Motorola WiNG 4.4, Reference Manual, Page: 443 / 598

Switch Security 6 - 91
Apart from EAP authentication, the switch allows the enforcement of user-based policies. User-based policies include
dynamic VLAN assignment and access based on time of day.
The switch uses a default trustpoint. A certificate is required for EAP TTLS,PEAP and TLS Radius authentication (configured
with the Radius service).
Dynamic VLAN assignment is achieved based on the Radius server response. A user who associates to WLAN1 (mapped
to VLAN1) can be assigned a different VLAN after authentication with the Radius server. This dynamic VLAN assignment
overrides the WLAN's VLAN ID to which the User associates.
For 802.1x EAP authentication, the switch initiates the authentication process by sending an EAPoL message to the Access
Port only after the wireless client joins the wireless network. The Radius client in the switch processes the EAP messages
it receives. It encapsulates them to Radius access requests and sends them to the configured Radius server (in this case
the switch’s local Radius server).
The Radius server validates the user’s credentials and challenge information received in the Radius access request frames.
If the user is authorized and authenticated, the client is granted access by sending a Radius access accept frame. The
frame is transmitted to the client in an EAPoL frame format.
6.8.1.1 User Database
User group names and associated users (in each group) can be created in the local database. The User ID in the received
access request is mapped to the associated wireless group for authentication. The switch supports the creation of 500
users and 100 groups within its local database. Each group can have a maximum of 500 users.
6.8.1.2 Authentication of Terminal/Management User(s)
The local Radius server can be used to authenticate users. A normal user (with a password) should be created in the local
database. These users should not be a part of any group.
6.8.1.3 Access Policy
Access policies are defined for a group created in the local database. Each user is authorized based on the access policies
defined for the groups to which the user belongs. Access policies allow the administrator to control access to a set of users
based on the WLANs (ESSID).
NOTE: For a Radius supported VLAN to function properly, the "Dynamic Assignment"
checkbox must be enabled for the WLAN supporting the VLAN. For more information, see
Editing the WLAN Configuration on page 4-27 .