Concept Guide

(Instant AP)(wired ap profile <name>)# set-role <attribute>{{equals|not-equal|starts-with|
ends-with|contains}<operator> <role>|value-of}
(Instant AP)(wired ap profile <name>)# end
(Instant AP)# commit apply
Example
(Instant AP)(config)# wlan ssid-profile Profile1
(Instant AP)(SSID Profile "Profile1")# set-role mac-address-and-dhcp-options matches-regular-
expression \bring\b Profile1
(Instant AP)(SSID Profile"Profile1")# end
(Instant AP)# commit apply
Understanding VLAN Assignment
You can assign VLANs to a client based on the following configuration conditions:
l The default VLAN configured for the WLAN can be assigned to a client.
l If VLANs are configured for a WLAN SSID or an Ethernet port profile, the VLAN for the client can be derived
before the authentication, from the rules configured for these profiles.
l If a rule derives a specific VLAN, it is prioritized over the user roles that may have a VLAN configured.
l The user VLANs can be derived from the default roles configured for 802.1X authentication or MAC
authentication.
l After client authentication, the VLAN can be derived from Vendor-Specific Attributes (VSA) for RADIUS
server authentication.
l The DHCP-based VLANs can be derived for captive portal authentication.
Instant supports role derivation based on the DHCP option for captive portal authentication. When the
captive portal authentication is successful, the role derivation based on the DHCP option assigns a new user
role to the guest users, instead of the pre-authenticated role.
Vendor-Specific Attributes
When an external RADIUS server is used, the user VLAN can be derived from the Dell-User-Vlan VSA. The VSA
is then carried in an Access-Accept packet from the RADIUS server. The W-IAP can analyze the return message
and derive the value of the VLAN which it assigns to the user.
Figure 45 RADIUS Access-Accept Packets with VSA
Dell Networking W-Series Instant 6.5.1.0-4.3.1.0 | User Guide Roles and Policies | 200