Dell PowerConnect W-Clearpass 100 Software Betriebsanweisung PDF herunterladen (Seite 123)

ClearPass Guest 3.9 | Deployment Guide RADIUS Services | 123

Example: Location-Specific VLAN Assignment

In this example, the value of a vendor-specific VLAN attribute will be modified based on the NAS to which

visitors are connecting.

The network has an Aruba wireless controller at 192.168.30.2 which should be configured to place all visitor

traffic into VLAN ID 100. There is another Aruba wireless controller at 192.168.40.2 which should be

configured to place visitor traffic into VLAN ID 200.

1. Create a new role named Sample role

2. Click the Add Attribute tab.

3. Select the Aruba vendor, and then select the Aruba-User-Vlan attribute from the drop-down list. Enter

the following value for the attribute:

<?= GetAttr('NAS-IP-Address') == '192.168.30.2' ? '100' : '200'

4. Select Always from the Condition drop-down list and click the Add Attribute button.

5. Click the Save Changes button to apply the new settings to the role.

Explanation: The GetAttr() function returns the value of an attribute that was supplied to the RADIUS

server with the Access-Request. Here, the NAS-IP-Address attribute is retrieved, which will contain the IP

address of the NAS making the RADIUS request. PHP’s ternary operator (?:) is used to check if the NAS is

192.168.30.2; if it is, then 100 is returned as the VLAN ID. In all other cases, the value 200 is returned as the

VLAN ID.

Multiple ternary statements can be nested in parentheses to allow more than two values to be checked. For

example, to check against three values, and return a default value if none of the values are matched, use a

PHP expression like the following:

(GetAttr('NAS-IP-Address') == 'value1' ? 'result1' : (GetAttr('NAS-IP-Address') ==

'value2' ? 'result2' : (GetAttr('NAS-IP-Address') == 'value3' ? 'result3' :

'default_value')))

Configuring MAC Caching During User Authentication

You can control MAC caching during user authentication without having to write complex expressions

within the role.

To configure MAC device caching for a role during user authentication:

1. Go to RADIUS > User Roles and click the role’s row, then click its Edit link. The RADIUS Role Editor

form opens.

2. In the MAC Cache area at the bottom of the form, mark the Enabled check box. The form expands to

include options for the role override, expiration, and device limit settings.

1 2 ... 118 119 120 121 122 123 124 125 126 127 128 ... 517 518

Keine Kommentare

Dell PowerConnect W-Clearpass 100 Software Betriebsanweisung Seite 123