179| Authentication Servers DellPowerConnect W- Series ArubaOS 6.2 | User Guide
Using the WebUI
1. N avigate to the Configuration > Security > Authentication > Servers page.
2. Select LDAP Server t o display the LDAP Server List.
3. E nter ldap-1for t he servername and click Add.
4. E nter ldap-2for t he servername and click Add.
5. U nderthe Servers tab, select ldap-1 to configure serverparameters. Enter the IP address for the server. Selectthe
Mode checkboxto activate the authentication server. Click Apply.
6. R epeatst ep 5 on page 179 to configure ldap-2.
7. D isplay the ServerGroup list: Under the Serverst ab,select Server G roup.
8. E nter corp-serv as the new server group and click Add.
9. Select corp-serv, under the Server tab, to configure the server group.
10. Select Fail Through.
11. Under Servers,c lick New to add a server to the group. Select ldap-1 fromt hedrop-down menu and click Add
Server.
12. Repeat step 11 on page 179 to add ldap-2 to the group.
13. Click Apply.
Using the CLI
(host)(config) #aaa authentication-server ldap ldap-1
host 10.1.1.234
(host)(config) #aaa authentication-server ldap ldap-2
host 10.2.2.234
(host)(config) #aaa server-group corp-serv
auth-server ldap-1 position 1
auth-server ldap-2 position 2
allow-fail-through
Configuring Dyna mic Server Sele ction
The controllercan dynamically select an authentication server from a server group based on the user information sent
by the client in an authentication request. For example,an authenticati on request can includeclient or user
information in one of the following formats:
l<domain>\<user>— for example, corpnet.com\darwin
l<user>@<domain>— for example, darwin@corpnet.com
lhost/<pc-name>.<domain>— for example, host/darwin-g.finance.corpnet.com(this format is used wit h 802.1x
machine authentication in Windows environments)
Whenyou c onfigurea server in a server group, you can optio nallyassoci ate the server with one or more match rules.
A match rulefor a server can be one of the following:
lThe serveri s selected if the client/user information

contains

a specified string.
lThe serveri s selected if the client/user information

begins

with a specified string.
lThe serveri s selected if the client/user information

exactly

matches a specified string.
You can configuremultiple match rules for the same server.The controller compares the client/userinformation with
the match rulesconfigured for each server,st artingwi th the first serverin the server group. If a match is found, the
controllersends the authentication request to the server with the matching rule. If no match is found beforethe end
of the serverlist is reached, an error is returnedand no authentication request for the client/useris sent.