Configuring AAA for network users 613
Nortel WLAN—Security Switch 2300 Series Configuration Guide

Applying security ACLs in a location policy rule

When reassigning security ACL filters, specify whether the filter is an input filter or an output filter, as follows:
• Input filter—Use inacl inacl-name to filter traffic that enters the switch from users via an AP access port or wired
authentication port, or from the network via a network port.
• Output filter—Use outacl outacl-name to filter traffic sent from the switch to users via an AP access port or wired
authentication port, or from the network via a network port.
For example, the following command authorizes users at *.ny.ourfirm.com to access the bld4.tac VLAN, and applies the
security ACL tac_24 to the traffic they receive:
WSS# set location policy permit vlan bld4.tac outacl tac_24 if user eq *.ny.ourfirm.com
The following command authorizes access to users on VLANs with names matching bld4.* and applies security ACLs
svcs_2 to the traffic they send and svcs_3 to the traffic they receive:
WSS# set location policy permit inacl svcs_2 outacl svcs_3 if vlan eq bldg4.*
You can optionally add the suffixes .in and .out to inacl-name and outacl-name for consistency with their usage in
entries stored in the local WSS database.

Displaying and positioning location policy rules

The order of location policy rules is significant. WSS Software checks a location policy rule that is higher in the list
before those lower in the list. Rules are listed in the order in which you create them, unless you move them.
To position location policy rules within the location policy, use before rule-number and modify rule-number in the set
location policy command, or use the clear location policy rule-number command.
For example, suppose you have configured the following location policy rules:
WSS show location policy
Id Clauses
----------------------------------------------------------------
1) deny if user eq *.theirfirm.com
2) permit vl an guest_1 if vlan ne q *.ourfirm. co m
3) permit vlan bld4.tac inacl tac_24.in if user eq *.ny.ourfirm.com
4) permit inacl svcs_2.in outacl svcs_3.out if vlan eq bld g4.*
To move the first rule to the end of the list and display the results, type the following commands:
WSS clear location policy 1
success: clause 1 is removed.
WSS set location policy deny if user eq *.theirfirm.com
WSS show location policy
Id Clauses
----------------------------------------------------------------
1) permit vl an guest_1 if vlan ne q *.ourfirm. co m
2) permit vlan bld4.tac inacl tac_24.in if user eq *.ny.ourfirm.com
3) permit inacl svcs_2.in outacl svcs_3.out if vlan eq bld g4.*
4) deny if user eq *.theirfirm.com