Nortel Networks 2300 Configuring Portal Web-based AAA, Portal Web-based AAA Configuration Example

Configuring AAA for Network Users 433

Configuring Portal Web-based AAA

To configure portal Web-based AAA:

1Configure the user’s VLAN on the WSS switch, and configure an IP interface on the VLAN.The interface must be in the subnet on which the DHCP server will place the user.

2Set the fallthru authentication type to web-portalfor all SSIDs and wired authentication ports through which Web-based AAA users will access the network. The default for SSIDs is already web-portal. However, the default for wired authentication ports is none.

3Configure web-portal-ssidand web-portal-wiredusers. You must create a web-portal-ssiduser for each SSID. However, the web-portal-wireduser is applicable to all wired authentication ports.

Set the VLAN-Name and Filter-Id attributes for these users. For the VLAN-Name, specify the VLAN in which you want to place authorized Web-based AAA users. For Filter-Id, specify the portal ACL, and map the ACL to the inbound traffic direction.

4Configure individual Web-based AAA users. Because the VLAN is assigned based on the web-portal-ssidor web-portal-wireduser, WSS Software ignores the VLAN-Name and Tunnel-Private-Group-ID attributes. However, WSS Software does assign other attributes if set.

5Configure a last-resort authentication rule for each web-portal-ssidand web-portal-wireduser.

6Configure web authentication rules for the Web-based AAA users.

7Save the configuration changes.

Portal Web-based AAA Configuration Example

This example configures portal Web-based AAA for wireless users of SSID mycorp. The web-portal-mycorpuser and the individual Web-based AAA users are configured in the local database. The default fallthru authentication type for SSIDs is already web-portal, so this example does not include the command to set it.

1Configure the user’s VLAN on ports 2 and 3, and configure an IP interface on the VLAN:

23x0# set vlan corpvlan port 2-3 success: change accepted.

23x0# set interface corpvlan ip 192.168.12.10 255.255.255.0 success: change accepted.

2Configure user web-portal-mycorpfor SSID mycorp, which Web-based AAA users will use to access the network. Use the vlan-nameattribute to assign the user to the VLAN corpvlan.

23x0# set user web-portal-mycorp attr vlan-name corpvlan

3Assign the ACL web to the inbound traffic direction for user web-portal-mycorp:

23x0# set user web-portal-mycorp attr filter-id portalacl.in

4Configure individual Web-based AAA users.

23x0# set user alice password alicepword success: change accepted.

23x0# set user bob password bobpword success: change accepted.

Nortel WLAN Security Switch 2300 Series Configuration Guide