Governments worldwide are intensifying their efforts to drive secure interactions between their agencies, departments, organizations, and their supporting companies.

The European Union has put forth the NIS2 Directive as a central regulation for safeguarding “essential” and “important” sectors across all of its member states. Expanding on the initial NIS Directive, NIS2 broadens its reach and raises security expectations for critical sectors, including healthcare, finance, energy, and more. It mandates enhanced cybersecurity measures, from risk management and incident response to supply chain security, network security, and business continuity planning.

In this blog, we focus on how NIS2 drives the need for secure networks and how RUCKUS^® solutions and products can help companies align with NIS2 mandates.

NIS2 Directive’s Network Security Implications

NIS2 comprises ten main categories, which were highlighted in part 1 of this blog series, NIS2 Directive Explained: Strengthening Network Security. Focusing on the network security aspect, NIS2 requirements can be broken down into a number of key requirements:

• Closely manage networks, configurations, roles, and privileges.
• Implement and enforce secure controls and security measures for network access and allowing users to connect.
• Utilize least privilege roles while managing the network.
• Follow, maintain, and update documented and proven processes for making network configuration changes and taking maintenance actions.
• Keep firmware and software up-to-date so the latest security vulnerabilities are addressed.
• Maintain and update network asset inventory.
• Configure wired and wireless networks to use the latest encryption for added security.
• Configure and monitor networks with automated notification of potential security incidents.
• Business continuity – ensure the network still functions even during security incidents.

NIS2 and RUCKUS Approach to Zero Trust Architecture as the Connectivity Solution

The network protections mandated by NIS2 may align with many of the principles of a zero-trust architecture (ZTA). Zero trust, in essence, means that a connection must never be trusted and always be verified. The RUCKUS approach to ZTA resides with the connectivity and access to the network; it involves bringing together devices and software to address the necessary components for a Zero Trust model, focusing upon access to the network and network elements. A comprehensive Zero Trust environment implements end-to-end protection by incorporating additional layers, including endpoint security, application-layer controls, and continuous identity verification.

Unlike traditional security models, zero trust assumes no implicit trust within the network and continually verifies connections to mitigate cybersecurity risks from unauthorized access or insider threats. Through robust user and device authentication, network segmentation, and continuous monitoring, RUCKUS provides the capabilities for network activity to be protected, providing organizations with a secure and scalable connectivity solution that aligns with their NIS2 compliance requirements.

Following a Zero Trust approach checks the boxes on the key NIS2 requirements listed previously, because you have to manage your networks, utilize least privilege accounts, provide secure access mechanisms to information systems, update your systems and software for security vulnerabilities, utilize encryption, and all the rest to protect your network.

RUCKUS One^® Solution

The RUCKUS One comprehensive cloud-based platform is designed to streamline network management and control for both wired and wireless networks, in line with NIS2 compliance. By centralizing network operations, the RUCKUS One solution provides IT administrators with a unified interface to manage all RUCKUS network components for seamless integration and coordination. Leveraging advanced AI and analytics to optimize network performance, the platform can detect anomalies and provide actionable insights. This not only enhances the efficiency of network management but also addresses requirements for robust and resilient networks to protect against potential cyber threats.

A key strength of the RUCKUS One solution is its comprehensive identity management capabilities. The platform allows organizations to map identity provider identities and groups (for example from a SAML IDP such as MS Entra) directly to RUCKUS One identity groups and identities. This integration requires that all devices on the network are associated with a verified identity, enabling adaptive policies that can reference these identity groups for granular network access control. This identity-centric approach is fundamental to implementing a zero trust security model to in line with NIS2.

The RUCKUS One solution also features built-in PKI (Public Key Infrastructure) capabilities, allowing it to issue device certificates through integration with Mobile Device Management (MDM) solutions such as Microsoft Intune or via self-service web portal workflows. This certificate-based authentication significantly enhances security by providing a stronger authentication method than traditional passwords.

For incident detection and response, the RUCKUS One solution integrates powerful AI capabilities that continuously monitor network behavior to identify potential security events, supporting overall security management strategies. When anomalies are detected, the system can automatically trigger alerts and send detailed information via webhooks to Security Information and Event Management (SIEM) systems or IT service management platforms. This integration capability is crucial for organizations that need to meet  24-hour incident reporting requirements, as it enables rapid escalation and documentation of security events, in line with NIS2.

The RUCKUS One solution offers a suite of features designed to protect network integrity and provide secure access in line with NIS2 requirements. These include:

• Secure Access: Implements role-based access control so only authorized users can access sensitive network resources.
• Multi-Factor Authentication (MFA): Configured for RUCKUS One network administrators, adds an extra layer of security by requiring network administrator users to verify their identity through multiple methods before gaining access.
• Automatic Updates: Updates network devices to the latest firmware for the latest security patches and software versions, reducing vulnerabilities and supporting cybersecurity risk management.
• Deep Analytics for Network Monitoring and Alerting: Offers real-time insights into network performance and security, allowing administrators to proactively address issues and receive alerts for any suspicious activities.
• Consistent Security Policy Enforcement: Deploy and manage security configurations uniformly across all network devices, removing security gaps from inconsistent implementation.
• Network Segmentation: Easily implement VLAN/VXLAN policies to isolate critical systems and contain potential breaches, preventing lateral movement by attackers.

The RUCKUS One solution integrates RUCKUS AI^™ capabilities, providing proactive risk management through machine learning that transforms network data into actionable security insights. These AI features are seamlessly available through the RUCKUS One interface, offering anomaly detection, preemptive issue resolution, and root cause analysis without requiring a separate management system.

While the RUCKUS One solution addresses critical network-focused controls, organizations should also implement policies, staff training, and incident response procedures to fulfill the broader NIS2 requirements and protect sensitive information.

RUCKUS Secure Access and Authentication with Cloudpath^™ Enrollment System

One distinct solution RUCKUS provides for managing secure access and assigning the right roles and controls to a user or device is the Cloudpath Enrollment System. As previously mentioned, device onboarding and secure access are core components where endpoint security is paramount.

RUCKUS Cloudpath Enrollment System offers an advanced solution for secure network onboarding by simplifying and securing the authentication process. The Cloudpath system verifies the identity of devices and users connecting to the network, providing that only authorized endpoints have access. With the Cloudpath enrollment system, organizations can implement role-based access control, automate certificate management, and simplify credential handling

A standout feature shared by both the Cloudpath and RUCKUS One solutions is Dynamic PSK^™ (Pre-Shared Keys) technology. Dynamic PSK technology provides an optimal balance of security and ease of use by allowing multiple keys/passwords to be used for the same network while enabling dynamic policy application. Unlike traditional pre-shared keys, Dynamic PSK technology restricts each password/key to a single device or a set of devices belonging to a specific user, significantly enhancing security without adding complexity for end users.

It’s important to note that many of the Cloudpath system’s core functionalities are integrated directly into the RUCKUS One solution, including certificate management, secure onboarding workflows, and Dynamic PSK capabilities. This integration enables organizations to access these powerful security features through a single, unified management interface if they choose to deploy the RUCKUS One solution.

RUCKUS Focus on Business Continuity Through Resilient Access Points

A key focus of NIS2 is ensuring business continuity and cyber resilience, particularly during cyber incidents or operational disruptions. RUCKUS Access Points (APs) are designed with this priority in mind, allowing continuous connectivity even if access to the central controller is temporarily interrupted. With this resilient architecture, RUCKUS APs can manage traffic and maintain network stability independently, ensuring that critical services remain operational in the event of a network outage or controller downtime.

RUCKUS Focus on Supply Chain Security

RUCKUS prioritizes supply chain security to be in line with NIS2 by implementing rigorous controls across its software and physical supply chains. RUCKUS enforces strict supplier assessments, contractual security requirements, continuous monitoring, and robust incident response planning. Advanced technologies like AI and IoT enhance visibility and threat detection, while secure device architecture, including Trusted Platform Modules (TPM), safeguards firmware and software integrity. These proactive measures mitigate supply chain risks, reinforcing the security of RUCKUS products. Reference the RUCKUS Supply Chain Security document for more information.

RUCKUS Built-In Security Standards and Certifications

RUCKUS’s commitment to security is demonstrated by its adherence to rigorous industry standards and certifications — a strong assurance for organizations aiming for NIS2 compliance. RUCKUS designs its products and cloud services with globally recognized cybersecurity frameworks in mind. For example, RUCKUS is an active participant in the StateRAMP (now GovRAMP) program in the United States, which aligns cloud offerings with the NIST 800-53 security controls (a widely respected standard for cybersecurity).

The RUCKUS One, RUCKUS AI, and Cloudpath solutions are all listed in the StateRAMP authorization program, meaning they are undergoing rigorous third-party assessments for confidentiality, integrity, and availability of data. This alignment with NIST-based frameworks underscores that RUCKUS solutions follow best practices for encryption, identity management, vulnerability patching, and other security processes.

Additionally, many RUCKUS networking products carry certifications that attest to their security at the hardware and software level. For instance, RUCKUS’s wireless access points, switches, and the Cloudpath software have achieved FIPS 140-2/3 validations (NIST Cryptographic Module Validation Program) and Common Criteria (NIAP) certifications (recognized by many EU member states), which are often prerequisites for use in government and mission-critical environments. These certifications confirm that RUCKUS implements robust encryption modules and secure software development practices. Additionally, as the EU Cybersecurity Certification Scheme (EUCC) evolves, RUCKUS remains committed to aligning its products and services with emerging EU-specific certification requirements.

Conclusion

As NIS2 reshapes cybersecurity expectations across Europe, RUCKUS delivers a robust suite of solutions to assist essential and important sectors. From implementing zero-trust architectures to facilitating resilient access points and enhancing the security of its supply chain, RUCKUS stands as a trusted partner for organizations aiming to achieve compliance and protect their networks.

The RUCKUS One solution provides a unified management interface that brings together powerful capabilities for identity management, secure access control, and AI-driven network intelligence. By centralizing these functions in a single platform, organizations can more easily implement and maintain the comprehensive security controls required by NIS2 while reducing operational complexity. The integration of advanced features like identity-based policy enforcement, certificate management, and Dynamic Pre-Shared Key technology enables a true zero-trust approach to network security without sacrificing usability.

The landscape of cybersecurity, understanding of NIS2 directives, and best practices for implementing these requirements are continually evolving, and RUCKUS is committed to evolving with them. RUCKUS equips organizations with the tools and strategies needed to secure their operations and safeguard data.

NWA110BE and NWA210BE WiFi 7 Dual-Radio NebulaFlex Access Points Support 2.4GHz and 5GHz or 6GHz to Extend Existing Networks and Protect Infrastructure Investments

ANAHEIM, California (March 25, 2025) Zyxel Networks, a leader in delivering secure, AI- and cloud-powered business and home networking solutions, today extended its family of affordable WiFi 7 access points with the launch of NWA110BE BE6500 WiFi 7 Dual-Radio Nebula Flex Access Point and NWA210BE BE12300 WiFi 7 Dual-Radio NebulaFlex Access Point. Designed for growing small- and medium-sized businesses, the high-performance access points support existing 5GHz networks while futureproofing for network upgrades to 6GHz.

NWA110BE and NWA210BE WiFi 7 access points feature the flexible BandFlex radio, which can support either 5GHz or 6GHz by configuration, making them the most economical choice for extending 5GHz coverage or adding 6GHz support to existing networks. The advanced RF filter prevents interference between the 5GHz and 6GHz bands guaranteeing optimum performance on all channels.

The dual-radio NWA110BE BE6500 access point supports 2.4GHz (2×2:2) and 5GHz or 6GHz (4×4:2) and delivers fast WiFi 7 speeds up to 6.5Gbps. The NWA210BE BE12300 access point supports 2.4GHz (2×2:2) and 5GHz or 6GHz (4×4:4) at speeds up to 12.3Gbps. Both access points, which can be powered by PoE (802.3at) or USB Type C charger for maximum deployment flexibility, ensure lower latency for real-time responsiveness.

Benefits and Features of NWA110BE and NWA210BE WiFi 7 Access Points

• MLO Provides Unprecedented Connectivity – Multiple Link Operation (MLO) technology enables devices connected to the access points to simultaneously transmit and receive data on multiple radios, significantly increasing data throughput, reducing latency, and enhancing reliability.
• Designed to Eliminate RF Interference – The advanced RF filter design eliminates interference between the 5GHz and 6GHz bands and the built-in 4G/5G interference filter allows seamless coexistence with 4G/5G cellular networks. The rectangular design maintains isolation between antennas to ensure a good signal-to-noise ratio for 4K QAM.
• Unparalleled Management Flexibility – NebulaFlex enables users to easily switch between standalone mode and the intuitive cloud-managed Nebula Control Center (NCC) without additional cost. The access points can also be managed by Nebula Cloud Networking Solution which provides comprehensive monitoring capabilities, including real-time notifications for critical events via email or the mobile app without the need for additional software or hardware controllers.
• Advanced Wireless Features – Dynamic Channel Selection (DCS) minimizes the interference of co-channel and overlapping channels. Load Balancing enables administrators to set limits on the number of clients associated with each AP. Smart Client Steering features with Band Select, Signal Threshold, and Band Balancing combine to deliver stable, reliable wireless connections.

“NWA110BE and NWA210BE enable small- and medium-sized businesses to expand their existing 5GHz networks while future-proofing the investment when they’re ready to add or switch to 6GHz connectivity,” stated Shawn Rogers, Market Development Manager at Zyxel Networks. “These access points provide a compelling combination of enterprise-class features, performance, ease and flexibility of management, and affordability that make them ideal long-term WiFi solutions for networks in homes and businesses.”

Zyxel Networks WiFi 7 Dual-Radio Nebula Flex Access Points carry limited lifetime warranties. NWA110BE is available at a street price of $119.99 through Amazon and Zyxel Store. NWA210BE is available at a street price of $169.99 through Amazon and Zyxel Store. Both access points are also available through Zyxel Authorized Distributors: D&H, IngramMicro, TD Synnex, Target, and Wav, Zyxel Authorized VARs and MSPs, and online at other leading e-tailers.

For more information about Zyxel, its connectivity solutions, and the Zyxel Authorized Partner Program, visit www.zyxel.com/us and follow us on Facebook, X(formerly Twitter) and LinkedIn.

About Zyxel:

Zyxel Networks is a technology provider with over 30 years of experience, specializing in delivering solutions for small to medium-sized businesses and the enterprise-edge in partnership with VARs, MSPs and System Integrators. We enable network professionals to connect and protect organizations with greater ease by bringing together intuitive, scalable and secure cloud management with a complete portfolio of network devices.

DNSFilter Earns 5-Star Rating in the 2025 CRN^® Partner Program Guide

WASHINGTON, D.C. – March 24, 2025 – DNSFilter, content filtering and protective DNS software, has been honored by CRN^®, a brand of The Channel Company, with a 5-Star Award in the 2025 CRN Partner Program Guide. This annual guide is an essential resource for solution providers seeking vendor partner programs that match their business goals and deliver high partner value.

The extensive support and resources technology vendors offer through their partner programs are a critical consideration for solution providers assessing which IT vendors, service providers, and distributors to team with in building world-class technology solutions. Program elements such as financial incentives, sales and marketing assistance, training and certification, technical support and more can set vendors apart and play a key role in boosting their partners’ long-term growth and profitability.

The 5-Star Award is an elite recognition given to companies that have built their partner programs on the key elements needed to nurture lasting, profitable, and successful channel partnerships.

For the 2025 Partner Program Guide, the CRN research team evaluated vendors based on program requirements and offerings such as partner training and education, pre- and post-sales support, marketing programs and resources, technical support, and communication.

DNSFilter stands out as a premier cybersecurity solution for partners due to its ease of deployment, robust security coverage, and seamless integrations. DNSFilter delivers AI-driven threat protection and content filtering at the DNS layer, stopping attacks before they reach the network. Its flexible pricing, API integrations, and support for MSPs and MSSPs make it an ideal choice for service providers looking to enhance their security offerings. With over 3,000 MSP customers and blocking 200 million threats daily, DNSFilter provides global security. Designed for non-traditional network setups and remote workforces, it ensures organizations of all sizes and setups can implement fast, reliable, and effective security via the DNS layer.

“Our partners are at the heart of everything we do, and this award is a direct reflection of the trust and collaboration we’ve built together,” said Shawn Brady, Senior Vice President of Sales,“At DNSFilter, we are dedicated to delivering best-in-class support, tools, and opportunities that enable our partners to grow and excel. We are grateful for this recognition and remain committed to raising the bar for excellence in our partner program.”

“Being featured on the 2025 CRN Partner Program Guide highlights the dedication these technology vendors have to evolving with solution providers, driving innovation, and supporting mutual success,” said Jennifer Follett, VP, U.S. Content and Executive Editor, CRN, at The Channel Company. “This critical annual project empowers solution providers to identify vendors that are committed to enhancing their partner programs and meeting the always-changing business needs of the channel and end customers. The guide provides deep insight into the distinctive value of each partner program so solution providers can make strategic partnership decisions with confidence.”

The 2025 Partner Program Guide will be featured in the April 2025 issue of CRN and published online at www.CRN.com/PPG beginning March 24, 2025.

About DNSFilter

DNSFilter is redefining how organizations secure their largest threat vector: the Internet itself. DNSFilter is making the Internet safer and workplaces more productive by blocking threats at the DNS layer. DNSFilter resolves upwards of 170 billion daily queries. With 79% of attacks using Domain Name System (DNS), DNSFilter provides the world’s fastest protective DNS powered by AI, blocking threats an average of 10 days faster than traditional threat feeds. Over 35 million users trust DNSFilter to protect them from phishing, malware, and advanced cyber threats.

About The Channel Company:

The Channel Company (TCC) is the global leader in channel growth for the world’s top technology brands. We accelerate success across strategic channels for tech vendors, solution providers, and end users with premier media brands, integrated marketing and event services, strategic consulting, and exclusive market and audience insights. TCC is a portfolio company of investment funds managed by EagleTree Capital, a New York City-based private equity firm. For more information, visit thechannelco.com.

Customers can take advantage of new capabilities of Wi-SUN FAN 1.1

With over 100 products certified by the Wi-SUN Alliance, Field Area Network 1.0 is a popular networking option for smart utility and smart city use cases. Electric utility metering, distribution automation, and municipal street lighting applications benefit greatly from FAN’s secure, self-forming, self-healing IPv6 wireless mesh networking which is able to support million scale deployments spanning large geographic areas.

Building on the strong foundation laid down by FAN 1.0, the Wi-SUN Alliance recently announced the availability of the first devices certified to support the new feature additions of FAN 1.1. These new FAN 1.1 capabilities include:

• Low energy device operation (LE). Low power nodes are able to function for up to 20 years on a single battery charge, targeting use cases such as methane detection, water metering, gas metering, and other low power field sensing applications.
• Higher performance (HP). FAN 1.1 adds Orthogonal Frequency Division Multiplexing radio support, meaning FAN 1.1 now offers data rates from 50 Kbps (FSK) up to 2.4 Mbps (OFDM). The higher data rates are ideal for utility AMI 2.0 and Distribution Automation use cases such as Fault Location Isolation and Restoration (FLISR).
• Modulations and data rate negotiation (MDR). Mesh neighbors can now negotiate a “gear shift” to transition, for example, a section of a lower speed AMI mesh to a higher throughput mode for DA fault isolation operations.
• Expanded geographic support. North America, Brazil, Japan, and European Union operation is supported. Extension to additional 800 and 900 MHz regions is now practical.

Figure 1 depicts an example multi-hop FAN 1.1 mesh. The mesh forms automatically between a set of deployed Routers and a Border Router providing WAN connectivity. A Router’s frequency hopping capabilities and ability to determine alternate data paths provide superior resiliency. Routers are further able to “parent” low power nodes.

The sub-GHz mesh RF links can individually stretch to several kilometers (depending upon local conditions), with multi-hop meshes able to span distances of 10s of kilometers. A single FAN 1.1 mesh can support thousands of Router nodes, each able to parent low power nodes. A classic utility deployment scenario is an electric meters (Router) parenting one or more low power water meters, gas meters, or environmental sensors. Adding additional meshes scales a deployment to millions of nodes.

The Catalyst IR8100 Heavy Duty Series Industrial Router will be the first member of the Cisco Resilient Mesh solution to be FAN 1.1 certified. Given its rugged design for harsh outdoor environments, flexible backhaul configuration, and security capabilities, the IR8140 is an ideal FAN 1.1 Border Router. An individual IR8140 can root a mesh of thousands of FAN 1.1 devices, with millions scale device networks achieved with the deployment of additional IR8140s. Following the IR8140, IR530 Range Extender, and Cisco Resilient Mesh Endpoint SDK will also be scheduled for FAN 1.1 certification, rounding out a complete Cisco FAN 1.1 portfolio of Border Routers, Routers, and endpoint design SDK.

Figure 2: Cisco IR8140 Border Router

Large FAN 1.1 networks require a network management system able to provide lifecycle management for million node networks. Cisco IoT Field Network Director is purpose built, and field proven to manage these large-scale networks.

“Wi-SUN 1.1 provides improved flexibility, security, and adaptive performance to unlock newer markets demanding high performance or low energy use cases in the growing Utility or Smart city landscape. Cisco’s Wi-SUN commitment has been focused on ease of use through simplified Zero Touch Provisioning, resiliency in varying RF conditions, interoperability and network management for endpoints and border routers through industry leading OpenCSMP to enable customers to build production networks with its industry leading solution at scale in a secure manner.” says Lakshmi Narayana Jammi, Sr Product Manager for Cisco IR8140 and Cisco Resilient Mesh SDK

“With the introduction of low power nodes and higher data rates, FAN 1.1 supports many new and exciting use cases. Cisco is well positioned to support this increase in utility and smart city network demand with OpenCSMP and Field Network Director, device and network management solutions that have proven ability to scale to millions of endpoints.” says Clay Stroud, Product Manager for Cisco Field Network Director.

“Wi-SUN FAN1.1 provides highly flexible communications capability allowing both high performance and low energy functionality on the same network, making it the obvious choice for an even broader range of industrial IoT applications such as utilities and smart cities” says Phil Beecher, President and CEO of the Wi-SUN Alliance.  “We’re excited that Cisco will be supporting Wi-SUN FAN 1.1 communications infrastructure with its range of industrial routers, bringing proven reliability, scalability, and security to these critical infrastructure networks. “

For more information about the Wi-SUN Alliance and Field Area Network 1.1, head over to the Wi-SUN FAN information site.

Also see this additional information about Cisco Resilient Mesh products and Cisco Field Network Director.

Finally, if you are attending DISTRIBUTECH 2025, join us at Booth 1223 to see the Catalyst IR8140 and our IoT Field Network Director in person, as well key solutions to help utilities with their grid modernization projects in grid security, substation automation, distribution automation, renewable energy, and more.

As Vietnam regulators are set to open access to 6 GHz spectrum, VNPT is poised to take full advantage with its advanced 10G Fiber Wi-Fi 7 service

As tenant expectations continue to soar, multi-dwelling unit (MDU) owners and managers must meet the growing demands of the market. This requires the best product from Internet Service Providers (ISPs), Managed Service Providers (MSPs), and vendors to succeed and win competitive bids. This article explains how RUCKUS One^®, utilizing RUCKUS DPSK3 and RUCKUS AI, stands out as the all-in-one network solution for MDU environments. It offers a unified platform that meets all the needs of a Managed Service Provider (MSP) to deliver a Managed Wi-Fi Solution across all bands, including 6 GHz. The article showcases the ability to integrate various network components and support complex network requirements using best-in-class Wi-Fi at an affordable price per door.

Wi-Fi as the “Fourth Utility”

Internet connectivity through Wi-Fi has become the “fourth utility.” Reliable internet access is now as essential to daily life as traditional utilities like electricity, water, and gas. This is perhaps the main reason why Real Estate Developers have chosen the pre-installed nature of “Managed Wi-Fi solutions” using Network Segmentation over the conventional physical residential gateway per unit, where each resident or tenant must wait for the next available truck roll, which can sometimes take weeks. People today want and expect reliable, high-performance Internet connectivity ready on Day One.

What is the Managed Wi-Fi Solution?

Managed Wi-Fi in a multi-dwelling units (MDU) property typically involves a Managed Service Provider (MSP) overseeing the deployment and operation of Wi-Fi services, with costs included in the association fees paid by unit owners or tenants’ rent. The provider strategically plans and installs access points for optimal coverage, based on a comprehensive professional design, reducing interference and ensuring consistent Wi-Fi access throughout the complex. This reliable infrastructure not only attracts and retains tenants but also supports ‘Smart Home’ solutions and enhances facility management efficiencies, offering tangible business benefits.

Benefits of reliable, high-performance managed Wi-Fi across the property for MDUs

• Differentiate properties in a competitive market by appealing to tech-savvy residents who demand fast Wi-Fi service everywhere.
• Boost tenant renewals, as satisfied tenants are more likely to renew their leases.
• Provide new wireless Smart Home and business services, including IoT applications like keyless entry, sensors, employee and asset location, analytics, and more.
• Enhance technology capabilities without hassle through centrally managed Wi-Fi services delivered by wireless experts who can proactively prevent problems.
• Simplify wireless service management with multiple control options available in the cloud or on-premises.
• Attract future tenants more effectively, as guests experiencing excellent Wi-Fi are more likely to consider the property for their next home.

Managed Wi-Fi solutions often leverage network segmentation to enhance security, performance, and management efficiency.

What is Network Segmentation?

Network segmentation entails breaking down a network into smaller subnetworks, effectively isolating users’ end devices from each other to improve IT security and user experience. Devices are placed into separate virtual networks, preventing threats to enter the network from moving laterally across segments to other devices. This approach is particularly effective for MDU, such as apartment buildings, college dormitories, senior living facilities, or anywhere residents live communally. The cornerstone of Wi-Fi network segmentation is per-user/per-device PSKs.

What is per-user/per-device PSKs?

Per-user/per-device PSKs (Pre-Shared Keys) are proprietary PSKs solutions, designed to address the vulnerabilities associated with traditional PSK authentication, particularly in environments like MDU. The primary concern with using a single PSK for all devices on a WLAN is the vulnerability to social engineering. If the PSK is shared, whether inadvertently or deliberately, with unauthorized individuals, it jeopardizes the security of the entire WLAN.

Per-user/per-device PSKs offer a solution by assigning a unique PSK to each device or user. This means that each device uses its own unique PSK for connecting to the WLAN, and the MAC address or multiple MAC addresses (due to MAC randomization) of each device are mapped to a unique personal passphrase. These individual PSKs can be created dynamically or manually and are tied to a single SSID. This approach provides unique identity credentials for each device while keeping the simplicity of using a single SSID, enhancing security by isolating each device’s access credentials.

Benefits of the per-user per-device PSKs

• Enhance security by preventing decryption of unicast traffic
• Eliminates the management burden when a passphrase must be changed due to an individual leaving the Property/Company
• Allows granular, user-specific control of network privileges.
• Provide enhanced accounting functionality.
• Transparent for the client devices, acting as a regular PSK network on their side

The RUCKUS patented per-user per-device PSK Solution: Dynamic PSK^™

Dynamic PSK is a CommScope-patented technology that enhances network security by providing unique encryption keys for each user or device connecting to the RUCKUS network. Users can obtain their unique Wi-Fi passwords either through self-service or from an IT administrator, making the connection process intuitive and like home network setups. Unlike conventional PSKs, the Dynamic PSK solution allows administrators to define access policies and revoke access for individual users without affecting others. Wireless traffic is encrypted using WPA2^™-Personal or WPA3^™-SAE, optimizing a robust network and data security. The Dynamic PSK solution is a key part for RUCKUS Network Segmentation.

Breaking Barriers: The RUCKUS Innovation for 6 GHz WPA3 Challenges

When the 6 GHz band was opened for unlicensed use in April 2020, the Wi-Fi Alliance mandated Wi-Fi Protected Access^® 3 (WPA3) and Opportunistic Wireless Encryption (OWE) as the standards for Wi-Fi security for all Wi-Fi 6E devices and any future devices using the greenfield 6 GHz band. This posed a challenge for per-user, per-device PSKs implementations, as WPA3-SAE inherently prevents the use of multiple keys, eliminating the possibility of reverse-engineering the passphrase used in traditional Dynamic PSK and other vendor solutions.

However, there’s no need to be disheartened. Initially, there was no per-user per-device PSK solution for 6 GHz (WPA3-SAE mandatory), but in early 2023, RUCKUS introduced a groundbreaking innovation. The magic unfolds as the “RUCKUS Team” turns the impossible dream into reality with per-user, per-device PSKs on the 6 GHz band. After rigorous testing by the Development and Quality Assurance Teams, RUCKUS released the patented “Dynamic SAE (DSAE) or DPSK3.” This innovation made per-user, per-device PSKs possible in the 6 GHz band using WPA3-SAE, positioning RUCKUS as the first vendor in the industry to offer a multiple password solution on the new 6 GHz band without RADIUS (Remote Authentication Dial-In User Service). RUCKUS DPSK3 extends the successful Dynamic PSK technology to support WPA3, delivering all the benefits of the Dynamic PSK solution while keeping robust WPA3 security.

Key Advantages of Network Segmentation through DPSK3

• 6 GHz Band Compatible: The 6 GHz frequency addition marks the largest expansion of Wi-Fi spectrum ever, with 59 more channels, enabling a dramatic increase in bandwidth and reduction of latency. DPSK3 is fully compatible with the 6 GHz band.
• RUCKUS One Single Network Platform: Deploying DPSK3 within the RUCKUS One solution, alongside Property Management/Residential Portal, Identity Groups, and Adaptive Policy features, eliminates the need for third-party captive portals or advanced gateways. This makes DPSK3 in the RUCKUS One solution an affordable, optimal, and feature-rich solution for MDU, Higher Education Dorms, Hospitality, and other verticals.
• Clean Radio Frequency (RF) Air Space: A single SSID deployment throughout the property, using RUCKUS One AI RRM (Radio Resource Management through Artificial Intelligence), minimizes Co-Channel Interference (CCI), known as “the Wi-Fi Killer”. This creates a cleaner RF environment compared to the conventional “one standalone Wi-Fi router per unit” setup, where frequency coordination is impossible, substantially increasing CCI.
• Universal Coverage Throughout the Property: Residents/Tenants can access their private LAN using the same SSID from anywhere, in their unit, the Common Areas or any other space covered by the Wi-Fi Signal. Basically, their own private LAN follows them around the property, creating a ubiquitous network connection.
• Enhanced Network Security: By segmenting the network, any malware or breach in one segment of the network can be contained to that smaller network segment, making it more difficult to spread horizontally throughout the entire network. In the animation below the malware is confined to the specific microsegment/VLAN, affecting only one customer, and preventing horizontal propagation to other network segments.

• Defeats MAC Randomization (Private MAC Address): With RUCKUS Dynamic PSK and DPSK3 solutions, segmentation is achieved through the uniqueness of the password, independent of the MAC address. This means that even if a device uses multiple randomized MAC addresses, it will consistently use the same password. As a result, all those MAC addresses will be added to its private LAN, enabling seamless connectivity and optimizing security.
• Property Management can revoke access at any time without impacting others: Conventional PSKs involve shared Wi-Fi passwords, making it challenging to revoke access for an individual without affecting everyone else. In contrast, with RUCKUS Dynamic PSK and DPSK3 solutions, access can be individually managed. If a resident sells their unit or a tenant’s lease expires, access can be revoked through the Resident Portal or by Property Management. Additionally, Customer Service, the Network Operation Center (NOC) for ISPs, or any Network Administrator with proper privileges can manage access rights effectively.
• Private Network for each Tenant: The benefits of this Private LAN architecture include:
  • All devices belonging to a single tenant can communicate with each other, while preventing access to other tenants’ devices.
  • Residents or tenants can only view their own traffic when using packet sniffers like tcpdump or Wireshark, ensuring they cannot intercept others’ traffic.
  • Congestion is reduced by limiting unnecessary traffic flow between segments.
• Unique Public IP per Tenant: Each private network can be linked to a unique public IP address, granting tenants control over their inbound and outbound connectivity, benefits include:
  • The unique public address typically helps Service Providers comply with CALEA (Communications Assistance for Law Enforcement Act) non-repudiation requirements, enabling the origin and the integrity of data to be verified.
  • Devices that rely on Universal Plug and Play (UPnP), such as game consoles, can function properly without any effort from the tenant or operator.
  • Applications that depend on broadcast and multicast-based protocols, such as multicast Domain Name System (mDNS), function properly.

Network Segmentation with DPSK3 Proof of Concept (POC) for a Partner

The purpose of this POC Lab was to deliver a “Single Pane of Glass” Managed Wi-Fi Solution on 6 GHz to a long-standing ISP/MDU Partner. This partner successfully implemented Network Segmentation using the RUCKUS Dynamic PSK solution across multiple properties, including MDUs, hotels, and university environments. However, as mentioned, with the introduction of 6 GHz and the requirement for WPA3, the Dynamic PSK solution was challenged, but the RUCKUS Team embraced this challenge and developed the DPSK3 solution.

Now, the partner’s requirements were not just about network security, they also needed an affordable and easy to deploy solution. Typically, with most vendors, achieving all three is difficult, often resulting in a compromise of one or two of the three. To provide a Wi-Fi network that is both reasonably secure and easy to deploy, customers often need to invest in expensive advanced gateways and/or costly RADIUS servers, increasing CapEx and reducing competitiveness. Alternatively, opting for a cheaper solution typically compromises security and performance. However, the RUCKUS solution offers partners all three benefits: security, affordability, and ease of deployment, along with RUCKUS’s unmatched RF performance. Configuration can be automated using the template capabilities built into the RUCKUS One solution, facilitating “cookie-cutter” future deployments.

Requirement added per Partner Feature Request

In addition to the above requirements, the partner, being an ISP, needed different Bandwidth Service Tier levels per user, such as:

1. Bulk Service: Bandwidth Down = 100 Mbps, Bandwidth Up = 100 Mbps
2. Silver Service: Bandwidth Down = 500 Mbps, Bandwidth Up = 500 Mbps
3. Gold Service: Bandwidth Down = 1000 Mbps, Bandwidth Up = 1000 Mbps

The RUCKUS Engineering and Development Team returned to the drawing board and undertook significant coding efforts to provide the Partner with the requested Rate Limiting option. At that point, the RUCKUS One solution became the single, cloud-based platform to manage all network components across all properties; enabling the partner to monitor, configure, and optimize networks remotely using the following features:

Main RUCKUS One Solution Features

Centralized and Automated Management

The RUCKUS One solution provides a single, unified platform for managing both wired and wireless networks, with automation tools for configuration, updates, and monitoring to enhance efficiency and reduce manual workload.

AI-Driven Analytics and Security

The platform leverages Artificial Intelligence (AI) and Machine Learning (ML) for real-time network analytics, predictive maintenance, and robust security features, including intrusion detection and automated updates, to proactively manage and secure network performance.

Scalability and Remote Capabilities

Designed to scale with organizational growth, the RUCKUS One solution supports remote monitoring and management, allowing for efficient network optimization and bandwidth management across all properties.

Specific RUCKUS One Solution Features

Network Segmentation through DPSK3 Service on 6 GHz

The animation below illustrates the customer’s mobile phone in UNIT 104, initially connected on 6 GHz within their unit, roaming to different APs and bands, eventually reaching the pool area and going back to 6 GHz. Throughout this process, the device remains connected to its own private VLAN704. (Note: Hopefully, the phone is indeed water-resistant—just a lighthearted remark!)

Property Management

Enables the creation of an unlimited number of units for the MDU. For example, the system can accommodate a property with 500 units/ identities.

Residential Portal

The RUCKUS Resident Portal feature provides a user-friendly interface for managing network access in MDU. It allows property managers to create and manage multiple units, offering residents seamless connectivity and secure access to the network. The portal supports self-service options for residents to obtain, change/reset unique Wi-Fi credentials and control devices connected to their private network.

Adaptive Policy

Rate Limiting based on RADIUS Attributes for the different Tiers Services (Bulk: 100×100, Silver 500×500, Gold:1000×1000).

“Matrix Like” Role Base Access Control (RBAC) for their different management Tiers

NOC, Engineering and others

Wi-Fi Calling

Facilitates cell phone calling in areas with low or no cellular signal.

Hotspot 2.0

This feature was a requirement from the MDU developers, enabling their users to automatically connect to Wi-Fi across multiple properties and roam seamlessly through OpenRoaming^™.

The All-in-One Solution for MDU Network Management: RUCKUS One

RUCKUS DPSK3, when deployed within the RUCKUS One solution, emerges as the most versatile and comprehensive solution for MDU environments. It provides a single platform that fulfills all the requirements a Managed Service Provider (MSP) needs to offer a Managed Wi-Fi Solution on all bands, including 6 GHz. All the features discussed in this publication are integrated into the RUCKUS One solution, serving as a single pane of glass to monitor, manage, and control Access Points, Switches, RUCKUS Edge^™, Property Units, Residential Portals, and Policies for Rate Limiting, Service Scheduling, and more. Additionally, it offers RUCKUS AI RRM, Analytics, and Reports, with upcoming support for features like PON (Passive Optical Networks) management and IoT integration.

© 2025 CommScope, LLC.  All rights reserved.  CommScope and the CommScope logo are registered trademarks of CommScope and/or its affiliates in the U.S. and other countries.  For additional trademark information see https://www.commscope.com/trademarks.  Wi-Fi, Wi-Fi 6E, WPA2, WPA3 and Wi-Fi Protected Access are trademarks of the Wi-Fi Alliance. OpenRoaming is a trademark of the Wireless Broadband Alliance. All product names, trademarks and registered trademarks are property of their respective owners.