Users Guide

196| Authentication Servers Dell Networking W-Series ArubaOS 6.5.x| User Guide
l <user>@<domain> : the @<domain> portion is truncated
This option does not support client information sent in the format host/<pc-name>.<domain>
Using the WebUI
1. Navigate to the Configuration > Security > Authentication > Servers page.
2. Select Server Group to display the Server Group list.
3. Enter the name of the new server group and click Add.
4. Select the name to configure the server group.
5. Under Servers, click Edit for a configured server or click New to add a server to the group.
l If editing a configured server, select Trim FQDN, scroll right, and click Update Server.
l If adding a new server, select a server from the drop-down list, then select Trim FQDN, scroll right, and
click Add Server.
6. Click Apply.
Using the CLI
(host)(config) #aaa server-group corp-serv
auth-server radius-2 match-authstring contains abc.corpnet.com trim-fqdn
Configuring Server-Derivation Rules
When you configure a server group, you can set the VLAN or role for clients based on attributes returned for
the client by the server during authentication. The server derivation rules apply to all servers in the group. The
user role or VLAN assigned through server derivation rules takes precedence over the default role and VLAN
configured for the authentication method.
The authentication servers must be configured to return the attributes for the clients during authentication. For
instructions on configuring the authentication attributes in a Windows environment using IAS, refer to the
documentation at
technet2.microsoft.com/windowsserver/en/technologies/ias.mspx
The server rules are applied based on the first match principle. The first rule that is applicable for the server and
the attribute returned is applied to the client, and would be the only rule applied from the server rules. These
rules are applied uniformly across all servers in the server group.
Table 44 describes the server rule parameters you can configure.
Parameter Description
Role or VLAN The server derivation rules apply to either user role or VLAN assignment. With
Role assignment, a client can be assigned a specific role based on the
attributes returned. In VLAN assignment, the client can be placed in a specific
VLAN based on the attributes returned.
Attribute This is the attribute returned by the authentication server that is examined for
Operation and Operand match.
Operation This is the match method by which the string in Operand is matched with the
attribute value returned by the authentication server.
Table 44: Server Rule Configuration Parameters