Administrator Guide

451 | Roles and Policies Dell Networking W-Series ArubaOS 6.4.x| User Guide
Figure 58 DHCP Option Rule
To identify DHCP strings used by an individual device, access the command-line interface in config mode and
issue the command logging level debugging network process dhcpd to include DHCP option values for
DHCP-DISCOVER and DHCP-REQUEST frames in the controller’s log files:
Now, connect the device you want to identify to the network, and issue the CLI command show log network
to view the DHCP strings.
Be aware that each device type may not have a unique DHCP fingerprint signature. For example, devices from
different manufacturers may use vendor class identifiers that begin with similar strings. If you create a DHCP-
Option rule that uses the starts-with condition instead of the equals condition, the rule may assign a role or
VLAN to more than one device type.
RADIUS Override of User-Derived Roles
This feature introduces a new RADIUS vendor specific attribute (VSA) named “Aruba-No-DHCP-Fingerprint,”
value 14. This attribute signals the RADIUS Client (controller) to ignore the DHCP Fingerprint user role and
VLAN change post L2 authentication. This feature applies to both CAP and RAP in tunnel mode and for the L2
authenticated role only.
Configuring a Default Role for Authentication Method
For each authentication method, you can configure a default role for clients who are successfully authenticated
using that method. To configure a default role for an authentication method:
In the WebUI
1. Navigate to the Configuration > Security > Authentication page.
2. To configure the default user role for MAC or 802.1x authentication, select the AAA Profiles tab. Select the
AAA profile. Enter the user role for MAC Authentication Default Role or 802.1x Authentication Default Role.
3. To configure the default user role for other authentication methods, select the L2 Authentication or L3
Authentication tab. Select the authentication type (Stateful 802.1x or stateful NTLM for L2
Authentication, Captive Portal or VPN for L3 Authentication), and then select the profile. Enter the user role
for Default Role.
4. Click Apply.
For additional information on configuring captive portal authentication, see Captive Portal Authentication on
page 372.
In the CLI
To configure the default user role for MAC or 802.1x authentication: