Configuring Dynamic Vlan Assignment - 3Com WX3000 Series Operation Manual

You can use an arbitrary combination of the above implementations for your AAA scheme configuration.
2) For FTP users
Only authentication is supported for FTP users.
Authentication: RADIUS, local, or HWTACACS.
Follow these steps to configure separate AAA schemes:
To do...
Enter system view
Create an ISP domain and
enter its view, or enter the view
of an existing ISP domain
Configure an authentication
scheme for the ISP domain
Configure an authorization
scheme for the ISP domain
Configure an accounting
scheme for the ISP domain
If a combined AAA scheme is configured as well as the separate authentication, authorization and
accounting schemes, the separate ones will be adopted in precedence.
RADIUS scheme and local scheme do not support the separation of authentication and
authorization. Therefore, pay attention when you make authentication and authorization
configuration for a domain: When the scheme radius-scheme or scheme local command is
executed and the authentication command is not executed, the authorization information returned
from the RADIUS or local scheme still takes effect even if the authorization none command is
executed.

Configuring Dynamic VLAN Assignment

The dynamic VLAN assignment feature enables a device to dynamically add the ports of successfully
authenticated users to different VLANs according to the attributes assigned by the RADIUS server, so
as to control the network resources that different users can access.
Currently, the device supports the following two types of assigned VLAN IDs: integer and string.
Integer: If the RADIUS authentication server assigns integer type of VLAN IDs, you can set the
VLAN assignment mode to integer on the device (this is also the default mode on the device). Then,
Use the command...
system-view
domain isp-name
authentication
{ radius-scheme
radius-scheme-name [ local ] |
hwtacacs-scheme
hwtacacs-scheme-name
[ local ] | local | none }
authorization { none |
hwtacacs-scheme
hwtacacs-scheme-name }
accounting { none |
radius-scheme
radius-scheme-name |
hwtacacs-scheme
hwtacacs-scheme-name }
2-5
Remarks
—
Required
Optional
By default, no separate
authentication scheme is
configured.
Optional
By default, no separate
authorization scheme is
configured.
Optional
By default, no separate
accounting scheme is
configured.