Nortel 2350 Mode D'Emploi
Configuring AAA for network users 529
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Assigning SSID default attributes to a service profile
You can configure a service profile with a set of default AAA authorization attributes that are used when the
normal AAA process or a location policy does not provide them. These authorization attributes are applied by
default to users accessing the SSID managed by the service profile.
normal AAA process or a location policy does not provide them. These authorization attributes are applied by
default to users accessing the SSID managed by the service profile.
Use the following command to assign an authorization attribute to a service profile and specify its value:
set service-profile name attr attribute-name value
By default, a service profile contains no SSID default authorization attributes. When specified, attributes in a
service profile are applied in addition to any attributes supplied for the user by the RADIUS server or the local
database. When the same attribute is specified both as an SSID default attribute and through AAA, then the
attribute supplied by the RADIUS server or the local database takes precedence over the SSID default
attribute. If a location policy is configured, the location policy takes precedence over both AAA and SSID
default attributes. The SSID default attributes serve as a fallback when neither the AAA process, nor a location
policy, provides them.
service profile are applied in addition to any attributes supplied for the user by the RADIUS server or the local
database. When the same attribute is specified both as an SSID default attribute and through AAA, then the
attribute supplied by the RADIUS server or the local database takes precedence over the SSID default
attribute. If a location policy is configured, the location policy takes precedence over both AAA and SSID
default attributes. The SSID default attributes serve as a fallback when neither the AAA process, nor a location
policy, provides them.
For example, a service profile might be configured with the service-type attribute set to 2. If a user accessing
the SSID is authenticated by a RADIUS server, and the RADIUS server returns the vlan-name attribute set to
orange, then that user will have a total of two attributes set: service-type and vlan-name.
the SSID is authenticated by a RADIUS server, and the RADIUS server returns the vlan-name attribute set to
orange, then that user will have a total of two attributes set: service-type and vlan-name.
If the service profile is configured with the vlan-name attribute set to blue, and the RADIUS server returns the
vlan-name attribute set to orange, then the attribute from the RADIUS server takes precedence; the user is
placed in the orange VLAN.
vlan-name attribute set to orange, then the attribute from the RADIUS server takes precedence; the user is
placed in the orange VLAN.
You can display the attributes for each connected user and whether they are set through AAA or through SSID
defaults by entering the show sessions network verbose command. You can display the configured SSID
defaults by entering the show service-profile command.
defaults by entering the show sessions network verbose command. You can display the configured SSID
defaults by entering the show service-profile command.
All of the authorization attributes listed in
ssid.