Users Guide

Field Description
Captive Portal
Profile (optional)
This assigns a Captive Portal profile to this role. For more details about Captive Portal
profiles, see Captive Portal Authentication on page 302.
Captive Portal Check
for Accounting
This setting is enabled by default. If disabled, RADIUS accounting is done for an authen-
ticated users irrespective of the captive-portal profile in the role of an authenticated user.
If enabled, accounting is not done as long as the user's role has a captive portal profile on
it. Accounting will start when Auth/XML-Add/CoA changes the role of an authenticated user
to a role which doesn't have captive portal profile.
Max Sessions This parameter configures the maximum number of sessions per user in this role. If the
sessions reach the maximum value, any additional sessions from this user that are
reaching the threshold are blocked till the session usage count for the user falls back
below the configured limit.
The default is 65535. You can configure any value between 0-65535.
To a delete a user role in the WebUI:
1. Navigate to the Configuration > Security > Access Control > User Roles page.
2. Click the Delete button against the role you want to delete.
You cannot delete a user-role that is referenced to profile or server derived role. Deleting a server referenced role
will result in an error. Remove all references to the role and then perform the delete operation.
In the CLI
The commands to associate an access control list (ACL) to a user role vary, depending upon the type of access
control list being associated to that role. User roles are applied globally across all controllers, so ethertype, MAC
and session ACLs can be applied to global user roles. However, routing access lists may vary between locations,
so they are mapped to a user role in a local configuration setting.
To associate the user role with an ethertype, MAC or session ACL, use the command user-role <role> access-
list eth|mac|session <acl>. To associate a user role with a routing ACL, use the routing-policy-map
command.
Assigning User Roles
A client is assigned a user role by one of several methods. A role assigned by one method may take precedence
over one assigned by a different method. The methods of assigning user roles are, from lowest to highest
precedence:
1. The initial user role or VLAN for unauthenticated clients is configured in the AAA profile for a virtual AP (see
Access Points on page 508).
2. The user role can be derived from user attributes upon the client’s association with an AP (this is known as a
user-derived role). You can configure rules that assign a user role to clients that match a certain set of
criteria. For example, you can configure a rule to assign the role VoIP-Phone to any client that has a MAC
address that starts with bytes xx:yy:zz.User-derivation rules are executed before client authentication.
3. The user role can be the default user role configured for an authentication method, such as 802.1X or VPN.
For each authentication method, you can configure a default role for clients who are successfully
authenticated using that method.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Roles and Policies |
382