Viewing and Changing Location Policy Rules 327Viewing andChanging LocationPolicy RulesDuring the login process, the AAA authorization process is started immediatelyafter clients are authenticated to use the WX switch. During authorization,MSS assigns the user to a VLAN and applies optional user attributes, such as asession timeout value and one or more security ACL filters.A location policy is a set of rules that enables you to locally set or changeauthorization attributes for a user after the user is authorized by AAA,without making changes to the AAA server. For example, you might wantto enforce VLAN membership and security ACL policies on a particularWX based on a client’s organization or physical location, or assign a VLANto users who have no AAA assignment. For these situations, you canconfigure the location policy on the switch.You can use a location policy to locally set or change the Filter-Id andVLAN-Name authorization attributes obtained from AAA.Conditions within a rule are ANDed. All conditions in the rule must matchin order for MSS to take the specified action. If the location policycontains multiple rules, MSS compares the user information to the rulesone at a time, in the order the rules appear in the switch’s configurationfile, beginning with the rule at the top of the list. MSS continuescomparing until a user matches all conditions in a rule or until there areno more rules.Any authorization attributes not changed by the location policy remainactive.Each WX switch can have one location policy. The location policy consistsof a set of rules. Each rule contains conditions, and an action to performif all conditions in the rule match. The location policy can contain up to150 rules.Viewing LocationPolicy RulesTo view location policy rules:1 Select the Configuration tool bar option.2 In the Organizer panel, click the plus sign next to the WX switch.3 Click the plus sign next to AAA.4 Select Location Policy.The configured location policy rules appear.
