Extreme Networks Summit WM3000 Series, Reference Manual

Page: 137 / 513

Summit WM3000 Series Controller System Reference Guide
137
10 Click OK to save the changes made to this screen.
11 Click Cancel to revert back to the last saved configuration and move back to the
Network > Wireless LANs > Edit screen.
Configuring an External Radius Server for Optimal Controller Support.
The controller’s external Radius
Server should be configured with Extreme Networks wireless LAN controller specific attributes to best
utilize the user privilege values assignable by the Radius Server. The following two values should be
configured on the external Server for optimal use with the controller:
●
Extreme Networks user privilege values
●
User login source
Configuring Extreme Networks Specific Radius Server User Privilege Values.
The following recommended
Radius Server user privilege settings specify access privilege levels for those accessing the controller
managed network. To define user privilege values, assign the following attributes in the external Radius
Server:
1 Set the attribute number to 1 and its type as "integer."
2 Define the following possible decimal values for user access permissions:
a Set the Monitor Role value to 1 (read-only access to the controller).
b Set the Helpdesk Role value to 2 (helpdesk/support access to the controller).
c Set the Nwadmin Role value to 4 (wired and wireless access to the controller).
d Set the Sysadmin Role value to 8 (system administrator access).
e Set the WebAdmin Role value to 16 (guest user application access).
f Set the Superuser Role value to 32768 (grants full read/write access to the controller).
3 Specify multiple privileges (for a single user) by specifying different attributes as needed. The
privilege values can be
ORed and specified once. For example, if a user needs monitor (read-only)
and helpdesk access, configure the Radius Server with two attributes. Once with a value 1 for
monitor access and then with a value 2 for the helpdesk role.
Multiple roles can also be defined by configuring the Radius Server with attribute 1 and value 3 (or
monitor value 1 and helpdesk value 2).
NOTE
If user privilege attributes are not defined for the Radius Server, users will be authenticated with a default
privilege role of 1 (Monitor read-only access).
Configuring the User Login Sources.
The following recommended Radius Server user login sources
specify the location (ssh/telnet/console/Web) from which users are allowed controller access. If login
access permissions are not defined (restricted), users will be allowed to login from each interface. To
define login source access locations:
1 Set the attribute number to 100 and its type as "integer."
2 Define the following possible decimal values for login sources:
a Set the Console Access value to 128 (user is allowed login privileges only from console).
DSCP/TOS
Optionally mark packets with a
DiffServ CodePoint
(DSCP) in the header.
The DSCP value is stored in the first 6 bits of the Type of Service (ToS)
field that is part of the standard IP header. The DCSP values are
associated with a forwarding treatment called P
er Hop Behaviors
(PHB).
Service can be provisioned (if necessary) by assigning a DCSP point code
from 1 - 6.