Dell W-Series 207 Instant 6.5.1.0-4.3.1.0 User Guide - Page 200

(Instant AP)(wired ap profile )# set-role {{equals|not-equal|starts-with| ends-with|contains} |value-of} (Instant AP)(wired ap profile )# end (Instant AP)# commit apply Example (Instant AP)(config)# wlan ssid-profile Profile1 (Instant AP)(SSID Profile "Profile1")# set-role mac-address-and-dhcp-options matches-regularexpression \bring\b Profile1 (Instant AP)(SSID Profile"Profile1")# end (Instant AP)# commit apply Understanding VLAN Assignment You can assign VLANs to a client based on the following configuration conditions: l The default VLAN configured for the WLAN can be assigned to a client. l If VLANs are configured for a WLAN SSID or an Ethernet port profile, the VLAN for the client can be derived before the authentication, from the rules configured for these profiles. l If a rule derives a specific VLAN, it is prioritized over the user roles that may have a VLAN configured. l The user VLANs can be derived from the default roles configured for 802.1X authentication or MAC authentication. l After client authentication, the VLAN can be derived from Vendor-Specific Attributes (VSA) for RADIUS server authentication. l The DHCP-based VLANs can be derived for captive portal authentication. Instant supports role derivation based on the DHCP option for captive portal authentication. When the captive portal authentication is successful, the role derivation based on the DHCP option assigns a new user role to the guest users, instead of the pre-authenticated role. Vendor-Specific Attributes When an external RADIUS server is used, the user VLAN can be derived from the Dell-User-Vlan VSA. The VSA is then carried in an Access-Accept packet from the RADIUS server. The W-IAP can analyze the return message and derive the value of the VLAN which it assigns to the user. Figure 45 RADIUS Access-Accept Packets with VSA Dell Networking W-Series Instant 6.5.1.0-4.3.1.0 | User Guide Roles and Policies | 200