530 Configuring AAA for network usersNN47250-500 (320657-F Version 02.01)Assigning a security ACL to a user or a groupOnce a security access control list (ACL) is defined and committed, it can be applied dynamically and auto-matically to users and user groups through the 802.1X authentication and authorization process. When youassign a Filter-Id attribute to a user or group, the security ACL name value is entered as an authorizationattribute into the user or group record in the local WSS database or RADIUS server.(For details about security ACLs, see “Configuring and managing security ACLs” (page 407).)Assigning a security ACL locallyTo use the local WSS database to restrict a user, a MAC user, or a group of users or MAC users to the permis-sions stored within a committed security ACL, use the following commands:You can set filters for incoming and outgoing packets:• Use acl-name.in to filter traffic that enters the WSS from users via an AP access port or wiredauthentication port, or from the network via a network port.• Use acl-name.out to filter traffic sent from the WSS to users via an AP access port or wiredauthentication port, or from the network via a network port.For example, the following command applies security ACL acl-101 to packets coming into the WSS from userJose:WSS# set user Jose attr filter-id acl-101.insuccess: change accepted.Note. If the Filter-Id value returned through the authentication and authorization processdoes not match the name of a committed security ACL in the WSS, the user failsauthorization and cannot be connected.Security ACL Target CommandsUser authenticated by apassword set user username attr filter-id acl-name.inset user username attr filter-id acl-name.outGroup of usersauthenticated by apasswordset usergroup groupname attr filter-id acl-name.inset usergroup groupname attr filter-id acl-name.outUser authenticated by aMAC addressset mac-user username attr filter-id acl-name.inset mac-user username attr filter-id acl-name.outGroup of usersauthenticated by a MACaddressset mac-usergroup groupname attr filter-idacl-name.inset mac-usergroup groupname attr filter-idacl-name.out
