<profile>

Name that identifies this instance of the profile. The name must be 1-63 characters.

“default”

authentication-dot1x <dot1x-profile>

Name of the 802.1X authentication profile associated with the WLAN. See aaa authentication dot1x.

—

authentication-mac <mac-profile>

Name of the MAC authentication profile associated with the WLAN. See aaa authentication mac.

—

clone <profile>

Name of an existing AAA profile configuration from which parameter values are copied.

—

devtype-classification

The device identification feature can automatically identify different client device types and operating systems by parsing the User-Agent strings in a client’s HTTP packets. When the devtype-classification parameter is enabled, the output of the show user and show user-table commands shows each client’s device type, if that client device can be identified.

enabled

dot1x-default-role <role>

Configured role assigned to the client after 802.1X authentication. If derivation rules are present, the role assigned to the client through these rules take precedence over the default role.

NOTE: This parameter requires the PEFNG license.

guest

dot1x-server-group <group>

Name of the server group used for 802.1X authentication. See aaa server-group.

—

enforce-dhcp

When you enable this option, clients must complete a DHCP exchange to obtain an IP address. Best practices are to enable this option, when you use the aaa derivation-rules command to create a rule with the DHCP‑Option rule type. This parameter is disabled by default.

disabled

initial-role <role>

Role for unauthenticated users.

logon

l2-auth-fail-through

To select different authentication method if one fails

disabled

mac-default-role <role>

Configured role assigned to the user when the device is MAC authenticated. If derivation rules are present, the role assigned to the client through these rules take precedence over the default role.

NOTE: This parameter requires the PEFNG license.

guest

mac-server-group group

Name of the server group used for MAC authentication. See aaa server-group.

—

max-ip ipv4 wireless <max_ipv4_users>

Control the number of IPv4 addresses that can be associated to single wireless user.

Range: 1-32

WARNING: Increasing the max-ip limit may prevent the system from scaling to maximum users on all master/local controllers. For more information, refer to Usage Guidelines for max-ip ipv4 wireless.

2

If enabled, the controller sends RADIUS accounting to all servers in RADIUS accounting server group.

disabled

no

Negates any configured parameter.

—

open ssid radius accounting

Initiates RADIUS accounting as soon as the user associates to an Open SSID without any authentication.

NOTE: Do not enable this parameter for wired users. If enabled, the controller sends RADIUS accounting packets for unauthenticated wired users.

disabled

The profile requires mapping at a Palo Alto Networks (PAN) firewall

disabled

radius-accounting <group>

Name of the server group used for RADIUS accounting. See aaa server-group.

—

radius-interim-accounting

By default, the RADIUS accounting feature sends only start and stop messages to the RADIUS accounting server. Issue the interim-radius-accounting command to allow the controller to send Interim-Update messages with current user statistics to the server at regular intervals.

disabled

rfc-3576-server <ip-addr>

IP address of a RADIUS server that can send user disconnect, session timeout and change-of-authorization messages, as described in RFC 3576, “Dynamic Authorization Extensions to Remote Dial In User Service (RADIUS)”. See aaa rfc-3576-server.

NOTE: This parameter requires the PEFNG license.

—

sip-authentication-role <role>

Configured role assigned to a session initiation protocol (SIP) client upon registration.

NOTE: This parameter requires the PEFNG license.

guest

user-derivation-rules <profile>

User attribute profile from which the user role or VLAN is derived.

—

user-idle-timeout

The user idle timeout for this profile. Specify the idle timeout value for the client in seconds. A value of 0, deletes the user immediately after disassociation from the wireless network. Valid range is 30-15300 in multiples of 30 seconds. Enabling this option overrides the global settings configured in the AAA timers. If this is disabled, the global settings are used.

disabled

wired-to-wireless-roam

Keeps user authenticated when roaming from the wired side of the network.

enabled

xml-api-server <ip-addr>

IP address of a configured XML API server. See aaa xml-api.

NOTE: This parameter requires the PEFNG license.

—

authentication-dot1x

default

N/A

N/A

authentication-mac

N/A

default

N/A

dot1x-default-role

authenticated

guest

guest

dot1x-server-group

N/A

N/A

N/A

initial-role

logon

logon

logon

mac-default-role

guest

authenticated

guest

mac-server-group

default

default

default

radius-accounting

N/A

N/A

N/A

rfc-3576-server

N/A

N/A

N/A

user-derivation-rules

N/A

N/A

N/A

wired-to-wireless roam

enabled

enabled

enabled

ArubaOS 3.0

Command introduced.

ArubaOS 3.4.1

License requirements changed in ArubaOS 3.4.1, so the sip-authentication-role parameter required the Policy Enforcement Firewall license instead of the Voice Services Module license required in earlier versions.

ArubaOS 6.1

The radius-interim-accounting, devtype-classification and enforce-dhcp parameters were introduced.

ArubaOS 6.3

The user-idle-timeout parameter was introduced.

ArubaOS 6.4

The multiple-server-accounting and download-role parameters were introduced.

ArubaOS 6.4.1.0

The user-idle-timeout parameter now accepts a value of 0.

ArubaOS 6.4.3.0

The max-ip and open ssid radius accounting parameters were introduced.

All platforms

Base operating system, except for noted parameters

Config mode on master controllers