Owners manual

194 | Roles and Policies Aruba Instant 6.4.0.2-4.1 | User Guide
Roles Based on Client Authentication
The user role can be the default user role configured for an authentication method, such as 802.1x authentication. For
each authentication method, you can configure a default role for clients who are successfully authenticated using
that method.
DHCP Option and DHCP Fingerprinting
The DHCP fingerprinting allows you to identify the operating system of a device by looking at the options in the
DHCP frame. Based on the operating system type, a role can be assigned to the device.
For example, to create a role assignment rule with the DHCP option, select equals from the Operator drop-down
list and enter 370103060F77FC in the String text box. Since 370103060F77FC is the fingerprint for Apple iOS
devices such as iPad and iPhone, IAP assigns Apple iOS devices to the role that you choose.
Device DHCP Option DHCP Fingerprint
Apple iOS Option 55 370103060F77FC
Android Option 60 3C64686370636420342E302E3135
Blackberry Option 60 3C426C61636B4265727279
Windows 7/Vista Desktop Option 55 37010f03062c2e2f1f2179f92b
Windows XP(SP3, Home,
Professional)
Option 55 37010f03062c2e2f1f21f92b
Windows Mobile Option 60 3c4d6963726f736f66742057696e646f777320434500
Windows 7 Phone Option 55 370103060f2c2e2f
Apple Mac OSX Option 55 370103060f775ffc2c2e2f
Table 37: Validated DHCP Fingerprint
Creating a Role Derivation Rule
You can configure rules for determining the role that is assigned for each authenticated client.
When creating more than one role assignment rule, the first matching rule in the rule list is applied.
You can create a role assignment rules by using the Instant UI or CLI.
In the Instant UI
1. Navigate to the WLAN wizard or Wired settings window:
l To configure access rules for a WLANSSID, in the Network tab, click New to create a new network profile or
edit to modify an existing profile.
l To configure access rules for a wired profile, More > Wired. In the Wired window, click New under Wired
Networks to create a new network or click Edit to select an existing profile.
2. Click the Access tab.
3. Under Role Assignment Rules, click New. The New Role Assignment window allows you to define a match
method by which the string in Operand is matched with the attribute value returned by the authentication server.