Nortel Networks 2300 manual Assigning a Security ACL to a User or a Group

Configuring AAA for Network Users 451

Assigning a Security ACL to a User or a Group

Once a security access control list (ACL) is defined and committed, it can be applied dynamically and auto- matically to users and user groups through the 802.1X authentication and authorization process. When you assign a Filter-Id attribute to a user or group, the security ACL name value is entered as an authorization attribute into the user or group record in the local WSS database or RADIUS server.

Note. If the Filter-Id value returned through the authentication and authorization process does not match the name of a committed security ACL in the WSS, the user fails authorization and cannot be connected.

(For details about security ACLs, see “Configuring and Managing Security ACLs,” on page 351.)

Assigning a Security ACL Locally

To use the local WSS database to restrict a user, a MAC user, or a group of users or MAC users to the permis- sions stored within a committed security ACL, use the following commands:

Security ACL Target

User authenticated by a password

Group of users authenticated by a password

User authenticated by a MAC address

Group of users authenticated by a MAC address

Commands

set user username attr filter-id acl-name.in set user username attr filter-id acl-name.out

set usergroup groupname attr filter-id acl-name.in set usergroup groupname attr filter-id acl-name.out

set mac-user username attr filter-id acl-name.in set mac-user username attr filter-id acl-name.out

set mac-usergroup groupname attr filter-id acl-name.in set mac-usergroup groupname attr filter-id acl-name.out

You can set filters for incoming and outgoing packets:

•Use acl-name.into filter traffic that enters the WSS switch from users through an AP access point or wired authentication port, or from the network through a network port.

•Use acl-name.outto filter traffic sent from the WSS switch to users through an AP access point or wired authentication port, or from the network through a network port.

For example, the following command applies security ACL acl-101to packets coming into the WSS from user Jose:

23x0# set user Jose attr filter-id acl-101.in

success: change accepted.

The following command applies the incoming filters of acl-101to the users who belong to the group eastcoasters:

23x0# set usergroup eastcoasters attr filter-id acl-101.in

Nortel WLAN Security Switch 2300 Series Configuration Guide