Users created on an AAA server can be mapped to roles on ZoneDirector using group
attributes. When a client completes authentication successfully, ZoneDirector gets the
group attributes assigned to this user from the AAA server and uses the group attributes
to determine the user's role, and applies the access control restrictions defined in that
role to the client's access privileges.
NOTE
When RBAC is enabled on a WLAN, Client Fingerprinting must be enabled, and
Dynamic VLAN should also be enabled if VLANs will be assigned based on user roles.
Figure 159: Configuring RBAC policy for a role
RBAC Policy Options
The following control policies can be applied to a role:
•
OS type
: Limit access based on operating system/device type.
•
VLAN
: Assign a VLAN ID to this role.
•
Rate Limiting
: Limit per-station uplink and downlink speeds.
•
L3/L4/IP address ACL
: Apply a Layer 3/Layer 4/IP address ACL to this role.
•
Time Range
: Limit the time range during which this role will be allowed access.
Once you have created access control policies for your user roles, you will need to apply
them to any WLANs for which you want to enforce these policies. To do this, edit the
WLAN, expand the
Advanced Options
, and enable the check box next to
Enable Role
Based Access Control Policy
in the
Access Control
section.
Ruckus Wireless ZoneDirector™ Release 10.0 User Guide
232
Managing User Access
Creating New User Roles
