Method of connecting remote AP to SZ 100

Here are the ports you need for the SmartZone 100 to communicate with the AP effectively and other things.

AP to SmartZone Control Plane communication needs TCP port 443 for registration using certificate

AP to SmartZone Control Plane SSH Tunnel requires TCP port 22

AP to SmartZone CP for firmware updates and more needs TCP port 91

AP to SZ-CP for time sync requires UDP port 123

AP to RADIUS server if needed requires UDP port 1812 and 1813 and can be changed as needed

AP to SmartZone Data Plane for R-GRE tunnel formation and maintenance needs port 23233 and can be changed as needed in the SZ-100

AP to SmartZone DP for R-GRE traffic transmission of client data requires TCP port 23232.  This is not configurable.

IP on SZ-DataPlane needs to be able to reach SZ-Control Plane IP on port 80 for internal communication - Just FYI

SZ-D to SZ-CP requires ports 443 and 6868 for other services internal to the controller, again these are FYI as both refer to internal controller functions

Hope this helps.

To put it simply and in a way I can post it in a short reply here, with the SZ, the AP forms two separate tunnels.  One is SSH and the other is GRE (if required). 

The SSH tunnel is used to communicate with the controller securely and for the AP to download configuration, firmware and send stats, etc.. 

The GRE tunnel is formed when you chose to send the data of wireless clients to the controller via a GRE tunnel instead of sending it locally to a switch in what we call Local Break Out (LBO).  During this process, the AP forms a tunnel with the controller using a Ruckus proprietary process that allows the AP to be behind NAT if needed.  The data from the clients is encapsulated into a VLAN and sent via this tunnel to the controller where the VLAN is then removed from the tunnel and sent natively to the switch attached at the core, behind the SZ100 or SCG-200 controller.  Effectively, this creates a layer 2 tunnel over layer 3 and preserves the client MAC addresses and other needed information.  Which means, that this client can now have IPs from the core DHCP server, be sent to a session manager or gateway, sent to NAT, AAA, Active Directory or whatever you need to do the same way you would do if the client was connected locally to a switch port in your enterprise network.

Here is the datasheet for this controller. 

http://a030f85c1e25003d7609-b98377aee968aad08453374eb1df3398.r40.cf2.rackcdn.com/datasheets/ds-smart...

The ZD however uses LWAPP (Lightweight Access Point Protocol) as its tunneling mechanism.  That is a bit different than GRE and can be read about briefly in this Wiki page.

https://en.wikipedia.org/wiki/Lightweight_Access_Point_Protocol

It is a standard protocol a bit older and uses more overhead than SSH which is why it is not being used in our newer controllers today.

Hope this helps!