Using Authentication And Accounting Rules Together; Configuration Producing An Incorrect Processing Order; Configuration For A Correct Processing Order - Nortel 2360 Configuration Manual

Using authentication and accounting rules together

When you use accounting commands with authentication commands and identify users with user wildcards, WSS
Software might not process the commands in the order you entered them. As a result, user authentication or accounting
might not proceed as you intend, or valid users might fail authentication and be shut out of the network.
You can prevent these problems by using duplicate user wildcards for authentication and accounting and entering the
commands in pairs.

Configuration producing an incorrect processing order

For example, suppose you initially set up start-stop accounting as follows for all 802.1X users via RADIUS server
group 1:
WSS# set accounting dot1x ssid mycorp * start-stop group1
success: change accepted.
You then set up PEAP-MS-CHAP-V2 authentication and authorization for all users at EXAMPLE/ at server group 1.
Finally, you set up PEAP-MS-CHAP-V2 authentication and authorization for all users in the local WSS database, with
the intention that EXAMPLE users are to be processed first:
WSS# set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1
success: change accepted.
WSS# set authentication dot1x ssid mycorp * peap-mschapv2 local
success: change accepted.
The following configuration order results. The authentication commands are reversed, and WSS Software processes the
authentication of all 802.1X users in the local database and ignores the command for EXAMPLE/ users.
WSS# show aaa
...
set accounting dot1x ssid mycorp * start-stop group1
set authentication dot1x ssid mycorp * peap-mschapv2 local
set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1

Configuration for a correct processing order

To avoid processing errors for authentication and accounting commands that include order-sensitive user wildcards,
enter the commands for each user wildcard in pairs.
For example, to set accounting and authorization for 802.1X users as you intended in
incorrect processing order" (page
order in which you want them processed:
WSS# set accounting dot1x ssid mycorp EXAMPLE/* start-stop group1
success: change accepted.
WSS# set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1
success: change accepted.
WSS# set accounting dot1x ssid mycorp * start-stop group1
551), enter an accounting and authentication command for each user wildcard in the
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Configuring AAA for network users 551
"Configuration producing an