Authorization - 3Com 3CRWX120695A, 3CRWX440095A Configuration Manual

282 C 13: C
HAPTER ONFIGURING

Authorization

AAA N U
FOR ETWORK SERS
For a user to be successfully authenticated by an 802.1X or WebAAA
rule, the username and password entered by the user must be
configured on the RADIUS servers used by the authentication rule or
in the switch's local database, if the local database is used by the rule.
For a user to be successfully authenticated based on the MAC address
of the user's device, the MAC address must be configured on the
RADIUS servers used by the authentication rule or in the switch's local
database, if the local database is used by the rule. If the MAC address
is configured in the local database, no password is required. However,
since RADIUS requires a password, if the MAC address is on the
RADIUS server, MSS checks for a password. By default, MSS assumes
that the MAC address for a MAC user is also the password.
For a user to be successfully authenticated for last-resort access, the
RADIUS servers or local database (whichever method is used by the
last-resort authentication rule), must contain a user named
last-resort-wired (for wired authentication access) or last-resort-ssid,
where ssid is the SSID requested by the user. If the matching
last-resort user is configured in the local database, no password is
required. However, since RADIUS requires a password, if the matching
last-resort user is on the RADIUS server, MSS checks for the
authorization password, which is 3Com by default.
If the last-resort authentication rule matches on SSID any, which is a
wildcard that matches on any SSID string, the RADIUS servers or local
database must have user last-resort-any, exactly as spelled here.
If the user is authenticated, MSS then checks the RADIUS server or local
database (the same place MSS looked for user information to
authenticate the user) for the authorization attributes assigned to the
user. Authorization attributes specify the network resources the user can
access.
The only required attribute is the Virtual LAN (VLAN) name on which to
place the user. RADIUS and MSS have additional optional attributes. For
example, you can provide further access controls by specifying the times
during which the user can access the network, you can apply inbound
and outbound access control lists (ACLs) to the user's traffic, and so on.
To assign attributes on the RADIUS server, use the standard RADIUS
attributes supported on the server. To assign attributes in the WX
switch's local database, use the MSS vendor-specific attributes (VSAs).