Dell 6.2 Working with User-Derived VLANs, Rule Type Condition Value, Equals String, Dhcp server

In the WebUI

1.Navigate to the Configuration > Security > Authentication > AAA Profiles page.

2.Select the default profile or a user-defined AAA profile.

3.Click the Initial Role drop-down list, and select the desired user role for unauthenticated users.

4.Click the 802.1x Authentication Default Role drop-down list and select the desired user role for users who have completed 802.1x authentication.

5.Click the MAC Authentication Default Role drop-down list and select the desired user role for clients who have completed MAC authentication.

6.Click Apply.

In the CLI

(host)(config) #aaa profile <profile> initial-role <role> d>ot1x-default-role <role> mac-default-role <role>

For additional information on creating AAA profiles, see "AAA Profile Parameters" on page 319.

Working with User-Derived VLANs

Attributes derived from the client’s association with an AP can be used to assign the client to a specific role or VLAN, as user-derivation rules are executed before the client is authenticated.

You configure the user role or VLAN to be assigned to the client by specifying condition rules; when a condition is met, the specified user role or VLAN is assigned to the client. You can specify more than one condition rule; the order of rules is important as the first matching condition is applied. You can optionally add a description of the user rule.

Table 82 describes the conditions for which you can specify a user role or VLAN.

Table 82: Conditions for a User-Derived Role or VLAN

Rule Type	Condition		Value
BSSID: Assign client to a role or VLAN based	One of the following:		MAC address (xx:xx:xx:xx:xx:xx)
upon the BSSID of AP to which client is	•	contains
associating.	•	ends with
	•	equals
	•	does not equal
	•	starts with
DHCP-Option: Assign client to a role or VLAN	One of the following:		DHCP signature ID.
based upon the DHCP signature ID.	•	equals	NOTE: This string is not case sensitive.
	•	starts with
DHCP-Option-77: Assign client to a role or VLAN	equals		string
based upon the user class identifier returned by
DHCP server.
Encryption: Assign client to a role or VLAN based	One of the following:		•	Open (no encryption)
upon the encryption type used by the client.	•	equals	•	WPA/WPA2 AES
	•	does not equal	•	WPA-TKIP (static or dynamic)
			•	Dynamic WEP
			•	WPA/WPA2 AES PSK

Dell PowerConnect W-Series ArubaOS 6.2 User Guide Roles and Policies 306