Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide 802.1x Authentication | 261
known as machine authentication. Machine authentication ensures that only authorized devices are allowed on
the network.
You can configure 802.1x for both user and machine authentication (select the Enforce Machine Authentication
option described in Table 52 on page 255). This tightens the authentication process further since both the device
and user need to be authenticated.
Role Assignment with Machine Authentication Enabled
When you enable machine authentication, there are two additional roles you can define in the 802.1x
authentication profile:
z Machine authentication default machine role
z Machine authentication default user role
While you can select the same role for both options, you should define the roles as per the polices that need to be
enforced. Also, these roles can be different from the 802.1x authentication default role configured in the AAA
profile.
With machine authentication enabled, the assigned role depends upon the success or failure of the machine and
user authentications. In certain cases, the role that is ultimately assigned to a client can also depend upon
attributes returned by the authentication server or server derivation rules configured on the controller.
Table 53 describes role assignment based on the results of the machine and user authentications.
For example, if the following roles are configured:
z 802.1x authentication default role (in AAA profile): dot1x_user
z Machine authentication default machine role (in 802.1x authentication profile): dot1x_mc
z Machine authentication default user role (in 802.1x authentication profile): guest
Role assignments would be as follows:
z If both machine and user authentication succeed, the role is dot1x_user. If there is a server-derived role, the
server-derived role takes precedence.
z If only machine authentication succeeds, the role is dot1x_mc.
z If only user authentication succeeds, the role is guest.
z On failure of both machine and user authentication, the user does not have access to the network.
Table 53 Role Assignment for User and Machine Authentication
Machine
Auth
Status
User
Auth
Status
Description Role Assigned
Failed Failed Both machine authentication and user authentication
failed. L2 authentication failed.
No role assigned. No access to the
network allowed.
Failed Passed Machine authentication fails (for example, the machine
information is not present on the server) and user
authentication succeeds. Server-derived roles do not
apply.
Machine authentication default user role
configured in the 802.1x authentication
profile.
Passed Failed Machine authentication succeeds and user
authentication has not been initiated. Server-derived
roles do not apply.
Machine authentication default machine
role configured in the 802.1x
authentication profile.
Passed Passed Both machine and user are successfully authenticated.
If there are server-derived roles, the role assigned via
the derivation take precedence. This is the only case
where server-derived roles are applied.
A role derived from the authentication
server takes precedence. Otherwise, the
802.1x authentication default role
configured in the AAA profile is assigned.