Wireless Access

last person joined: 10 hours ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

server derived rule for a vlan

This thread has been viewed 1 times

  • 1.  server derived rule for a vlan

    Posted Aug 25, 2013 11:02 AM

    Hi,

    Can I have server derived vlan (server rule) for a specific group of users in a SSID which is configured with vlan setting as a pool of vlans, we use NPS for .1x authentication. If yes, could help us with the configuration both in controller as well as RADIUS.

     

    Thanks

     



  • 2.  RE: server derived rule for a vlan

    EMPLOYEE
    Posted Aug 25, 2013 11:20 AM

    New in ArubaOS 6.3, you can assign a VLAN pool to a server derivation rule.  From the 6.3 release notes:

     

    VLAN Derivation from Named VLAN Pools


    Named VLANs can be configured under user rule, server derivation, user derivation, and VSA in this release. Previously, only single VLAN ID names supported the above.

    You cannot modify a VLAN name so choose the name carefully.

    Named VLANs (single VLAN IDs or VLAN pools) can only be assigned to tunnel mode VAP’s and wired profiles. They can also be assigned to user roles, user rule derivation, server derivation, and VSA for tunnel and bridge mode. 

     

    There are two parts to this:

     

    1- Configuring NPS to send back an attribute based on a user group:  http://community.arubanetworks.com/t5/Campus-WLAN-and-High-Density-Wi/Assigning-users-different-vlan-subnet-based-on-AD-group/td-p/59210

     

    2- Writing a server derivation rule to put users in a named VLAN pool based on that attribute.



  • 3.  RE: server derived rule for a vlan

    Posted Aug 25, 2013 11:54 AM

    Thank you Joseph for the reply, I would like to stress that I don't need a vlan pool in server derived rule, just one vlan is sufficient, but the SSID is already set for a vlan pool (vlan setting under SSID properties), now could you advise.

     

    Thanks

     



  • 4.  RE: server derived rule for a vlan

    EMPLOYEE
    Posted Aug 25, 2013 12:02 PM

    Then you need the first link that describes how to send back the attribute.  You then write a server derived rule to change the VLAN or role based on that returned attribute from NPS.



  • 5.  RE: server derived rule for a vlan

    Posted Aug 25, 2013 12:45 PM

    Hi,

     

    Will this set up works if SSID vlan setting is already configured for vlan pool.

     

    thnaks



  • 6.  RE: server derived rule for a vlan

    EMPLOYEE
    Posted Aug 25, 2013 12:47 PM
    The server derivation rule overrides that setting as an exception.


  • 7.  RE: server derived rule for a vlan

    Posted Aug 25, 2013 01:00 PM

    override happens only if computer + user authentication succedes ?, anything like that ?



  • 8.  RE: server derived rule for a vlan
    Best Answer

    EMPLOYEE
    Posted Aug 25, 2013 01:07 PM
    Nothing like that.