Nortel Networks NN47250-500 Setting the location policy

612 Configuring AAA for network users
NN47250-500 (Version 03.01)
Setting the location policy
To enable the location policy function on a WSS, you must create at least one location policy rule with one of
the following commands:
set location policy deny if {ssid operator ssid-name | vlan operator vlan-wildcard | user
operator user-wildcard | port port-list | ap ap-num}
[before rule-number | mo dify rule-number]
set location policy permit {vlan vlan-name | inacl inacl-name | outacl outacl-name} if
{ssid operator ssid-name | vlan operator vlan-wildcard | user operator user-wildcard
| port port-list | ap ap-num}
[before rule-number | mo dify rule-number]
You must specify whether to permit or deny access, and you must identify a VLAN, username, or access port
to match. Use one of the following operators to specify how the rule must match the VLAN or username:
•eq—Applies the location policy rule to all users assigned VLAN names matching vlan-wildcard or
having usernames that match user-wildcard.
(Like a user wildcard, a VLAN wildcard is a way to group VLANs for use in this command.
For more information, see “VLAN wildcards” on page 48.)
•neq—Applies the location policy rule to all users assigned VLAN names not matching vlan-wildcard or
having usernames that do not match user-wildcard.
For example, the following command denies network access to all users matching *.theirfirm.com, causing
them to fail authorization:
WSS# set location policy deny if user eq *.theirfirm.com
The following command authorizes access to the guest_1 VLAN for all users who do not match
*.ourfirm.com:
WSS# set location policy permit vlan guest_1 if user neq *.ourfirm.com
The following command places all users who are authorized for SSID tempvendor_a into VLAN kiosk_1:
WSS# set location policy permit vlan kiosk_1 if ssid eq tempvendor_a
success: change accepted.
Note. Asterisks (wildcards) are not supported in SSID names. You must specify the
complete SSID name.