Nortel Networks NN47250-500 Using authentication and accounting rules together

Configuring AAA for network users 623
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Using authentication and accounting rules together
When you use accounting commands with authentication commands and identify users with user wildcards, WSS
Software might not process the commands in the order you entered them. As a result, user authentication or accounting
might not proceed as you intend, or valid users might fail authentication and be shut out of the network.
You can prevent these problems by using duplicate user wildcards for authentication and accounting and entering the
commands in pairs.
Configuration producing an incorrect processing order
For example, suppose you initially set up start-stop accounting as follows for all 802.1X users via RADIUS server
group 1:
WSS# set accounting dot1x ssid mycorp * start-stop group1
success: change accepted.
You then set up PEAP-MS-CHAP-V2 authentication and authorization for all users at EXAMPLE/ at server group 1.
Finally, you set up PEAP-MS-CHAP-V2 authentication and authorization for all users in the local WSS database, with
the intention that EXAMPLE users are to be processed first:
WSS# set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1
success: change accepted.
WSS# set authentication dot1x ssid mycorp * peap-mschapv2 local
success: change accepted.
The following configuration order results. The authentication commands are reversed, and WSS Software processes the
authentication of all 802.1X users in the local database and ignores the command for EXAMPLE/ users.
WSS# show aaa
...
set accounting dot1x ssid mycorp * st art-stop group1
set authentication dot1x ssid mycorp * peap-m schapv2 local
set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 gro up1
Configuration for a correct processing order
To avoid processing errors for authentication and accounting commands that include order-sensitive user wildcards,
enter the commands for each user wildcard in pairs.
For example, to set accounting and authorization for 802.1X users as you intended in “Configuration producing an
incorrect processing order” on page 623, enter an accounting and authentication command for each user wildcard in the
order in which you want them processed:
WSS# set accounting dot1x ssid mycorp EXAMPLE/* start-stop group1
success: change accepted.
WSS# set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1
success: change accepted.
WSS# set accounting dot1x ssid mycorp * start-stop group1