RUCKUS® Cloudpath® Enrollment System
Let BYOD and guest users connect to the network quickly, easily and securely with RUCKUS Cloudpath Enrollment System

Overview:

RUCKUS® Cloudpath® Enrollment System is a cloud service (or on-premises software) that delivers secure network access for any user, and any device, on any network.

Cloudpath secures every connection with WPA2/WPA3-Enterprise, protecting data in transit between the device and the access point with powerful encryption. You gain visibility and control over which devices are on the network, and can define and manage policies so every user sees only the network resources they should see. The Cloudpath service checks the security posture of devices during onboarding to ensure they comply with your organization’s security policies. The system redirects users with noncompliant devices to remediate them before granting access. It associates every device with a user, and you can easily revoke access at any time—for example, when a BYOD user leaves the organization. The service supports any Wi-Fi enabled device, including headless and IoT devices.

Intuitive self-service workflows streamline network onboarding—users gain network access simply and securely without IT intervention. The service lets you deliver a great onboarding experience while dramatically reducing helpdesk tickets related to network access. Internal users can easily self-provision any device for network access using their existing login credentials. Cloudpath installs a digital certificate for network authentication so that, after the initial connection, users don’t need to re-enter credentials when they connect again. Guest users access a self-service login portal and receive credentials in the form of a CommScope-patented Dynamic PSK™ via email or SMS. Dynamic PSKs remove the need to install a certificate on the device, and offer similar security benefits. They are intuitive for users and much more secure than conventional PSKs because every user/device gets a unique key.

The Cloudpath service interoperates via its APIs with thirdparty products to further enhance security and improve user experience. It works flawlessly with any vendor’s wired and wireless infrastructure. Unlike leading competitors, the Cloudpath service offers a unique combination of cloud-based or virtualized on-premises deployment, built-in multi-tenancy, cost-effective per-user licensing, and superior ease of use.

Secure multi-vendor network access

The Cloudpath service delivers secure network access for every user, and every device, on any vendor’s network.

• Secure connections with WPA2/WPA3-Enterprise via 802.1X authentication
• Powerful encryption for data in transit over the air
• Support for BYOD, guest and IT-owned devices—including headless and IoT devices
• Up-front-posture check with remediation
• Visibility and control over devices on the network—with the power to revoke access

Digital certificates and Dynamic Pre-Shared Keys

The Cloudpath service includes a built-in, comprehensive certificate authority (CA) that lets you create and manage your own public key infrastructure (PKI). Dynamic PSKs are a great alternative for guest users and devices that don’t support certificates. They provide similar security benefits to digital certificates without the need to install a certificate on the device.

• Built-in RADIUS server and user database
• Integration with external certificate authorities and user database infrastructures
• Certificate-based authentication, authorization and accounting (AAA)
• CommScope patented Dynamic PSKs improve security because, unlike conventional PSKs, each user gets a unique key—revoke a user’s access at any time without affecting other users

Self-service onboarding and device enablement

Easy self-service onboarding ensures that users gain network access quickly and securely—without helpdesk involvement.

• Customizable workflows—entirely self-service or with internal sponsors—to tailor the user experience
• Optional pre-boarding lets users set up their devices for secure access before arriving at a given location
• Device provisioning capability can prompt users to install specific software during onboarding
• Customizable onboarding portal for guest access—including optional social login with Google, Facebook, LinkedIn and other popular identity providers
• Guest credentials via email, SMS or printed voucher
• Management portal and resident portal for multi-dwelling units help residents and their guests connect quickly, easily and securely
• Automated IT-managed onboarding via integration with thirdparty endpoint management products

Policy management

The Cloudpath service lets you define and manage policies that govern network access for all users. It works with your network infrastructure to enforce policies for role-based access.

• Granular per-user, per-device policies, including bandwidth management and application-based access0
• Role-based access—users get only the appropriate level of access
• Private per-user networks via VLANs, VXLANs or access policies—users see only their devices and traffic

Third-party product integration via API

The Cloudpath service integrates via its APIs with third-party products to enhance security and user experience. It works with any product that can consume its APIs.

• Web content filters—lets these products filter encrypted content and apply role-based filtering rules (technology partnerships: iBoss® and Lightspeed Systems®)
• Next-generation firewalls—enables per-user and per-device policies (technology partnership: Palo Alto Networks®)
• Mobile device management—works with MDM products to support both managed and unmanaged devices with appropriate policies (technology partnership: AirWatch®)
• eduroam®—facilitates inter-campus roaming
• Google Chromebooks™—IT can onboard devices directly through the Google console, eliminating the need for users to onboard their own devices