Web content filters Mobile device management	eduroam Google Chromebooks Any platform that can consume APIs

Video:

RUCKUS® Cloudpath® Enrollment System

How to Buy:

Subscription

(Support included)

Cloud
Step 1	Choose number of users
<1K	1K–5K	5K–10K	10K+

Step 2	Choose subscription duration
<1K	1 year	3 years	5 years

On-premises
Step 1	Choose number of users
<1K	1K–5K	5K–10K	10K+

Step 2	Choose subscription duration
<1K	1 year	3 years	5 years

Step 3	Choose server license quantity
1 license per 20K users

• Licensed by user, not device
• User count determines volume discount
• Separate list price for education customers

Perpetual License

Step 1	Choose number of users
<1K	1K–5K	5K–10K	10K+

Step 2	Choose server license quantity
1 license per 20K users

Step 3	Choose support duration
<1K	1 year	3 years	5 years

• Licensed by user, not device
• User count determines volume discount
• Separate list price for education customers

Ordering Guidance

1. Select from cloud or on-premises deployment model.
2. If you select on-premises, choose from subscription or perpetual licensing model.
3. Cloud deployment requires subscription model.
4. Determine the number of users in your environment, including guests.
5. Choose the appropriate SKU based upon subscription duration and user count.
6. Add optional white glove service for remotely assisted deployment.

Documentation:

Download the RUCKUS® Cloudpath® Enrollment System Datasheet (PDF).

Download the RUCKUS® Cloudpath® Flyer (PDF).