Reference Guide

53 | aaa derivation-rules Dell PowerConnect ArubaOS 6.0 Command Line Interface | Reference Guide
aaa derivation-rules
aaa derivation-rules user <name>
no ...
set {role|vlan} condition <rule-type> <condition> <value> set-value {<role>|<vlan>}
[description <rule description>][position <number>]
Description
This command configures rules by which the role or VLAN assigned to a client is derived from the client’s
association with an AP.
The PEFNG must be installed for a user role to be assigned.
Syntax
Usage Guidelines
The user role can be derived from attributes from the client’s association with an AP. You configure the user role
to be derived by specifying condition rules; when a condition is met, the specified user role is assigned to the
client. You can specify more than one condition rule; the order of rules is important as the first matching
condition is applied. You can also add a description of the rule.
User-derivation rules are executed before the client is authenticated.
Example
The following command sets the client’s user role to “guest” if the client associates to the “Guest” ESSID. The
rule description indicates that is was created for special customers.
Parameter Description
<name> Name that identifies this set of user derivation rules.
no Negates a configured rule.
set {role|vlan} Specify whether the action of the rule is to set the role or the VLAN.
condition Condition that should be checked to derive role/VLAN
<rule-type> Specify one of the following rule types for this user derivation rule.
z bssid: BSSID of access point.
z dhcp-option-77: Enable DHCP packet processing.
z encryption-type: Encryption method used by station.
z essid: ESSID of access point.
z location: user location (ap name).
z macaddr: MAC address of user.
<condition> Specify one of the following conditions:
z contains: Check if attribute contains the operand value.
z ends-with: Check if attribute ends with the operand value.
z equals: Check if attribute equals the operand value.
z not-equals: Check if attribute is not equal to the operand value.
z starts-with: Check if attribute starts with the operand value.
set-value
<role>|<vlan>
Specify the user role or VLAN ID to be assigned to the client if the above condition is met.
description
Describes the user derivation rule. This parameter is optional and has a 128 character
maximum.
position
Position of this rule relative to other rules that are configured.