In the Instant UI
To configure access rules:
1. On the
Access
tab, configure the following access rule parameters.
a. Select any of the following types of access control:
l
Role-based
—Allows the users to obtain access based on the roles assigned to them.
l
Unrestricted
—Allows the users to obtain unrestricted access on the port.
l
Network-based
—Allows the users to be authenticated based on access rules specified for a
network.
b. If the
Role-based
access control is selected, perform the following steps:
l
Under
Roles
, select an existing role for which you want to apply the access rules, or click
New
and
add the required role. The list of roles defined for all networks is displayed under
Roles
.
The default role with the same name as the network is automatically defined for each network. The default
roles cannot be modified or deleted.
l
Select the access rule associated with a specific role and modify if required. To add a new access rule,
click
New
in the
Access Rules
window. You can configure up to 64 access rules. For more
information on configuring access rules, see
Configuring ACL Rules for Network Services on page 182
.
l
Configure rules to assign roles for an authenticated client. You can also configure rules to derive
VLANs for the wired network profile. For more information on role assignment rules and VLAN
derivation rules, see
Configuring Derivation Rules on page 201
and
.
l
Select the
Assign pre-authentication role
check box to add a pre-authentication role that allows
some access to the users before client authentication.
l
Select the
Enforce Machine Authentication
check box, to configure access rights to clients based
on whether the client device supports machine authentication. Select the
Machine auth only
and
User auth only
rules. Machine Authentication is only supported on Windows devices and devices
such as iPads.
If
Enforce Machine Authentication
is enabled, both the device and the user must be
authenticated for the role assignment rule to apply.
2. Click
Finish
.
In the CLI
To configure access rules for a wired profile:
(Instant AP)(config)# wired-port-profile <name>
(Instant AP)(wired ap profile <name>)# access-rule-name <name>
(Instant AP)(wired ap profile <name>)# end
(Instant AP)# commit apply
To configure role assignment rules:
(Instant AP)(config)# wired-port-profile <name>
(Instant AP)(wired ap profile <name>)# set-role <attribute>{{equals|not-equal|starts-with|
ends-with|contains|matches-regular-expression}<operator> <role>|value-of}
(Instant AP)(wired ap profile <name>)# end
(Instant AP)# commit apply
To configure a pre-authentication role:
(Instant AP)(config)# wired-port-profile <name>
(Instant AP)(wired ap profile <name>)# set-role-pre-auth <role>
Aruba Instant 6.5.0.0-4.3.0.0 | User Guide
Wired Profiles |
112
