3Com WX4400 Reference Manual page 329

For EAP with Transport Layer Security (EAP-TLS) clients, the format is
username@domain_name. For example, sydney@example.com specifies
the user sydney in the domain name example.com. The
*@marketing.example.com glob specifies all users in the marketing
department at example.com. The user glob
sydney@engineering.example.com specifies the user sydney in the
engineering department at example.com.
5 Click Next.
6 If the authentication rule is disabled, select Enabled.
When a rule is disabled, 3WXM does not add it to the configuration.
7 Select the authentication method(s) in the Available RADIUS Server
Groups list and click Add.
An authentication method specifies where the switch will look for user
information to authenticate users. You can select a RADIUS server group,
LOCAL (the local user database for the switch), or both.
MSS tries the methods in the order they appear in the Current RADIUS
Server Groups list. To reorder the methods, select a method and click Up
or Down.
If you specify a RADIUS server group as the first method and a user is
denied access by the RADIUS server, no authentication and
authorization are attempted with the other methods specified in the
list.
If you specify LOCAL as the first method and a user is not in the local user
database on the WX, authentication and authorization are attempted
with a RADIUS server group if one is defined in the method list.
The authentication methods you select are also used for authorization.
8 Click Next.
9 To enable this accounting rule for the SSID, select Enabled.
By default, accounting rules you configure in 3WXM are disabled, which
means 3WXM does not add the rules to the configuration.
10 Select one of the following record options:
Select Start-Stop to specify that records are sent at the start of a
session and the end of a session.
Select Stop-Only to specify that records are sent only at the end of a
session.
Viewing and Configuring WebAAA Network Access Rules 329