202 CHAPTER 7: AAA C OMMANDS■ server-group-name — Uses the defined group of RADIUS serversfor authentication. You can enter up to four names of existingRADIUS server groups as methods.RADIUS servers cannot be used with the EAP-TLS protocol.For more information, see “Usage.”Defaults — By default, authentication is unconfigured for all clients withnetwork access through MAP ports or wired authentication ports on theWX switch. Connection, authorization, and accounting are also disabledfor these users.Access — Enabled.History — Introduced in MSS Version 3.0.Usage — You can configure different authentication methods fordifferent groups of users by “globbing.” (For details, see “User Globs” onpage 24.)You can configure a rule either for wireless access to an SSID, or for wiredaccess through a WX switch’s wired authentication port. If the rule is forwireless access to an SSID, specify the SSID name or specify any to matchon all SSID names. If the rule is for wired access, specify wired instead ofan SSID name.If you specify multiple authentication methods in the set authenticationweb command, MSS applies them in the order in which they appear inthe command, with these results:If the first method responds with pass or fail, the evaluation is final.If the first method does not respond, MSS tries the second method, andso on.However, if local appears first, followed by a RADIUS server group, MSSoverrides any failed searches in the local WX database and sends anauthentication request to the server group.MSS uses a Web AAA rule only under the following conditions:The client is not denied access by 802.1X or does not support 802.1X.The client’s MAC address does not match a MAC authentication rule.
