3com WX2200 3CRWX220095A User Manual

C

HAPTER

 21: C

ONFIGURING

 AAA 

FOR

 N

ETWORK

 U

SERS

“Globbing” lets you classify users by username or MAC address for 
different AAA treatments. A user glob is a string used by AAA and IEEE 
802.1X or WebAAA methods to match a user or set of users. MAC 
address globs match authentication methods to a MAC address or set of 
MAC addresses. User globs and MAC address globs can make use of 
wildcards. For details, see “User Globs, MAC Address Globs, and VLAN 
Globs” on page 30.

A user group is a named collection of users or MAC addresses sharing a 
common authorization policy. For example, you might group all users on 
the first floor of building 17 into the group bldg-17-1st-floor, or group all 
users in the IT group into the group infotech-people. 

Authentication rules for wireless access include the SSID name, and must 
match on the SSID name requested by the user for MSS to attempt to 
authenticate the user for that SSID. To make an authentication rule 
match an any SSID string, specify the SSID name as any in the rule.

The following AAA methods are supported by 3Com for 802.1X and 
Web network access mode:

„

Client certificates issued by a certificate authority (CA) for 
authentication.

(For this method, you assign an authentication protocol to a user. For 
protocol details, see “IEEE 802.1X Extensible Authentication Protocol 
Types” on page 446.)

„

The WX local database of usernames and user groups for 
authentication. 

(For configuration details, see “Adding and Clearing Local Users for 
Administrative Access” on page 59, “Authenticating via a Local 
Database” on page 450, and “Adding and Clearing MAC Users and 
User Groups Locally” on page 456.)

„

A named group of RADIUS servers. The WX switch supports up to four 
server groups, which can each contain between one and four servers. 

(For server group details, see “Configuring RADIUS Server Groups” on 
page 524.)