3com WX1200 User Manual

Access — Enabled.

History —Introduced in MSS Version 3.0.

Usage — You can configure different authentication methods for 
different groups of users by “globbing.” (For details, see “User Globs” on 
page 26.) 

You can configure a rule either for wireless access to an SSID, or for wired 
access through a WX switch’s wired authentication port. If the rule is for 
wireless access to an SSID, specify the SSID name or specify any to match 
on all SSID names. If the rule is for wired access, specify wired instead of 
an SSID name.

You cannot configure client authentication that uses both the EAP-TLS 
protocol and one or more RADIUS servers. EAP-TLS authentication is 
supported only on the local WX database. 

If you specify multiple authentication methods in the set authentication 
dot1x command, MSS applies them in the order in which they appear in 
the command, with these results:

If the first method responds with pass or fail, the evaluation is final. 

If the first method does not respond, MSS tries the second method, and so on. 

However, if local appears first, followed by a RADIUS server group, MSS 
overrides any failed searches in the local WX database and sends an 
authentication request to the server group.

If the user does not support 802.1X, MSS attempts to perform MAC 
authentication for the user. In this case, if the switch’s configuration 
contains a set authentication mac command that matches the SSID the 
user is attempting to access and the user’s MAC address, MSS uses the 
method specified by the command. Otherwise, MSS uses local MAC 
authentication by default.

If the username does not match an authentication rule for the SSID the 
user is attempting to access, MSS uses the fallthru authentication type 
configured for the SSID, which can be last-resort, web (for WebAAA), 
or none.