Nortel Networks 2300 Series manual Set location policy, Deny, Permit, Complete Ssid name

AAA Commands 203

•set authentication admin on page 182

•set authentication console on page 183

•set authentication dot1x on page 185

•show aaa on page 210

set location policy

Creates and enables a location policy on a WSS. A location policy enables you to locally set or change authorization attributes for a user after the user is authorized by AAA, without making changes to the AAA server.

Syntax set location policy deny if {ssid operator ssid-namevlan operator vlan-wildcarduser operator user-wildcard

port port-list ap ap-num}

[before rule-number modify rule-number]

Syntax set location policy permit {vlan vlan-nameinacl inacl-nameoutacl outacl-name}if {ssid operator ssid-namevlan operator vlan-wildcarduser operator user-wildcardport port- list ap ap-num}

[before rule-number modify rule-number]

deny	Denies access to the network to users with characteristics that match the
	location policy rule.
permit	Allows access to the network or to a specified VLAN, and/or assigns a
	particular security ACL to users with characteristics that match the
	location policy rule.

Action options—For a permit rule, WSS Software changes the attributes assigned to the user to the values specified by the following options:

vlan vlan-name	Name of an existing VLAN to assign to users with characteristics that
	match the location policy rule.
inacl inacl-name	Name of an existing security ACL to apply to packets sent to the WSS
	with characteristics that match the location policy rule.
	Optionally, you can add the suffix.in to the name.
outacl outacl-name	Name of an existing security ACL to apply to packets sent from the WSS
	with characteristics that match the location policy rule.
	Optionally, you can add the suffix.out to the name.

Condition options—WSS Software takes the action specified by the rule if all conditions in the rule are met. You can specify one or more of the following conditions:

ssid operator ssid-	SSID with which the user is associated. The operator must be eq, which
name	applies the location policy rule to all users associated with the SSID.
	Asterisks (wildcards) are not supported in SSID names. You must specify
	the complete SSID name.

Nortel WLAN—Security Switch 2300 Series Command Line Reference