D-Link DWS-1008 User Manual page 309

DWS-1008 User's Manual
How the Location Policy Differs from a Security ACL
Although structurally similar, the location policy and security ACLs have different functions.
The location policy on a switch can be used to locally redirect a user to a different VLAN or
locally control the traffic to and from a user.
In contrast, security ACLs are packet filters applied to the user throughout a MobileLAN.
You can use the location policy to locally apply a security ACL to a user.
Setting the Location Policy
To enable the location policy function on a switch, you must create at least one location
policy rule with one of the following commands:
set location policy deny if {ssid operator ssid-name | vlan operator vlan-glob | user
operator user-glob | port port-list | dap dap-num}
[before rule-number | modify rule-number]
set location policy permit {vlan vlan-name | inacl inacl-name | outacl outacl-name} if
{ssid operator ssid-name | vlan operator vlan-glob | user operator user-glob | port port-list
| dap dap-num}
[before rule-number | modify rule-number]
You must specify whether to permit or deny access, and you must identify a VLAN,
username, or access port to match. Use one of the following operators to specify how the
rule must match the VLAN or username:
• eq - Applies the location policy rule to all users assigned VLAN names matching
vlan-glob or having usernames that match user-glob.
(Like a user glob, a VLAN glob is a way to group VLANs for use in this command.)
• neq - Applies the location policy rule to all users assigned VLAN names not matching
vlan-glob or having usernames that do not match user-glob.
For example, the following command denies network access to all users matching
*.theirfirm.com, causing them to fail authorization:
DWS-1008# set location policy deny if user eq *.theirfirm.com
The following command authorizes access to the guest_1 VLAN for all users who do not
match *.ourfirm.com:
DWS-1008# set location policy permit vlan guest_1 if user neq *.ourfirm.com
The following command places all users who are authorized for SSID tempvendor_a into
VLAN kiosk_1:
DWS-1008# set location policy permit vlan kiosk_1 if ssid eq tempvendor_a
success: change accepted.
D-Link Systems, Inc.
Configuring AAA for Network Users
304