Dell W-Series 314 Instant 6.4.3.1-4.2 User Guide - Page 206

In the Instant UI To configure machine authentication with role-based access control: 1. In the Access tab of the WLAN wizard (New WLAN or Edit ) or wired profile configuration window (New Wired Network or Edit Wired Network), under Roles, create Machine auth only and User auth only roles. 2. Configure access rules for these roles by selecting the role, and applying the rule. For more information on configuring access rules, see Configuring ACL Rules for Network Services on page 189. 3. Select Enforce Machine Authentication and select the Machine auth only and User auth only roles. 4. Click Finish to apply these changes. In the CLI To configure machine and user authentication roles for a WLAN SSID: (Instant AP)(config)# wlan ssid-profile (Instant AP)(SSID Profile # set-role-machine-auth (Instant AP)(SSID Profile # end (Instant AP)# commit apply To configure machine and user authentication roles for wired profile: (Instant AP)(config)# wired-port-profile (Instant AP)(wired ap profile )# set-role-machine-auth (Instant AP)(wired ap profile )# end (Instant AP)# commit apply Configuring Derivation Rules Instant allows you to configure role and VLAN derivation-rules. You can configure these rules to assign a user role or VLAN to the clients connecting to an SSID or a wired profile. Understanding Role Assignment Rule When an SSID or wired profile is created, a default role for the clients connecting this SSID or wired profile is assigned. You can assign a user role to the clients connecting to an SSID by any of the following methods. The role assigned by some methods may take precedence over the roles assigned by the other methods. RADIUS VSA Attributes The user role can be derived from Dell Vendor-Specific Attributes (VSA) for RADIUS server authentication. The role derived from a Dell VSA takes precedence over roles defined by other methods. MAC-Address Attribute The first three octets in a MAC address are known as Organizationally Unique Identifier (OUI), and are purchased from the Institute of Electrical and Electronics Engineers, Incorporated (IEEE) Registration Authority. This identifier uniquely identifies a vendor, manufacturer, or other organization (referred to by the IEEE as the "assignee") globally and effectively reserves a block of each possible type of derivative identifier (such as MAC addresses) for the exclusive use of the assignee. W-IAPs use the OUI part of a MAC address to identify the device manufacturer and can be configured to assign a desired role for users who have completed 802.1X authentication and MAC authentication. The user role can be derived from the user attributes after a client associates with an AP. You can configure rules that assign a user role to clients that match a MAC address based criteria. For example, you can assign a voice role to any client with a MAC address starting a0:a1:a2. 206 | Roles and Policies Dell Networking W-Series Instant 6.4.3.1-4.2.0.0 | User Guide