Configuring and managing security ACLs 513
Nortel WLAN—Security Switch 2300 Series Configuration Guide

Configuring a VLAN and AAA for voice clients

WSS Software requires all clients to be authenticated by RADIUS or the local database, and to be authorized for a
specific VLAN. WSS Software places the user in the authorized VLAN.
• Configure a VLAN for voice clients.
• Disable IGMP snooping in the VLAN. (Disabling this feature is required for SVP.)
• Configure a last-resort-ssid user, and set the user’s VLAN attribute to the name of the VLAN you create for the
voice clients.
• Configure an authentication and authorization rule that matches on the last-resort username and on the voice SSID.
To configure a VLAN and a last-resort user for the voice SSID:
WSS# set vlan 2 name v1 port 3
WSS# set igmp disable vlan v1
WSS# set authentication last-resort ssid phones local
WSS# set user last-resort-phones attr vlan-name v1
The set vlan and set igmp commands create VLAN v1 and add the uplink port to it, then disable IGMP snooping in the
VLAN.
The set authentication command in this example uses the local database to authenticate all users who associate with the
SSID phones. The set user command configures the user last-resort-phones in the local database and assigns the user to
VLAN v1. When a user associates with the SSID, WSS Software appends the SSID name to the last-resort username,
and searches for the last-resort-ssid name.

Configuring an ACL to prioritize voice traffic

WSS Software does not provide priority forwarding for SVP traffic by default. To enable prioritization for SVP traffic,
you must configure an ACL and map it to the both the inbound and outbound directions of the VLAN to which the voice
clients are assigned. The ACL must contain an ACE that matches on IP protocol 119 and marks the IP ToS bits in
matching packets with CoS value 7. When an AP receives a packet with CoS value 7, the AP places the packet in the
voice queue for priority forwarding.
If the VLAN will be shared by other clients, you also need to add an ACE that permits the traffic that is not using IP
protocol 119. Otherwise, the WSS drops this traffic. Every ACL has an implicit ACE at the end that denies all traffic that
does not match any of the other ACEs in the ACL.
After you configure the ACE and map it to the VLAN, you must commit the VLAN to the configuration. The ACL does
not take effect until you map it and commit it.
The following commands configure an ACE to prioritize SVP traffic and map the ACE to the outbound direction of the
voice VLAN:
WSS# set security acl ip SVP permit cos 7 udp 10.2.4.69 255.255.255.255 gt 0 any gt 0
WSS# set security acl ip SVP permit cos 7 119 0.0.0.0 255.255.255.255 0.0.0.0 255.2 55.255.255
WSS# set security acl ip SVP permit 0.0.0.0 255.255.255.255
Note. You can use the same VLAN for other clients. However, it is a best practice to use
the VLAN primarily, if not exclusively, for voice traffic.