222| DellPowerConnect W- Series ArubaOS 6.2 | User Guide
profile.Dell’s stateful NTLM authentication does not support placing usersin vario us rolesbased upon group
membershipor ot herrole-derivation attributes.
Working With WISPr Authe ntication
WISPr authentication allows a “smart client” to authenticate on the network when they roam between Wireless
Internet Service Providers, eveni f the wireless hotspot uses an ISP for which the client may not have an acco unt.
If you are a hotspot operator using WISPrauthenticati on,and a client that has an account with your ISP attempts
to access the Internet at your hotspot , then your ISP’s WISPr AAA server authenticates that client di rectly,and
allows the clientacc ess on the network.If, however, the client only has an account with a

partner

ISP, then your
ISP’s WISPr AAA server forwards that client’s credentials to the partner ISP’s WISPr A AA server for authentication.
Oncet hec lient has beenauthenticated o n the partnerISP , it is authenticated on your hotspot’s own I SP, as per
their service agreements.After your ISP sends an authentication message to the controller, the controllerassi gnst he
defaultWISPr user role to t hat client.
ArubaOSsupports the following smart clients,whic henable client authentication and roamingbetween hotspots by
embeddingiP ass Generic Interface Specification (GIS)

redirect

,

proxy

,

authentication

and

logoff

messages within
HTLM messagest o the controller.
liPass
lBongo
lTrustive
lweRoam
lAT&T
Understanding St ateful Authentication Best Practic es
Beforey ou can configurea stateful authentication feature,y ou shouldhave defined a user role you want to assign to
the authenticated users, andcreated a server groupthat includesa RADIUS authentication server for stateful 802.1x
authentication or a Windows server for stateful NTLM authentication. For details on performing these tasks, see the
followingsect ions of this User Guide:
l"Roles and Policies" on page 296
l"Configuringa RAD IUS Server"on page 1 69
l"Configuringa Windows Server" on page 174
l"ConfiguringServer Groups" on page 177
You can uset hedefault stateful NTLM authentication and WISPr authentication profiles to manage the settings for
these features,or you can create additional profiles as desired. Note, however, that unlikemo st other types of
authentication, stateful 802.lx authentication uses only a single Stateful 802.1x profile. This profile can be enabled or
disabled,but you can not configure more thanone instance of a Stateful 802.1x profile.
Configuring Statefu l 802.1x Authentication
Whenyou co nfigure802 .1x authentication for clients on non-Dell APs, you must specify the group of RADI US
serverst hat performsthe user authentication, and select the role to be assigned to those users who successfully
complete authentication. Whenthe user logs off or shuts down the client machine, ArubaOSnotesthe
deauthentication message fromthe RA DIUS server,and changes the user’s role fromt hes pecified authenticatedrole
back to the logon role. For details on defining a RADIUS serverused for st ateful80 2.1x authentication, see
"Configuringa RAD IUS Server"on page 1 69