Users Guide

146 | Role Derivation Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 | User Guide
7. Click New. The New Rule window appears. Enter the name of the new user role. To delete a
user role, select the user role and click Delete.
Figure 106 - Creating a New User Role
8. Click OK. The Allow any to all destinations access rule is enabled by default. This rule allows
traffic to all destinations. To create new access rules, see "Examples for Access Rules" on page
158.
9. Assign pre-authentication role— Use this option if you want to allow some access to users
even before they are authenticated.
10. Enforce Machine Authentication— You can assign different rights to clients based on
whether their hardware device supports machine authentication. Machine Authentication is
only supported on Windows devices, so this can be used to distinguish between Windows
devices and other devices such as iPads.
n Machine Auth only role - This indicates a Windows machine with no user logged in. The
device supports machine authentication and has a valid RADIUS account, but a user has
not yet logged in and authenticated.
n User Auth only role - This indicates a known user or a non-Windows device. The device
does not support machine auth or does not have a RADIUS account, but the user is
logged in and authenticates.
When a device does both Machine and User authentication, the user obtains the default role
or the derived role based on the RADIUS attribute.
To configure Machine Authentication, do the following:
1. In the Roles window, create a role for Machine auth only and User auth only.
2. Configure Access Rules for these roles by selecting the role, and applying the rule. Refer to
"Examples for Access Rules" on page 158 for procedures to create access rules.
3. Select Enforce Machine Authentication and specify these two roles.
4. Click Finish to apply these changes.