Users Guide

286 | Roles and Policies Dell PowerConnect ArubaOS 5.0 | [User Guide
1. Navigate to the Configuration > Security > Access Control > User Roles page.
2. Select Edit for the web-guest user role.
3. In the Bandwidth Contract section, click the Upstream drop-down list and select Add New. The New
Bandwidth Contract fields appear.
a. In the Name field, enter BC512_up.
b. In the Bandwidth field, enter 512.
c. Click the Bandwidth drop-down list and select kbps.
d. Click Done to add the new contract and assign it to the role. The New Bandwidth Contract section closes.
4. In the Bandwidth Contract section, select the Per User checkbox.
5. Scroll to the bottom of the page, and click Apply.
Configuring and Assigning Bandwidth Contracts in the CLI
aaa bandwidth-contract BC512_up kbps 512
user-role web-guest
bw-contract BC512_up per-user upstream
User Role Assignments
A client is assigned a user role by one of several methods. A user role assigned by one method may take
precedence over a user role assigned by a different method. The methods of assigning user roles are, from lowest
to highest precedence:
1. The initial user role for unauthenticated clients is configured in the AAA profile for a virtual AP (see Chapter
4, “Access Points” ).
2. The user role can be derived from user attributes upon the client’s association with an AP (this is known as a
user-derived role). You can configure rules that assign a user role to clients that match a certain set of criteria.
For example, you can configure a rule to assign the role “VoIP-Phone” to any client that has a MAC address
that starts with bytes xx:yy:zz. User-derivation rules are executed before client authentication.
3. The user role can be the default user role configured for an authentication method, such as 802.1x or VPN.
For each authentication method, you can configure a default role for clients who are successfully
authenticated using that method.
4. The user role can be derived from attributes returned by the authentication server and certain client attributes
(this is known as a server-derived role). If the client is authenticated via an authentication server, the user role
for the client can be based on one or more attributes returned by the server during authentication, or on client
attributes such as SSID (even if the attribute is not returned by the server). Server-derivation rules are
executed after client authentication.
5. The user role can be derived from Dell Vendor-Specific Attributes (VSA) for RADIUS server authentication.
A role derived from an Dell VSA takes precedence over any other user roles.
The following sections describe the methods of assigning user roles.
User Role in AAA Profile
An AAA profile defines the user role for unauthenticated clients (initial role) as well as the default user role for
MAC and 802.1x authentication. To conconfigure user roles in the AAA profile:
In the WebUI
1. Navigate to the Configuration > Security > Authentication > AAA Profiles page.
2. Select the “default” profile or a user-defined AAA profile.
3. Click the Initial Role drop-down list, and select the desired user role for unauthenticated users.