Nortel Networks 2300 manual Using Authentication and Accounting Rules Together

Configuring AAA for Network Users 467

Using Authentication and Accounting Rules Together

When you use accounting commands with authentication commands and identify users with user wildcards, WSS Software might not process the commands in the order you entered them. As a result, user authentication or accounting might not proceed as you intend, or valid users might fail authentication and be shut out of the network.

You can prevent these problems by using duplicate user wildcards for authentication and accounting and entering the commands in pairs.

Configuration Producing an Incorrect Processing Order

For example, suppose you initially set up start-stop accounting as follows for all 802.1X users through RADIUS server group 1:

23x0# set accounting dot1x ssid mycorp * start-stop group1

success: change accepted.

You then set up PEAP-MS-CHAP-V2 authentication and authorization for all users at EXAMPLE/ at server group 1. Finally, you set up PEAP-MS-CHAP-V2 authentication and authorization for all users in the local WSS database, with the intention that EXAMPLE users are to be processed first:

23x0# set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1 success: change accepted.

23x0# set authentication dot1x ssid mycorp * peap-mschapv2 local success: change accepted.

The following configuration order results. The authentication commands are reversed, and WSS Software processes the authentication of all 802.1X users in the local database and ignores the command for EXAMPLE/ users.

23x0# show aaa

...

set accounting dot1x ssid mycorp * start-stop group1

set authentication dot1x ssid mycorp * peap-mschapv2 local

set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1

Configuration for a Correct Processing Order

To avoid processing errors for authentication and accounting commands that include order-sensitive user wildcards, enter the commands for each user wildcard in pairs.

For example, to set accounting and authorization for 802.1X users as you intended in “Configuration Producing an Incorrect Processing Order” on page 467, enter an accounting and authentication command for each user wildcard in the order in which you want them processed:

23x0# set accounting dot1x ssid mycorp EXAMPLE/* start-stop group1 success: change accepted.

23x0# set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1 success: change accepted.

23x0# set accounting dot1x ssid mycorp * start-stop group1

Nortel WLAN Security Switch 2300 Series Configuration Guide