Concept Guide

206 | Roles and Policies Dell Networking W-Series Instant 6.4.3.1-4.2.0.0 | User Guide
In the Instant UI
To configure machine authentication with role-based access control:
1. In the Access tab of the WLAN wizard (New WLAN or Edit <WLAN-profile>) or wired profile
configuration window (New Wired Network or Edit Wired Network), under Roles, create Machine
auth only and User auth only roles.
2. Configure access rules for these roles by selecting the role, and applying the rule. For more information
on configuring access rules, see Configuring ACL Rules for Network Services on page 189.
3. Select Enforce Machine Authentication and select the Machine auth only and User auth only
roles.
4. Click Finish to apply these changes.
In the CLI
To configure machine and user authentication roles for a WLAN SSID:
(Instant AP)(config)# wlan ssid-profile <name>
(Instant AP)(SSID Profile <name># set-role-machine-auth <machine_only> <user_only>
(Instant AP)(SSID Profile <name># end
(Instant AP)# commit apply
To configure machine and user authentication roles for wired profile:
(Instant AP)(config)# wired-port-profile <name>
(Instant AP)(wired ap profile <name>)# set-role-machine-auth <machine_only> <user_only>
(Instant AP)(wired ap profile <name>)# end
(Instant AP)# commit apply
Configuring Derivation Rules
Instant allows you to configure role and VLAN derivation-rules. You can configure these rules to assign a user
role or VLAN to the clients connecting to an SSID or a wired profile.
Understanding Role Assignment Rule
When an SSID or wired profile is created, a default role for the clients connecting this SSID or wired profile is
assigned. You can assign a user role to the clients connecting to an SSID by any of the following methods. The
role assigned by some methods may take precedence over the roles assigned by the other methods.
RADIUS VSA Attributes
The user role can be derived from Dell Vendor-Specific Attributes (VSA) for RADIUS server authentication. The
role derived from a Dell VSA takes precedence over roles defined by other methods.
MAC-Address Attribute
The first three octets in a MAC address are known as Organizationally Unique Identifier (OUI), and are
purchased from the Institute of Electrical and Electronics Engineers, Incorporated (IEEE) Registration Authority.
This identifier uniquely identifies a vendor, manufacturer, or other organization (referred to by the IEEE as the
“assignee”) globally and effectively reserves a block of each possible type of derivative identifier (such as MAC
addresses) for the exclusive use of the assignee.
W-IAPs use the OUI part of a MAC address to identify the device manufacturer and can be configured to assign
a desired role for users who have completed 802.1X authentication and MAC authentication. The user role can
be derived from the user attributes after a client associates with an AP. You can configure rules that assign a
user role to clients that match a MAC address based criteria. For example, you can assign a voice role to any
client with a MAC address starting a0:a1:a2.