Nortel Networks 2300 manual Remote Authentication with Local Backup

Configuring AAA for Network Users 413

username entry in the local database, the WSS switch tries the next RADIUS server group method. This exception is referred to as local override.

If the local database is the last method in the list, however, local authentication must either accept or deny the user, because it has no other method to roll over to.

Remote Authentication with Local Backup

You can use a combination of authentication methods. In pass-through authentication, AAA processing is passed through the WSS switch and performed remotely by RADIUS servers. (For details, see “Using Pass-Through” on page 419.) If RADIUS servers are unavailable, local authentication can take place on the WSS switch.

Suppose an administrator wants to rely on RADIUS servers and also wants to ensure that a certain group of users always gets access. As shown in the following example, the administrator can configure pass-through authentication by a RADIUS server group as the first method for these users and configure local authentication last, in case the RADIUS servers are unavailable. (See Figure 18 on page 414.)

1To configure server-1and server-2at IP addresses 192.168.253.1 and 192.168.253.2 with the password chey3nn3, the administrator enters the following commands:

23x0# set radius server server-1 address 192.168.253.1 key chey3nn3 23x0# set radius server server-2 address 192.168.253.2 key chey3nn3

2To configure server-1and server-2into server-group-1, the administrator enters the following command:

23x0# set server group server-group-1 members server-1 server-2

3To enable pass-through plus local authentication for all users of SSID mycorp at @example.com, the administrator enters the following command.

23x0# set authentication dot1x ssid mycorp *@example.com pass-through server-group-1 local

Nortel WLAN Security Switch 2300 Series Configuration Guide