Aruba Networks AirOS v2.3, User Manual

Page: 252 / 254

242 Aruba AirOS Part 0500036-02
v2.3 User Guide January 2005
z
User Authentication and Access Policies
Guest Access
Guest users will use the SSID guest. Authentication method is captive portal
with guest logon enabled.
z
A local VLAN and subnet needs to be created on all the local switches for the guest
users associating with them. Since these VLANs are not going to be visible outside
the switch, we use the same VLAN ID on all switches. Create a local VLAN on the
switch, ex. on switch_101 create a local VLAN 50 and a subnet 192.168.50.0/16 for
that VLAN.
N
OTE
—
If guest users are placed on different vlans on the local switches, these vlans ids
must be created on the master switch to allow failover.
z
Create a small NAT pool of 1 – 5 address belonging to the switches IP address subnet
and nat the guest users using that pool. For example, on local users could be nated
using a pool of two address 10.1.101.15-10.1.101.16.
z
Appropriate ACLs will be applied to the guest role. For example, Internet_access with
nat, ensure that the user has access to the gateway, DNS after nating and deny access
to all internal subnets. All traffic from the guest will be nated using the nat pool.
Employee Access with Static WEP and VPN
z
The PPTP and L2TP VPN configurations need to be made as described in the user
guides. The default roles for the VPN users would be employee.
z
IAS server would be the authentication server of choice.
z
Captive portal for employee users needs to be configured to facilitate downloading of
the VPN dialers.
SSID guest Vlan-ID 50 50 50
encryption Open system Open
system Open system
employee1 Vlan-ID 101 102 103
Encryption WPA-TKIP WPA-TKIP WPA-TKIP
employee2 Vlan-ID 101 102 103
Encryption Static WEP Static WEP Static WEP
WEP key 1234567890
…. 123456789
0…. 1234567890
…