Contents 29
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Assigning a security ACL locally . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
Assigning a security ACL on a RADIUS server . . . . . . . . . . . . . . . . . . . 603
Clearing a security ACL from a user or group . . . . . . . . . . . . . . . . . . . . 603
Assigning encryption types to wireless users . . . . . . . . . . . . . . . . . . . . . . . . 604
Assigning and clearing encryption types locally . . . . . . . . . . . . . . . . . . . 604
Assigning and clearing en cryption types on a RADIUS server . . . . . . . . 605
Keeping users on the same VLAN even after roaming . . . . . . . . . . . . . . . . . 606
Overriding or adding attributes locally with a location policy . . . . . . . . . . . . . . . . 609
About the location policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610
How the location policy differs from a security ACL . . . . . . . . . . . . . . . . . . . 611
Setting the location policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612
Applying security ACLs in a location policy rule . . . . . . . . . . . . . . . . . . . 613
Displaying and positioning location policy rules . . . . . . . . . . . . . . . . . . . 613
Clearing location policy rules and disabling the location policy . . . . . . . . . . . 614
Configuring accounting for wireless network u se rs . . . . . . . . . . . . . . . . . . . . . . . 614
Configuring periodic accoun ting update records . . . . . . . . . . . . . . . . . . . . . . 616
Enabling system accounting messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617
Viewing local accounting records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618
Viewing roaming accounting records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619
Displaying the AAA configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620
Avoiding AAA problems in configuration order . . . . . . . . . . . . . . . . . . . . . . . . . . 621
Using the wildcard “Any” as the SSID name in authentication rules . . . . . . . 622
Using authentication and accounting rules together . . . . . . . . . . . . . . . . . . . 623
Configuration producing an incorrect processing order . . . . . . . . . . . . . 623
Configuration for a corr ect processing order . . . . . . . . . . . . . . . . . . . . . 623
Configuring a Mobility Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624
Network user configuration scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
General use of network user commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
Enabling RADIUS pass-through authentication . . . . . . . . . . . . . . . . . . . . . . 628
Enabling PEAP-MS-CHAP-V2 authentication . . . . . . . . . . . . . . . . . . . . . . . . 629
Enabling PEAP-MS-CHAP-V2 offload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
Combining 802.1X Acceleration with pass-through authentication . . . . . . . . 631
Overriding AAA-assigned VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632

Configuring communication with RADIUS . . . . . . . . . . . . . . . . . . . . . . . . 633

RADIUS overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633