Configuring Last-Resort Access - D-Link DWS-1008 User Manual

DWS-1008 User's Manual
Configuring Last-Resort Access
Users who are not authenticated and authorized by 802.1X methods or a MAC address can
gain limited access to the network as guest users. You can optionally configure a special
username called last-resort-wired (for wired authentication access) or last-resort-ssid, where
ssid is the SSID requested by the user. To match on the wildcard SSID name any, configure
user last-resort-any, exactly as spelled here.
To configure a last-resort authentication rule, use the following command:
set authentication last-resort {ssid ssid-name | wired} method1 [method2] [method3]
[method4]
For example, to enable wireless users who request SSID guestssid to join the network on
VLAN k3, type the following commands:
DWS-1008# set authentication last-resort ssid guestssid local
success: change accepted
DWS-1008# set user last-resort-guestssid attr vlan-name k3
success: change accepted
Note: Although MSS allows you to configure a user password for a last-resort user, the password
has no effect. Last-resort users can never access a DWS-1008 switch in administrative mode
and never require a password when authorized locally. However, if the last-resort user is
authorized on a RADIUS server, the server might require a password. In this case, use the
authorization password set on the switch, which is dlink by default.
Last-resort users configured on a RADIUS server require a password. Specify the authorization
password (dlink by default.) To change the password, see Changing the MAC Authorization
Password for RADIUS. This procedure also applies for last-resort users.
To ensure that your commands are configured, type the following command:
DWS-1008# show aaa
...
set authentication last-resort ssid guestssid local
...
user last-resort-guestssid
vlan-name = k3
D-Link Systems, Inc.
Configuring AAA for Network Users
289