Siemens SCALANCE W1750D UI Configuration Manual page 274

Roles and Policies
15.4 Configuring Derivation Rules
VLAN Assignment Based on Derivation Rules
When an external RADIUS server is used for authentication, the RADIUS server may return
a reply message for authentication. If the RADIUS server supports return attributes, and sets
an attribute value to the reply message, the AP can analyze the return message and match
attributes with a user pre-defined VLAN derivation rule. If the rule is matched, the VLAN
value defined by the rule is assigned to the user. For a complete list of RADIUS server
attributes, see RADIUS Server Authentication with VSA (Page 209).
Figure 15-6 Configuring RADIUS Attributes on the RADIUS Server
User Role
If the VSA and VLAN derivation rules are not matching, then the user VLAN can be derived
by a user role.
VLANs Created for an SSID
If the VSA and VLAN derivation rules are not matching, and the User Role does not contain
a VLAN, the user VLAN can be derived by VLANs configured for an SSID or an Ethernet port
profile.
274
Configuration Manual, 02/2018, C79000-G8976-C451-02
SCALANCE W1750D UI