The AAA Override option of a WLAN enables you to configure the WLAN for identity networking. It enables you to apply VLAN tagging, Quality of Service (QoS), and Access Control Lists (ACLs) to individual clients based on the returned RADIUS attributes from the AAA server.

Most of the configuration to allow AAA override is done at the RADIUS server, where you should configure the Access Control Server (ACS) with the override properties you would like it to return to the controller (for example, Interface-Name, QoS-Level, and VLAN-Tag).

On the controller, enable the Allow AAA Override configuration parameter using the GUI or CLI. Enabling this parameter allows the controller to accept the attributes returned by the RADIUS server. The controller then applies these attributes to its clients.

This section contains the following subsections:

If you are using a Steel-Belted RADIUS (SBR), FreeRadius, or similar RADIUS server, clients may not obtain the correct QoS values after the AAA override feature is enabled. For these servers, which allow you to edit the dictionary file, you need to update the file to reflect the proper QoS values: Silver is 0, Gold is 1, Platinum is 2, and Bronze is 3. To update the RADIUS server dictionary file, follow these steps:

Note	This issue does not apply to the Cisco Secure Access Control Server (ACS).

To update the RADIUS server dictionary file, follow these steps:

1. Stop the SBR service (or other RADIUS service).

2. Save the following text to the Radius_Install_Directory\Service folder as ciscowlan.dct:

   
   ################################################################################
   # CiscoWLAN.dct- Cisco Wireless Lan Controllers
   #
   # (See README.DCT for more details on the format of this file)
   ################################################################################
   
   # Dictionary - Cisco WLAN Controllers
   #
   # Start with the standard Radius specification attributes
   #
   @radius.dct
   #
   # Standard attributes supported by Airespace
   #
   # Define additional vendor specific attributes (VSAs)
   #
   
   MACRO Airespace-VSA(t,s) 26 [vid=14179 type1=%t% len1=+2 data=%s%]
   
   ATTRIBUTE   WLAN-Id                 Airespace-VSA(1, integer)     cr
   ATTRIBUTE   Aire-QoS-Level 	 	 	 	 	Airespace-VSA(2, integer)     r
   VALUE Aire-QoS-Level Bronze 	 		3
   VALUE Aire-QoS-Level Silver     0
   VALUE Aire-QoS-Level Gold       1
   VALUE Aire-QoS-Level Platinum   2
   
   ATTRIBUTE   DSCP                    Airespace-VSA(3, integer)     r
   ATTRIBUTE   802.1P-Tag              Airespace-VSA(4, integer)     r
   ATTRIBUTE   Interface-Name          Airespace-VSA(5, string)      r
   ATTRIBUTE   ACL-Name                Airespace-VSA(6, string)      r
   
   # This should be last.
   
   ################################################################################
   # CiscoWLAN.dct - Cisco WLC dictionary
   ##############################################################################

   

3. Open the dictiona.dcm file (in the same directory) and add the line “@ciscowlan.dct.”

4. Save and close the dictiona.dcm file.

5. Open the vendor.ini file (in the same directory) and add the following text:

   
   vendor-product       = Cisco WLAN Controller
   dictionary           = ciscowlan
   ignore-ports         = no
   port-number-usage    = per-port-type
   help-id 		 	 	 	     = 

   

6. Save and close the vendor.ini file.

7. Start the SBR service (or other RADIUS service).

8. Launch the SBR Administrator (or other RADIUS Administrator).

9. Add a RADIUS client (if not already added). Choose Cisco WLAN Controller from the Make/Model drop-down list.