Roles and Policies
15.4 Configuring Derivation Rules
SCALANCE W1750D UI
270
Configuration Manual, 02/2018, C79000-G8976-C451-02
15.4
Configuring Derivation Rules
SCALANCE W allows you to configure role and VLAN derivation-rules. You can configure
these rules to assign a user role or a VLAN to the clients connecting to an SSID or a wired
profile
15.4.1
Understanding Role Assignment Rule
When an SSID or a wired profile is created, a default role for the clients connecting to this
SSID or wired profile is assigned. You can assign a user role to the clients connecting to an
SSID by any of the following methods.
The role assigned by some methods may take precedence over the roles assigned by the
other methods.
RADIUS VSA Attributes
The user role can be derived from Vendor-Specific Attributes (VSA) for RADIUS server
authentication. The role derived from an VSA takes precedence over roles defined by other
methods.
MAC-Address Attribute
The first three octets in a MAC address are known as Organizationally Unique Identifier
(OUI), and are purchased from the Institute of Electrical and Electronics Engineers,
Incorporated (IEEE) Registration Authority. This identifier uniquely identifies a vendor,
manufacturer, or other organization (referred to by the IEEE as the “assignee”) globally and
effectively reserves a block of each possible type of derivative identifier (such as MAC
addresses) for the exclusive use of the assignee.
APs use the OUI part of a MAC address to identify the device manufacturer and can be
configured to assign a desired role for users who have completed 802.1X authentication and
MAC authentication. The user role can be derived from the user attributes after a client
associates with an AP. You can configure rules to assign a user role to clients that match a
MAC-address-based criteria. For example, you can assign a voice role to any client with a
MAC address starting with a0:a1:a2.
Roles Based on Client Authentication
The user role can be the default user role configured for an authentication method, such as
802.1X authentication. For each authentication method, you can configure a default role for
the clients who are successfully authenticated using that method.
DHCP Option and DHCP Fingerprinting
The DHCP fingerprinting allows you to identify the operating system of a device by looking at
the options in the DHCP frame. Based on the operating system type, a role can be assigned
to the device.
