Users Guide

294 | Stateful and WISPr Authentication Dell PowerConnect ArubaOS 5.0 | [User Guide
If, however, the client only has an account with a partner ISP, then your ISP’s WISPr AAA server will forward that
client’s credentials to the partner ISP’s WISPr AAA server for authentication. Once the client has been
authenticated on the partner ISP, it will be authenticated on your hotspot’s own ISP, as per their service
agreements. Once your ISP sends an authentication message to the controller, the controller assigns the default
WISPr user role to that client.
ArubaOS supports the following smart clients, which enable client authentication and roaming between hotspots
by embedding iPass Generic Interface Specification (GIS) redirect, proxy, authentication and logoff messages
within HTLM messages to the controller.
z iPass
z Bongo
z Trustive
z weRoam
z AT&T
Important Points to Remember
Before you can configure a stateful authentication feature, you should have defined a user role you want to assign
to the authenticated users, and created a server group that includes a RADIUS authentication server for stateful
802.1x authentication or a Windows server for stateful NTLM authentication. For details on performing these
tasks, see the following sections of this User Guide:
z “Roles and Policies” on page279
z “Configuring a RADIUS Server” on page232
z “Configuring a Windows Server” on page235
z “Server Groups” on page239
You can use the default stateful NTLM authentication and WISPr authentication profiles to manage the settings
for these features, or you can create additional profiles as desired. Note, however, that unlike most other types of
authentication, stateful 802.lx authentication uses only a single Stateful 802.1x profile. This profile can be
enabled or disabled, but you can not configure more than one instance of a Stateful 802.1x profile.
Stateful 802.1x Authentication
When you configure 802.1x authentication for clients on non-Dell APs, you must specify the group of RADIUS
servers that will perform the user authentication, and select the role to be assigned to those users who successfully
complete authentication. When the user logs off or shuts down the client machine, ArubaOS will note the
deauthentication message from the RADIUS server, and will change the user’s role from the specified
authenticated role back to the logon role. For details on defining a RADIUS server used for stateful 802.1x
authentication, see “Configuring a RADIUS Server” on page232
Configure Authentication via the WebUI
To configure the Stateful 802.1x Authentication profile via the WebUI:
1. Navigate to the Configuration > Security > Authentication > L2 Authentication window.
2. In the Profiles list, select Stateful 802.1x Authentication Profile.
3. Click the Default Role drop-down list, and select the role that will be assigned to stateful 802.1x
authenticated users.
4. Specify the timeout period for authentication requests, from 1-20 seconds. The default value is 10 seconds.
5. Select the Mode checkbox to enable stateful 802.1x authentication.