3Com 3CRWX440095A, 3CRWX120695A manual WX4400# set location policy deny if user eq *.theirfirm.com

206CHAPTER 7: AAA COMMANDS

The order of rules in the location policy is important to ensure users are properly granted or denied access. To position rules within the location policy, use before rule-numberand modify rule-numberin the set location policy command, and the clear location policy rule-numbercommand.

When applying security ACLs:

Use inacl inacl-nameto filter traffic that enters the switch from users via an MAP access port or wired authentication port, or from the network via a network port.

Use outacl outacl-nameto filter traffic sent from the switch to users via an MAP access port or wired authentication port, or from the network via a network port.

You can optionally add the suffixes .in and .out to inacl-nameand outacl-nameso that they match the names of security ACLs stored in the local WX database.

Examples — The following command denies network access to all users at *.theirfirm.com, causing them to fail authorization:

WX4400# set location policy deny if user eq *.theirfirm.com

The following command authorizes access to the guest_1 VLAN for all users who are not at *.wodefirm.com:

WX4400# set location policy permit vlan guest_1 if user neq *.wodefirm.com

The following command authorizes users at *.ny.ourfirm.com to access the bld4.tac VLAN instead, and applies the security ACL tac_24 to the traffic they receive:

WX4400# set location policy permit vlan bld4.tac outacl tac_24 if user eq *.ny.ourfirm.com

The following command authorizes access to users on VLANs with names matching bld4.* and applies security ACLs svcs_2 to the traffic they send and svcs_3 to the traffic they receive:

WX4400# set location policy permit inacl svcs_2 outacl svcs_3 if vlan eq bldg4.*