Filter
Top Products
In the WebUI
1. Navigate to the Configuration > Security > Authentication > AAA Profiles page.
2. Select the default profile or a user-defined AAA profile.
3. Click the Initial Role drop-down list, and select the desired user role for unauthenticated users.
4. Click the 802.1x Authentication Default Role drop-down list and select the desired user role for users who have
completed 802.1x authentication.
5. Click the MAC Authentication Default Role drop-down list and select the desired user role for clients who have
completed MAC authentication.
6. Click Apply.
In the CLI
(host)(config) #aaa profile <profile>
initial-role <role>
d>ot1x-default-role <role>
mac-default-role <role>
For additional information on creating AAA profiles, see "AAA Profile Parameters" on page 319.
Working with User-Derived VLANs
Attributes derived from the client’s association with an AP can be used to assign the client to a specific role or
VLAN, as user-derivation rules are executed before the client is authenticated.
You configure the user role or VLAN to be assigned to the client by specifying condition rules; when a condition is
met, the specified user role or VLAN is assigned to the client. You can specify more than one condition rule; the
order of rules is important as the first matching condition is applied. You can optionally add a description of the
user rule.
Table 82 describes the conditions for which you can specify a user role or VLAN.
Rule Type Condition Value
BSSID: Assign client to a role or VLAN based
upon the BSSID of AP to which client is
associating.
One of the following:
l contains
l ends with
l equals
l does not equal
l starts with
MAC address (xx:xx:xx:xx:xx:xx)
DHCP-Option: Assign client to a role or VLAN
based upon the DHCP signature ID.
One of the following:
l equals
l starts with
DHCP signature ID.
NOTE: This string is
not
case sensitive.
DHCP-Option-77: Assign client to a role or VLAN
based upon the user class identifier returned by
DHCP server.
equals string
Encryption: Assign client to a role or VLAN based
upon the encryption type used by the client.
One of the following:
l equals
l does not equal
l Open (no encryption)
l WPA/WPA2 AES
l WPA-TKIP (static or dynamic)
l Dynamic WEP
l WPA/WPA2 AES PSK
Table 82:
Conditions for a User-Derived Role or VLAN
DellPowerConnectW-SeriesArubaOS6.2 | User Guide Rolesand Policies | 306