Owners manual

Configuring Access Rules for a Wired Profile
The Ethernet ports allow third-party devices such as VoIP phones or printers (that support only wired connections) to
connect to the wireless network. You can also configure an Access Control List (ACL) for additional security on the
Ethernet downlink.
If you are creating a new wired profile, complete the WiredSettings and configure VLAN and security parameters,
before defining access rules. For more information, see Configuring Wired Settings on page 112, Configuring VLAN
for a Wired Profile on page 114, and Configuring Security Settings for a Wired Profile on page 115.
You can configure access rules by using the Instant UI or CLI.
In the Instant UI
To configure access rules:
1. In the Access tab, configure the following access rule parameters.
a. Select any of the following types of access control:
l Role-based— Allows the users to obtain access based on the roles assigned to them.
l Unrestricted— Allows the users to obtain unrestricted access on the port.
l Network-based— Allows the users to be authenticated based on access rules specified for a network.
b. If the Role-based access control is selected, perform the following steps:
l Under Roles, select an existing role for which you want to apply the access rules, or click New and add
the required role. The list of roles defined for all networks is displayed under Roles.
The default role with the same name as the network, is automatically defined for each network. The default roles
cannot be modified or deleted.
l Select the access rule associated with a specific role and modify if required. To add a new access rule,
click New in the Access Rules window. You can configure up to 64 access rules. For more information on
configuring access rules, see Configuring AccessRules for Network Services on page 178.
l Configure rules to assign roles for an authenticated client. You can also configure rules to derive VLANs
for the wired network profile. For more information on role assignment rules and VLAN derivation rules, see
Configuring Derivation Rules on page 193 and Configuring VLAN Derivation Rules on page 197.
l Select the Assign pre-authentication role checkbox to add a pre-authentication role that allows some
access to the users before the client authentication.
l Select the Enforce Machine Authentication checkbox, to configure access rights to clients based on
whether the client device supports machine authentication. Select the Machine auth only and User auth
only rules. Machine Authentication is only supported on Windows devices and devices such as iPads.
If Enforce Machine Authentication is enabled, both the device and the user must be authenticated for
the role assignment rule to apply.
2. Click Finish.
In the CLI
To configure access rules for a wired profile:
(Instant AP)(config)# wired-port-profile <name>
(Instant AP)(wired ap profile <name>)# access-rule-name <name>
(Instant AP)(wired ap profile <name>)# end
(Instant AP)# commit apply
To configure role assignment rules:
Aruba Instant 6.4.0.2-4.1 | User Guide Wired Profiles | 116