Alcatel-Lucent IAP93 Podręcznik Użytkownika Pobierz pdf (Strona 180)

When Enforce Machine Authentication is enabled, both the device and the user must be authenticated for the role

assignment rule to apply.

In the CLI

To configure role assignment rules for a WLAN SSID:

(Instant Access Point)(config)# wlan ssid-profile <name>

(Instant Access Point)(SSID Profile <name>)# set-role <attribute>{{equals|not-equals|starts-wi

th|ends-with|contains|matches-regular-expression} <operator><role>|value-of}

(Instant Access Point)(SSID Profile <name># end

(Instant Access Point)# commit apply

To configure role assignment rules for a wired profile:

(Instant Access Point)(config)# wired-port-profile <name>

(Instant Access Point)(wired ap profile <name>)# set-role <attribute>{{equals|not-equal|start

s-with|ends-with|contains}<operator> <role>| value-of}

(Instant Access Point)(wired ap profile <name>)# end

(Instant Access Point)# commit apply

Example

(Instant Access Point)(config)# wlan ssid-profile Profile1

(Instant Access Point)(SSID Profile "Profile1")# set-role mac-address-and-dhcp-options matche

s-regular-expression \bring\b Profile1

(Instant Access Point)(SSID Profile"Profile1")# end

(Instant Access Point)# commit apply

Understanding VLAN Assignment

You can assign VLANs to a client based on the following configuration conditions:

l The default VLAN configured for the WLAN can be assigned to a client.

l If VLANs are configured for a WLAN SSID or an Ethernet port profile, the VLAN for client can be derived before

the authentication, from the rules configured for these profiles.

l If a rule derives a specific VLAN, it is prioritized over the user roles that may have a VLAN configured.

l The user VLANs can be derived from the default roles configured for 802.1X authentication or MAC

authentication.

l After client authentication, the VLAN can be derived from Vendor Specific Attributes (VSA) for RADIUS server

authentication.

l The DHCP-based VLANs can be derived for Captive Portal authentication.

AOS-W Instant supports role derivation based on DHCP option for Captive Portal authentication. When the Captive

Portal authentication is successful, the role derivation based on DHCP option assigns a new user role to the guest

users, instead of the pre-authenticated role.

Vendor Specific Attributes (VSA)

When an external RADIUS server is used, the user VLAN can be derived from the Alcatel-Lucent-User-Vlan VSA.

The VSA is then carried in an

Access-Accept

packet from the RADIUS server. The OAW-IAP can analyze the return

message and derive the value of the VLAN which it assigns to the user.

AOS-W Instant 6.3.1.1-4.0 | User Guide Roles and Policies | 180

1 2 ... 175 176 177 178 179 180 181 182 183 184 185 ... 334 335

Brak uwag

Alcatel-Lucent IAP93 Podręcznik Użytkownika Strona 180