Assigning A Security Acl To A User Or A Group; Assigning A Security Acl Locally - Nortel 2360 Configuration Manual

530 Configuring AAA for network users

Assigning a security ACL to a user or a group

Once a security access control list (ACL) is defined and committed, it can be applied dynamically and auto-
matically to users and user groups through the 802.1X authentication and authorization process. When you
assign a Filter-Id attribute to a user or group, the security ACL name value is entered as an authorization
attribute into the user or group record in the local WSS database or RADIUS server.
Note.
If the Filter-Id value returned through the authentication and authorization process
does not match the name of a committed security ACL in the WSS, the user fails
authorization and cannot be connected.
(For details about security ACLs, see

Assigning a security ACL locally

To use the local WSS database to restrict a user, a MAC user, or a group of users or MAC users to the permis-
sions stored within a committed security ACL, use the following commands:
Security ACL Target
User authenticated by a
password
Group of users
authenticated by a
password
User authenticated by a
MAC address
Group of users
authenticated by a MAC
address
You can set filters for incoming and outgoing packets:
• Use acl-name.in to filter traffic that enters the WSS from users via an AP access port or wired
authentication port, or from the network via a network port.
• Use acl-name.out to filter traffic sent from the WSS to users via an AP access port or wired
authentication port, or from the network via a network port.
For example, the following command applies security ACL acl-101 to packets coming into the WSS from user
Jose:
WSS# set user Jose attr filter-id acl-101.in
success: change accepted.
NN47250-500 (320657-F Version 02.01)
"Configuring and managing security ACLs" (page
Commands
set user username attr filter-id acl-name.in
set user username attr filter-id acl-name.out
set usergroup groupname attr filter-id acl-name.in
set usergroup groupname attr filter-id acl-name.out
set mac-user username attr filter-id acl-name.in
set mac-user username attr filter-id acl-name.out
set mac-usergroup groupname attr filter-id
acl-name.in
set mac-usergroup groupname attr filter-id
acl-name.out
407).)