Reference Guide

46 | aaa derivation-rules Dell PowerConnect ArubaOS 5.0 Command Line Interface | Reference Guide
aaa derivation-rules
aaa derivation-rules user <name>
no ...
set {role|vlan} condition <rule-type> <condition> <value> set-value {<role>|<vlan>}
[position <number>]
Description
This command configures rules by which the role or VLAN assigned to a client is derived from the client’s
association with an AP.
The PEFNG must be installed for a user role to be assigned.
Syntax
Usage Guidelines
The user role can be derived from attributes from the client’s association with an AP. You configure the user role
to be derived by specifying condition rules; when a condition is met, the specified user role is assigned to the
client. You can specify more than one condition rule; the order of rules is important as the first matching
condition is applied.
User-derivation rules are executed before the client is authenticated.
Example
The following command sets the client’s user role to “guest” if the client associates to the “Guest” ESSID.
aaa derivation-rules user derive1
set role condition essid equals Guest set-value guest
Parameter Description
<name> Name that identifies this set of user derivation rules.
no Negates a configured rule.
set {role|vlan} Specify whether the action of the rule is to set the role or the VLAN.
condition Condition that should be checked to derive role/VLAN
<rule-type> Specify one of the following rule types for this user derivation rule.
z bssid: BSSID of access point.
z dhcp-option-77: Enable DHCP packet processing.
z encryption-type: Encryption method used by station.
z essid: ESSID of access point.
z location: user location (ap name).
z macaddr: MAC address of user.
<condition> Specify one of the following conditions:
z contains: Check if attribute contains the operand value.
z ends-with: Check if attribute ends with the operand value.
z equals: Check if attribute equals the operand value.
z not-equals: Check if attribute is not equal to the operand value.
z starts-with: Check if attribute starts with the operand value.
set-value
<role>|<vlan>
Specify the user role or VLAN ID to be assigned to the client if the above condition is met.
position
Position of this rule relative to other configured.