Users Guide

Working with Role Assignment with Machine Authentication Enabled
When you enable machine authentication, there are two additional roles you can define in the 802.1X
authentication profile:
l Machine authentication default machine role
l Machine authentication default user role
While you can select the same role for both options, you should define the roles as per the polices that need to
be enforced. Also, these roles can be different from the 802.1X authentication default role configured in the
AAA profile.
With machine authentication enabled, the assigned role depends upon the success or failure of the machine
and user authentications. In certain cases, the role that is ultimately assigned to a client can also depend upon
attributes returned by the authentication server or server derivation rules configured on the controller.
Table 66 describes role assignment based on the results of the machine and user authentications.
Machine
Auth
Status
User
Auth
Status
Description Role Assigned
Failed Failed Both machine authentication and
user authentication failed. L2
authentication failed.
No role assigned. No access to the
network allowed.
Failed Passed Machine authentication failed (for
example, the machine information is
not present on the server) and user
authentication succeeded. Server-
derived roles do not apply.
Machine authentication default user
role configured in the 802.1X
authentication profile.
Passed Failed Machine authentication succeeded
and user authentication has not been
initiated. Server-derived roles do not
apply.
Machine authentication default
machine role configured in the
802.1X authentication profile.
Passed Passed Both machine and user are
successfully authenticated. If there
are server-derived roles, the role
assigned via the derivation take
precedence. This is the only case
where server-derived roles are
applied.
A role derived from the
authentication server takes
precedence. Otherwise, the 802.1X
authentication default role
configured in the AAA profile is
assigned.
Table 66: Role Assignment for User and Machine Authentication
For example, if the following roles are configured:
l 802.1X authentication default role (in AAA profile): dot1x_user
l Machine authentication default machine role (in 802.1X authentication profile): dot1x_mc
l Machine authentication default user role (in 802.1X authentication profile): guest
Role assignment is as follows:
l If both machine and user authentication succeed, the role is dot1x_user. If there is a server-derived role, the
server-derived role takes precedence.
l If only machine authentication succeeds, the role is dot1x_mc.
Dell Networking W-Series ArubaOS 6.5.x | User Guide 802.1X Authentication | 265