Owners manual

1. In the Access tab of the WLAN (New WLAN or Edit <WLAN-profile>) or Wired Network configuration (New
Wired Network or Edit Wired Network) window, under Roles, create Machine auth only and User auth
only roles.
2. Configure access rules for these roles by selecting the role, and applying the rule. For more information on
configuring access rules, see Configuring AccessRules for Network Services on page 178.
3. Select Enforce Machine Authentication and select the Machine auth only and User auth only roles.
4. Click Finish to apply these changes.
In the CLI
To configure machine and user authentication roles for a WLAN SSID:
(Instant AP)(config)# wlan ssid-profile <name>
(Instant AP)(SSID Profile <name># set-role-machine-auth <machine-authentication-only> <user-
authentication-only>
(Instant AP)(SSID Profile <name># end
(Instant AP)# commit apply
To configure machine and user authentication roles for wired profile:
(Instant AP)(config)# wired-port-profile <name>
(Instant AP)(wired ap profile <name>)# set-role-machine-auth <machine-authentication-only>
<user-authentication-only>
(Instant AP)(wired ap profile <name>)# end
(Instant AP)# commit apply
Configuring Derivation Rules
Instant allows you to configure role and VLAN derivation-rules. You can configure these rules to assign a user role or
VLAN to the clients connecting to an SSID or a wired profile.
Understanding Role Assignment Rule
When an SSID or wired profile is created, a default role for the clients connecting this SSID or wired profile is
assigned. You can assign a user role to the clients connecting to an SSID by any of the following methods. The role
assigned by some methods may take precedence over the roles assigned by the other methods.
RADIUS VSA Attributes
The user role can be derived from Aruba Vendor-Specific Attributes (VSA) for RADIUS server authentication. The
role derived from an Aruba VSA takes precedence over roles defined by other methods.
MAC-Address Attribute
The first three octets in a MAC address are known as Organizationally Unique Identifier (OUI), and are purchased
from the Institute of Electrical and Electronics Engineers, Incorporated (IEEE) Registration Authority. This identifier
uniquely identifies a vendor, manufacturer, or other organization (referred to by the IEEE as the “assignee”) globally
and effectively reserves a block of each possible type of derivative identifier (such as MAC addresses) for the
exclusive use of the assignee.
IAPs use the OUI part of a MAC address to identify the device manufacturer and can be configures to assign a
desired role for users who have completed 802.1X authentication and MAC authentication. The user role can be
derived from the user attributes after a client associates with an AP. You can configure rules that assign a user role
to clients that match a MAC address based criteria. For example, you can assign a voice role to any client with a
MAC address starting a0:a1:a2.
Aruba Instant 6.4.0.2-4.1 | User Guide Roles and Policies | 193