User Database; Authentication Of Terminal/Management User(S); Access Policy - Motorola WS5100 Series Migration Giude

9-2 WS5100 Series Switch Migration Guide
the WS5100 switch processes the EAP messages that it receives. It encapsulates them to RADIUS access
requests and sends it to the configured RADIUS server, in this case the local Radius server.
The RADIUS server investigates the user credentials and the challenge information received in the RADIUS
access request frames. If the user is authorized and authenticated, the wireless client is granted access by
sending a RADIUS access accept frame. This is transmitted to the wireless client in a EAPoL frame format.
Figure 9.1 802.1x EAP Authentication Process

9.1.1 User Database

User Group names and the associated users in each group can be created in the local database. User ID in
the received access requests is mapped to the associated wireless group for the authentication and the
authorization policies.
The WS5100 supports creation of 500 users and 100 groups on its local database. Each group can have a
maximum of 500 users configured.

9.1.2 Authentication of Terminal/Management User(s)

The local radius server can be used to authenticate the management and terminal users. For this, the normal
user with the password should be created in the local database. These users should not be a part of any
group.

9.1.3 Access Policy

Access policies are defined in for a group created in local database. Each user is authorized based on the
access policies defined for the groups to which the user belongs.The access policies allow the administrator
to control the access to a set of users based on the WLANs (essid).
Group to wlan access will be controlled by using Time of the day access policy.
For example, consider User1 who's a part of Group1, which is mapped to wlan1 (i.e. essid of wlan1). When
the user tries to connect to wlan1, the user will be prompted to enter his/her credentials. Once the
authentication and authorization phases are successful then only user1 will be able to access the wlan1, only
for the allowed duration but not any other wlan.