305| Roles and Policies DellPowerConnect W- Series ArubaOS 6.2 | User Guide

Viewing the Current Excepti onsLi st

To view the current bandwidthco ntractexcepti onlist , access the command-lineinterface in enable mode and issue
the commandshow vlan-bwcontract-explist.To view the preconfigured internal bandwidth contract exception
list, includethe opti onali nternalparameter, as shown in the examplebelow:

Configuring Bandwidth C ontract Exceptions

To add the MAC address of a protocol to the exception list for bandwidth contracts, access the command-line
interface in config mode and issue the command vlan-bwcontract-explist <mac-addr>.
The followingexample adds the MAC address for CD P (Cisco Disco very Protocol) and VTP (Virtual Trunking
Protocol to the list o f protocols that are not limited by V LAN bandwidth contracts.
(host)(config) #vlan-bwcontract-explist mac 01:00:0C:CC:CC:CC
Assigning Use r Roles
A client is assigned a user roleby o neo fs everalmethods. A role assigned by one method may take precedence over
one assigned by a different method. The methods of assigning user roles are,from lowest to highest precedence:
1. The initial user role or VLAN for unauthenticated clients is configured in the AAA profile for a virtual AP (see
Access Points (APs) on page 393 ).
2. The userrole can be derived from user attributes upon the client’s asso ciation with an AP (this i s known as a
user-derivedrole). You can configure rulesthat assign a user role to clients that match a certain set of criteria. For
example,you can configure a rule to assign the role VoIP-Phone to any client that has a MAC address that starts
with bytes
xx:yy:zz
.User-derivationrules are executed
before
client authentication.
3. The userrole can be t he defaultuser role configured for an authentication method, such as 802.1x or V PN. For
each authentication method, you can configure a default rolefor c lients who are successfullyauthenticated using
that method.
4. The userrole can be derived from attributes returned by the authentication server and certain client attributes
(this is known as a
server-derivedrole
). If the client is authenticated via an authentication server,t heuser role for
the client can be based on one or more attributes returned by the server during authentication, or on client
attributes such as SSID (even if the attribute is not returnedby the server). Server-derivationrules are executed
after
client authentication.
5. The userrole can be derived from Dell Vendor-Specific Attributes (VSA) for R ADIUS server authentication. A
rolederived from a Dell VSA takes precedence over any other user roles.
The followingsecti ons describe the methods of assigning user roles.

Assigning Use r Roles in AAA P rofiles

An AAA profile defines the user role for unauthenticated clients (initial role) as well as the default user role for MAC
and 802.1x authentication. To configure user roles in the AAA profile: