UAM overview

Configuring endpoint MAC groups

An endpoint MAC group is a collection of MAC addresses. Endpoint users match different access conditions if the MAC addresses of the endpoints belong to two or more endpoint MAC groups.

Viewing the endpoint MAC group list

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Condition > Endpoint MAC Group.

The list includes all endpoint MAC groups.

Endpoint MAC group list contents

¡ Endpoint MAC Group Name—Name of the endpoint MAC group, which must be unique in UAM. Click the name to display the endpoint MAC group details page.

¡ Description—Endpoint MAC group description.

¡ Service Group—Service group to which the endpoint MAC group belongs.

¡ Modify—Click the Modify icon to modify the endpoint MAC group.

¡ Delete—Click the Delete icon to delete the endpoint MAC group.

Querying endpoint MAC groups

1. Access the endpoint MAC group list page.

2. In the Query Endpoint MAC Groups area, specify one or more of the following query criteria:

¡ Endpoint MAC Group Name—Enter a partial or complete endpoint MAC group name.

¡ Endpoint MAC—Enter a partial or complete endpoint MAC address. For example, if you enter 11:EF, all MAC addresses that contain 11:EF are matched.

¡ Service Group—Select Ungrouped or a service group from the list.

The query ignores empty fields.

3. Click Query. The list shows all endpoint MAC groups that match the query criteria.

4. Click Reset to clear the query criteria. The list shows all endpoint MAC groups in UAM.

Viewing endpoint MAC group details

1. Access the endpoint MAC group list page.

2. Click the name of an endpoint MAC group to display the endpoint MAC group details page.

¡ Basic Information

- Endpoint MAC Group Name—Name of the endpoint MAC group, which must be unique in UAM.

- Service Group—Service group to which the endpoint MAC group belongs.

- Description—Endpoint MAC group description.

¡ Endpoint MAC List

- Endpoint MAC—MAC address that belongs to the endpoint MAC group.

- Description—Endpoint MAC address description.

3. Click Back to return to the endpoint MAC group list page.

Adding an endpoint MAC group

1. Access the endpoint MAC group list page.

2. Click Add to display the page for adding an endpoint MAC group.

3. Configure basic information:

¡ Endpoint MAC Group Name—Enter the endpoint MAC group name, which must be unique in UAM.

¡ Description—Enter the endpoint MAC group description. Detailed descriptions can facilitate maintenance.

¡ Service Group—Select a service group for the endpoint MAC group. You can add endpoint MAC groups to different service groups to facilitate management.

4. Configure the endpoint MAC address list:

a. Click Add in the Endpoint MAC List area.

The Add Endpoint MAC dialog box opens.

b. Enter the endpoint MAC address and its description.

Valid MAC address formats include XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, and XX:XX:XX:XX:XX:XX.

c. Click OK.

d. Repeat steps a through c to add more endpoint MAC addresses.

e. To delete an undesired endpoint MAC address, click the Delete icon for the endpoint MAC address.

5. Click OK.

Modifying an endpoint MAC group

1. Access the endpoint MAC group list page.

2. Click the Modify icon for the endpoint MAC group you want to modify.

The page for modifying the endpoint MAC group opens.

3. Modify the endpoint MAC group parameters except Service Group, which cannot be modified.

For more information about the parameter description, see "Adding an endpoint MAC group."

4. Click OK.

Deleting an endpoint MAC group

An endpoint MAC group cannot be deleted when it is used in an access scenario.

To delete an endpoint MAC group:

1. Access the endpoint MAC group list page.

2. Click the Delete icon for the endpoint MAC group you want to delete.

A confirmation dialog box opens.

Table 15 Access policy contents

Configuring endpoint vendor groups

An endpoint vendor group is a collection of vendors, such as Apple, Microsoft, HTC, Samsung, Nokia, and HP.

Endpoint users match different access conditions if the endpoint vendors belong to two or more endpoint vendor groups.

Viewing the endpoint vendor group list

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Condition > Endpoint Vendor Group.

The list includes all endpoint vendor groups.

Endpoint vendor group list contents

¡ Endpoint Vendor Group Name—Must be unique in UAM. Click the name to display the endpoint vendor group details page.

¡ Description—Vendor group description.

¡ Service Group—Service group to which the vendor group belongs.

¡ Modify—Click the Modify icon to modify the vendor group.

¡ Delete—Click the Delete icon to delete the vendor group.

Querying endpoint vendor groups

1. Access the endpoint vendor group list page.

2. In the Query Endpoint Vendor Groups area, specify one or more of the following query criteria:

¡ Endpoint Vendor Group Name—Enter a partial or complete name of the endpoint vendor group. For example, if you enter test, all group names that contain test are matched.

¡ Vendor—Enter a vendor name. For example, if you enter hp, all vendor names that contain hp are matched.

¡ Service Group—Select Ungrouped or a service group from the list.

The query ignores empty fields.

3. Click Query. The list shows all endpoint vendor groups that match the query criteria.

4. Click Reset to clear the query criteria. The list shows all endpoint vendor groups in UAM.

Viewing endpoint vendor group details

1. Access the endpoint vendor group list page.

2. Click the name of a vendor group to display the vendor group details page.

¡ Basic Information

- Endpoint Vendor Group Name—Name of the vendor group, which must be unique in UAM.

- Description—Vendor group description.

- Service Group—Service group to which the vendor group belongs.

¡ Vendor List

- Vendor—Vendor that belongs to the vendor group.

- Description—Vendor description.

3. Click Back to return to the vendor group list page.

Adding an endpoint vendor group

1. Access the endpoint vendor group list page.

2. Click Add to display the page for adding a vendor group.

3. Configure basic information:

¡ Endpoint Vendor Group Name—Enter the vendor group name, which must be unique in UAM.

¡ Description—Enter the vendor group description. Detailed descriptions can facilitate maintenance.

¡ Service Group—Select a service group for the vendor group. You can add endpoint vendor groups to different service groups to facilitate management.

4. Configure the vendor list:

a. Click Add in the Vendor List area.

b. Select a vendor you want to add to the endpoint vendor group.

A vendor can be assigned to only one endpoint vendor group. UAM provides pre-defined endpoints vendors and also supports custom endpoint vendors. For more information about customizing vendors, see "Managing endpoint types."

c. Click OK.

d. Repeat steps a through c to add more vendors.

e. To delete an undesired vendor, click the Delete icon for the vendor.

5. Click OK.

Modifying an endpoint vendor group

1. Access the endpoint vendor group list page.

2. Click the Modify icon for the vendor group you want to modify.

The page for modifying the vendor group opens.

3. Modify the vendor group parameters except Service Group, which cannot be modified.

For more information about the parameter description, see "Adding an endpoint vendor group."

4. Click OK.

Deleting an endpoint vendor group

An endpoint vendor group cannot be deleted when it is used in an access scenario.

To delete an endpoint vendor group:

1. Access the endpoint vendor group list page.

2. Click the Delete icon for the endpoint vendor group you want to delete.

A confirmation dialog box opens.

3. Click OK.

Configuring endpoint type groups

An endpoint type group is a collection of endpoint types. Common endpoint types include PC, Mobile, Smartphone, iPhone, and iPad.

Endpoint users match different access conditions if the endpoint types belong to two or more endpoint type groups.

Accessing the endpoint type group list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Condition > Endpoint Type Group.

The list includes all endpoint type groups.

Endpoint type group list contents

¡ Endpoint Type Group Name—Name of the endpoint type group, which must be unique in UAM. Click the name to display the endpoint type group details page.

¡ Description—Description of the endpoint type group.

¡ Service Group—Service group to which the endpoint type group belongs.

¡ Modify—Click the Modify icon to modify the endpoint type group.

¡ Delete—Click the Delete icon to delete the endpoint type group.

Querying endpoint type groups

1. Access the endpoint type group list page.

2. In the Query Endpoint Type Groups area, specify one or more of the following query criteria:

¡ Endpoint Type Group Name—Enter a partial or complete name of the endpoint type group. For example, if you enter test, all group names that contain test are matched.

¡ Endpoint Type—Enter a partial or complete endpoint type. For example, if you enter hp, all endpoint types that contain hp are matched.

¡ Service Group—Select an existing service group or Ungrouped from the list.

The query ignores empty fields.

3. Click Query. The endpoint type group list includes all endpoint type groups that match the query criteria.

4. Click Reset to clear the query criteria. The endpoint type group list includes all endpoint type groups in UAM.

Viewing endpoint type group details

1. Access the endpoint type group list page.

2. Click the name of the endpoint type group whose detailed information you want to view.

The Endpoint Type Group Details page opens.

¡ Basic Information

- Endpoint Type Group Name—Name of the endpoint type group, which must be unique in UAM.

- Description—Description of the endpoint type group.

- Service Group—Service group to which the endpoint type group belongs.

¡ Endpoint Type List—Displays all endpoint types contained in the endpoint type group.

- Endpoint Type—Type of the endpoint devices.

- Display Name—Display name of the endpoint type.

3. Click Back to return to the endpoint type group list page.

Adding an endpoint type group

1. Access the endpoint type group list page.

2. Click Add to display the page for adding an endpoint type group.

3. Configure basic information:

¡ Endpoint Type Group Name—Enter the name of the endpoint type group, which must be unique in UAM.

¡ Description—Enter a description of the endpoint type group. Detailed descriptions can facilitate maintenance.

¡ Service Group—Select a service group to which the endpoint type group belongs. You can assign endpoint type groups to different service groups to facilitate management.

4. Configure the endpoint type list:

a. Enter a partial or complete endpoint type name or display name.

This field supports fuzzy matching.

b. Click Query.

The endpoint type list displays all endpoint types that match the query criterion.

To restore the full list, click Reset.

c. Select one or more endpoint types you want to add to the endpoint type group.

An endpoint type can be assigned to only one endpoint type group. UAM provides predefined endpoint types and also supports user-defined endpoint types. For information about customizing endpoint types, see "Managing endpoint types."

5. Click OK.

Modifying an endpoint type group

1. Access the endpoint type group list page.

2. Click the Modify icon for the endpoint type group you want to modify.

The page for modifying the endpoint type group opens.

3. Modify the settings of the endpoint type group as needed.

You can modify all the parameters except Service Group. For more information about the parameters, see "Adding an endpoint type group."

4. Click OK.

Deleting an endpoint type group

An endpoint type group cannot be deleted when it is used in an access scenario.

To delete an endpoint type group:

1. Access the endpoint type group list page.

2. Click the Delete icon for the endpoint type group you want to delete.

A confirmation dialog box opens.

3. Click OK.

Configuring endpoint OS groups

An endpoint OS group is a collection of operating systems. Common endpoint operating systems include the following:

· Windows XP

· Windows 7

· Windows 8

· Mac OS

· Android

· Linux

· iOS/OS X

Endpoint users match different access conditions if the endpoint operating systems belong to two or more endpoint OS groups.

Accessing the endpoint OS group list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Condition > Endpoint OS Group.

The list includes all OS groups.

Endpoint OS group list contents

¡ Endpoint OS Group Name—Name of the endpoint OS group, which must be unique in UAM. Click the name to display the endpoint OS group details page.

¡ Description—Description of the endpoint OS group.

¡ Service Group—Service group to which the endpoint OS group belongs.

¡ Modify—Click the Modify icon to modify the endpoint OS group.

¡ Delete—Click the Delete icon to delete an endpoint OS group.

Querying endpoint OS groups

1. Access the endpoint OS group list page.

2. In the Query Endpoint OS Groups area, specify one or more of the following query criteria:

¡ Endpoint OS Group Name—Enter a partial or complete name of the endpoint OS group. For example, if you enter test, all endpoint OS group names that contain test are matched.

¡ OS—Enter a partial or complete operating system name. For example, if you enter Windows, all operating systems that contain Windows are matched.

¡ Service Group—Select an existing service group or Ungrouped from the list.

The query ignores empty fields.

3. Click Query.

The endpoint OS group list includes all OS groups that match the query criteria.

4. Click Reset to clear the query criteria.

The endpoint OS group list includes all OS groups.

Viewing endpoint OS group details

1. Access the endpoint OS group list page.

2. Click the name of the endpoint OS group whose detailed information you want to view.

The Endpoint OS Group Details page opens.

¡ Basic Information

- Endpoint OS Group Name—Name of the endpoint OS group, which must be unique in UAM.

- Description—Description of the endpoint OS group.

- Service Group—Service group to which the endpoint OS group belongs.

¡ OS List—Displays the endpoint operating systems contained in the endpoint OS group.

3. Click Back to return to the endpoint OS group list page.

Adding an endpoint OS group

1. Access the endpoint OS group list page.

2. Click Add to display the page for adding an endpoint OS group.

3. Configure basic information:

¡ Endpoint OS Group Name—Specify the endpoint OS group name, which must be unique in UAM.

¡ Description—Enter a description of the endpoint OS group. Detailed descriptions can facilitate maintenance.

¡ Service Group—Specify the service group to which the endpoint OS group belongs. You can assign OS groups to different service groups to facilitate management.

4. Configure the OS list:

a. In the OS List area, enter a partial or complete OS name, and then click Query.

The OS list displays all OSs that match the query criterion.

b. Select one or more operating systems.

One endpoint operating system can be assigned to only one endpoint OS group. UAM provides predefined endpoint operating systems and also supports user-defined operating systems. For more information about customizing endpoint operating systems, see "Managing endpoint OSs."

5. Click OK.

Modifying an endpoint OS group

1. Access the endpoint OS group list page.

2. Click the Modify icon for the endpoint OS group you want to modify.

The page for modifying the endpoint OS group opens.

3. Modify the endpoint OS group settings as needed.

You can modify all the parameters except Service Group. For more information about the parameters, see "Adding an endpoint OS group."

4. Click OK.

Deleting an endpoint OS group

An endpoint OS group cannot be deleted when it is used in an access scenario.

To delete an endpoint OS group:

1. Access the endpoint OS group list page.

2. Click the Delete icon for the endpoint OS group you want to delete.

A confirmation dialog box opens.

3. Click OK.

Configuring AP groups

An AP group is a collection of APs. Endpoint users match different access conditions if the APs to which they connect belong to two or more AP groups.

Accessing the AP group list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Condition > AP Group.

The list includes all AP groups.

AP group list contents

¡ AP Group Name—Name of the AP group, which must be unique in UAM. Click the name to display the AP group details page.

¡ Description—AP group description.

¡ Service Group—Service group to which the AP group belongs.

¡ Modify—Click the Modify icon to modify the AP group.

¡ Delete—Click the Delete icon to delete the AP group.

Querying AP groups

1. Access the AP group list page.

2. In the Query AP Groups area, specify one or more of the following query criteria:

¡ AP Group Name—Enter a partial or complete AP group name. For example, if you enter test, all AP group names that contain test are matched.

¡ NAS ID—Enter a partial or complete AP NAS ID. For example, if you enter test, all NAS IDs that contain test are matched.

¡ Service Group—Select Ungrouped or a service group from the list.

The query ignores empty fields.

3. Click Query. The list shows all AP groups that match the query criteria.

4. Click Reset to clear the query criteria. The list shows all AP groups in UAM.

Viewing AP group details

1. Access the AP group list page.

2. Click the name of an AP group to display the AP group details page.

¡ Basic Information

- AP Group Name—Name of the AP group, which must be unique in UAM.

- Description—AP group description.

- Service Group—Service group to which the AP group belongs.

¡ AP List

- NAS ID—NAS ID of the AP.

- Description—AP description.

3. Click Back to return to the AP group list page.

Adding an AP group

1. Access the AP group list page.

2. Click Add to display the page for adding an AP group.

3. Configure basic information:

¡ AP Group Name—Enter the AP group name, which must be unique in UAM.

¡ Service Group—Select a service group for the AP group. You can add AP groups to different service groups to facilitate management.

¡ Description—Enter the AP group description. Detailed descriptions can facilitate maintenance.

4. Configure the AP list:

To add one AP at a time:

a. Click Add in the AP List area.

The Add AP window opens.

b. Enter the NAS ID and description.

c. Click OK.

d. Repeat steps a through c to add more APs.

To import APs in batches:

a. Click Batch Import in the AP List area.

The NAS ID Batch Import window opens.

b. Click Browse next to Import File to select a text or CSV file that stores AP devices.

UAM supports importing only text and CSV files in ANSI code.

c. Select a column delimiter from the Column Delimiter list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($).

Select the comma (,) if you have selected a CSV file.

d. Click Next to open the basic information page.

UAM automatically analyzes the number of columns available in the file and displays the result in the list of each parameter.

e. Specify the following basic information:

- NAS ID—Select a NAS ID from the list. This parameter must be selected from the imported file.

- Description—Select a column number from the list, or select Not Imported and enter a description in the field next to the list. The description you entered applies to all imported AP devices.

f. Click Preview to preview the import result.

g. Click OK.

The Operation Result page displays the total number of imported AP devices and import failures.

If import failures exist, you can click Download to download or open the operation log. The log records the AP devices that failed to be imported as well as the failure reason.

To delete an undesired AP, click the Delete icon for the AP.

5. Click OK.

Modifying an AP group

1. Access the AP group list page.

2. Click the Modify icon for the AP group you want to modify.

The page for modifying the AP group opens.

3. Modify the AP group parameters except Service Group, which cannot be modified.

For more information about the parameter description, see "Adding an AP group."

4. Click OK.

Deleting an AP group

An AP group cannot be deleted when it is used in an access scenario.

To delete an AP group:

1. Access the AP group list page.

2. Click the Delete icon for the AP group you want to delete.

A confirmation dialog box opens.

3. Click OK.

Configuring user access policies

The access policy is another important concept in BYOD, which specifies rules and policies to control network access of endpoint users.

BYOD also uses the following important concepts:

· Access Condition—Specifies the conditions to meet for network access such as time, location, endpoint device, and network type.

· Access Scenario—Defines the access policy to take effect on a specific access condition.

To implement BYOD, the following workflow applies:

1. In UAM, the operator defines access conditions and access policies.

2. In UAM, the operator defines one or more access scenarios for a specific service, and maps access conditions to access policies in each access scenario.

3. When an endpoint user attempts to access the network by using the service, UAM identifies the access conditions for the endpoint user and applies the correct access policy to the endpoint user.

For more information about configuring access conditions, see "Configuring access conditions."

An access policy provides the following access control information:

· Authorization—Controls authorization information such as the access time period, download and upload rates, VLANs, ACLs, preferred EAP type, and EAP automatic negotiation.

· Binding check—Compares the IP address, MAC address, computer name, and domain used by the endpoint, the IP address and MAC address of the access device, the user VLAN, and other binding information with those binding information configured for the user account.

· Network check—Requires the iNode client be used, and checks the proxy, multi-NIC, and other network settings.

· Security check—Works with EAD to check software information such as anti-virus, anti-spyware, anti-phishing, and firewall software, system patches, and software blacklist/whitelist on the terminals. For more information, see HPE Intelligent Management Center v7.3 EAD Security Policy Administrator Guide.

· Proprietary-attribute assignment—Deploys vendor-specific RADIUS attributes to the access devices to complete special network access schemes. For more information, see "Configuring proprietary attribute assignment policies."

· Internet access lock—Works with EAD to prevent endpoint users from accessing other networks. For more information, see HPE Intelligent Management Center v7.3 EAD Security Policy Administrator Guide.

UAM integrates the authorization, binding check, and network check functions into access policies. An access policy contains the items listed in Table 15. By default, an endpoint is examined against all items except for the access ACL. The endpoint can access the network only if it passes all examinations.

Access policy contents	Description
Access period policy	This function controls user access by time period. For more information, see "Configuring access period policies."
SSID access control	This function controls wireless user access by SSID. Only the wireless users with permitted SSIDs can access the network. For more information, see "Configuring access SSIDs."
Hard disk serial number	This function controls user access by hard disk serial number. Only users with at least one permitted hard disk serial number of their terminals can access the network. For more information, see "Configuring hard disk serial numbers."
Access MAC address	This function controls user access by MAC address. If a MAC address is not allowed to access the network, user authentication from the NIC fails. For more information, see "Configuring access MAC addresses."
Motherboard serial number	This function controls user access by motherboard serial number. Only users with permitted endpoint motherboard serial numbers can access the network. For more information, see "Configuring motherboard serial numbers."
Access ACL	This function controls user access by ACL. For more information, see "Configuring access ACLs."

Configuring access policies

An access policy specifies the authentication, binding check, and network check settings for network access. Configure access policies before you can add access policies for an access service.

Accessing the access policy list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Policy.

The list includes all access policies.

Access policy list contents

¡ Access Policy Name—Unique name of the access policy. Click the name to display the access policy details page.

¡ Description—Description of the access policy.

¡ Service Group—Name of the service group to which the access policy belongs.

¡ Modify—Click the Modify icon to modify settings of the access policy.

¡ Delete—Click the Delete icon to delete the access policy.

Querying access policies

1. Access the access policy list page.

2. On the Query Access Policies area, specify one or more of the following query criteria:

¡ Access Policy Name—Enter a partial or complete name of the access policy.

¡ Service Group—Select Ungrouped or a service group from the list.

The query ignores empty fields.

3. Click Query.

The list includes all access policies matching the query criteria.

4. To restore default settings on the query area, click Reset.

The list includes all access policies.

Viewing access policy details

To view detailed information about an access policy:

1. Access the access policy list page.

2. Click the name of the access policy for which you want to view its details.

The Access Policy Details page includes the Basic Information, Authorization Information, Authentication Binding Information, and User Client Configuration areas.

Basic Information area parameters:

¡ Access Policy Name—Unique name of the access policy.

¡ Service Group—Name of the service group to which the access policy belongs.

¡ Description—Description of the access policy.

Authorization Information area parameters:

This area contains parameters to be authorized to the user.

¡ Access Period—Name of the access period policy that is specified for the access policy. For more information about access period policies, see "Configuring access period policies."

¡ Allocate IP—Whether or not UAM requires an IP address be specified when an operator attempts to assign an access account a service that uses this access policy. UAM assigns the specified IP address to the user who passes authentication by using that access account. This parameter applies only to PPP authentication methods, for example, L2TP and PPPoE.

¡ Downstream Rate—Upper limit of the download rate for the access user. This parameter takes effect only when the access device is an HP ProCurve or Comware switch. Support for the parameter on the HP Comware switches depends on the device model.

¡ Upstream Rate—Upper limit of the upload rate for the access user. This parameter takes effect only when the access device is an HP ProCurve or Comware switch. Support for the parameter on the HP Comware switches depends on the device model.

¡ Priority—Priority of packets forwarded by the access device for the access user. This parameter takes effect only when the access device is an HP ProCurve or Comware switch. Support for the parameter on the HP Comware switches depends on the device model.

¡ Preferred EAP Type—EAP authentication type that UAM preferentially deploys to the client during EAP authentication. The following EAP authentication types are available: EAP-MD5, EAP-TLS, EAP-TTLS, and EAP-PEAP.

¡ Subtype—Authentication subtype for EAP-TTLS and EAP-PEAP. This parameter is displayed when the Preferred EAP Type displays EAP-TTLS or EAP-PEAP. The following subtypes are available:

- EAP-MSCHAPv2—UAM and the client use EAP-MSCHAPv2 or a non-EAP authentication type.

- EAP-MD5—UAM and the client use EAP-MD5 or a non-EAP authentication type.

- EAP-GTC—UAM and the client use EAP-GTC or a non-EAP authentication type.

¡ EAP Auto Negotiate—Whether automatic negotiation is enabled. EAP automatic negotiation enables UAM to permit the authentication request from a client if the EAP authentication type on the client and the preferred EAP type on UAM do not match.

¡ Maximum Online Duration for a Logon (Minutes)—Maximum duration an authenticated access user can be online. If this field is empty, the online duration is not limited. To specify this parameter, enter an integer in the range of 1 to 1440. When the online duration of an access user exceeds the specified value, UAM logs off the user.

¡ Deploy VLAN—ID or name of the VLAN to be assigned to the user through the access device. The value range of the VLAN ID is 1 to 4094. Other value is considered as a VLAN name.

¡ Deploy User Profile—Name of the user profile to be assigned to the user through the access device.

¡ Deploy User Group—Name of the user group to be assigned to the user through the access device.

¡ Deploy ACL—Number or name of the ACL to be assigned to the user through the access device.

Authentication Binding Information area parameters:

All options selected in this area must be checked in network access authentication.

¡ Bind Access Device IP—Requires the access device use the bound IP address.

¡ Bind Access Device Port—Requires the user endpoint connect to an access device through the bound port.

¡ Bind VLAN—Requires the packets of the user carry the bound VLAN tag.

¡ Bind QinQ Double VLAN—Requires the QinQ packets of the user carry the bound VLAN tags.

¡ Bind User IP—Requires the authenticated NIC on the user endpoint use the bound IP address.

¡ Bind User IPv6—Requires the authenticated NIC on the user endpoint use the bound IPv6 address.

¡ Bind User MAC—Requires the authenticated NIC on the user endpoint use the bound MAC address.

¡ Bind User IMSI—Requires the user endpoint use the bound IMSI.

¡ Bind Computer Name—Requires the user endpoint use the bound computer name.

¡ Bind Domain—Requires the user endpoint join the bound Windows domain. The user does not need to log on to the domain.

¡ Logon Domain—Requires the user endpoint log on to the bound domain.

¡ Bind User SSID—Requires the bound SSID be used.

¡ Bind Access Device SN—Requires the access device use the bound serial number.

¡ Control Access MAC Address—Checks the MAC address of the user endpoint. For more information, see "Configuring access MAC addresses."

¡ Control Hard Disk Serial Number—Checks serial numbers of the hard disks on the user endpoint. For more information, see "Configuring hard disk serial numbers."

¡ Enable SSID Access Control—Checks the SSID to which the user endpoint is connected. For more information, see "Configuring access SSIDs."

¡ Control Motherboard Serial Number—Checks the serial number of the motherboard on the user endpoint. For more information, see "Configuring motherboard serial numbers."

¡ Bind User IMEI—Requires the user endpoint to use the bound international mobile equipment identification number (IMEI).

User Client Configuration area parameters:

¡ iNode Client Only—Whether user authentication must be performed through the iNode client.

¡ Authentication Password—Determines the type of the passwords to be verified by UAM:

- Account Password—UAM verifies only the password of the user.

- Dynamic Password—UAM verifies only the verification code that the user dynamically gets through an SMS message. Verification codes typically have a short lifetime.

- Account Password + Dynamic Password—UAM verifies both the user password and the verification code that the user dynamically gets through an SMS message.

This parameter takes effect only on portal and SSL VPN connections in the iNode PC client.

¡ Disable iNode DC for Windows—Blocks use of the iNode DC on Windows endpoints.

¡ Disable iNode DC for Linux/Mac OS—Blocks use of the iNode DC on Linux and Mac OS endpoints.

¡ Forbid Modifying IP When Online—Disables an online user from modifying the endpoint's IP address. Otherwise, the user is logged out.

¡ Auto Reconnect after Network Failure—Enables the iNode client to automatically reconnect if the user connection is closed because of a network failure.

¡ Retry Interval (Minutes)—Interval at which the iNode client automatically reconnects, in minutes. This parameter is displayed only when the Auto Reconnect after Network Failure option is selected.

¡ Retries—Maximum number of reconnection retries. This parameter is displayed only when the Auto Reconnect after Network Failure option is selected.

¡ Lowest Client Version—Lowest version number of the iNode client that can be used on the network. This parameter must be used together with the iNode Client Only parameter of access services.

¡ Action for Violation—Action to take on the user who violates a check item. The action can be Kick Out or Monitor. The Kick Out option disconnects the online user or rejects the access request. The Monitor option logs the violation without affecting the user state. For more information about the violation logs, see "Managing authentication violation logs."

UAM checks the selected items on the user endpoint. The check items include:

- Disable Proxy Server—Prohibits use of proxy servers.

- Disable Proxy Setting in IE—Prohibits use of proxy settings in the Internet Explorer browser.

- Disable Multiple NICs—Prohibits use of more than one NIC.

- Prohibit Multiple OSs—Prohibits installation of more than one Windows operating system.

- Prohibit Multi-IP on Authenticated NIC—Prohibits the authenticated NIC from using more than one IP address.

- Forbid Modifying MAC—Prohibits modifying the MAC address of the authenticated NIC.

- Reject Duplicate MAC Addresses—Prohibits the user from using the same MAC address as an online user.

- Block VMware NAT Service—Prohibits the user from setting vNICs to NAT mode on VMs. This option prevents unauthorized VMs from accessing network resources by using the host computer's IP address.

- Block VMware USB Service—Prohibits the user from using the services named VMWareHostd and VMUSBArbService. This option prevents VMs from using the USB devices that are mounted to the host computer. Select both Block VMware NAT Service and this option to prohibit the host computer from sharing the wireless hotspots that are created on the vNICs of VMs.

- Prohibit from Running on Virtual Machine—Prohibits the user from running the iNode client on a virtual machine.

- IP Address Assignment Method—Checks the IP address assignment method on the endpoint: All, Static, or Dynamic.

3. To return to the access policy list page, click Back.

Adding an access policy

1. Access the access policy list page.

2. Click Add.

The Add Access Policy page opens, comprising the Basic Information, Authorization Information, Authentication Binding Information, and User Client Configuration areas.

3. Configure the Basic Information area parameters:

¡ Access Policy Name—Enter a unique name of the access policy.

¡ Description—Enter a description of the access policy to facilitate maintenance.

¡ Service Group—Select a service group from the list to assign the access policy to that group for privilege-based management. Select Ungrouped if you do not want to assign the access policy to any service group.

4. Configure the Authorization Information area parameters:

¡ Access Period—Select an access period policy from the list. For more information about access period policies, see "Configuring access period policies."

¡ Allocate IP—Specify whether UAM requires an IP address be specified when an operator attempts to assign an access account a service that uses this access policy. UAM assigns the specified IP address to the user who passes authentication by using that access account. This parameter applies only to PPP authentication methods, for example, L2TP and PPPoE.

¡ Downstream Rate—Enter an upper limit of the download rate for the access user. This parameter takes effect only when the access device is an HP ProCurve or Comware switch. Support for the parameter on the HP Comware switches depends on the device model.

¡ Upstream Rate—Enter an upper limit of the upload rate for the access user. This parameter takes effect only when the access device is an HP ProCurve or Comware switch. Support for the parameter on the HP Comware switches depends on the device model.

¡ Priority—Enter a priority of packets to forward by the access device for the access user. This parameter takes effect only when the access device is an HP ProCurve or Comware switch. Support for the parameter on the HP Comware switches depends on the device model.

¡ Deploy User Group—Enter the name of the user group to assign to the user through the access device. Make sure the access device is an SSL VPN device and already contains the user group.

¡ Preferred EAP Type—Select a preferred EAP type from the list. During EAP authentication, UAM deploys this EAP type preferentially to the client. Options are EAP-MD5, EAP-TLS, EAP-TTLS, and EAP-PEAP. EAP-TLS, EAP-TTLS, and EAP-PEAP are certificate-based authentication types. For more information about certificate authentication, see "Configuring certificate authentication."

¡ Subtype—Select a subtype when the preferred EAP type is EAP-TTLS or EAP-PEAP. Options are EAP-MSCHAPv2, EAP-MD5, and EAP-GTC.

¡ EAP Auto Negotiate—Select whether to enable automatic negotiation. EAP automatic negotiation enables UAM to permit the authentication request from a client if the EAP authentication type on the client and the preferred EAP type on UAM do not match.

UAM examines the preferred EAP type and subtype settings only for EAP authentication. When certificate authentication is disabled on the iNode PC client, UAM allows the client to perform PAP or CHAP authentication through the access device on which PAP or CHAP is configured. In this case, the EAP type configured on UAM is ignored.

UAM also permits the authentication request from an Android endpoint if the endpoint uses EAP-TTLS and the subtype PAP, regardless of the EAP type configured on UAM.

When the iNode PC client uses EAP-TTLS or EAP-PEAP, the authentication subtype is determined by UAM because the client does not support the subtype configuration.

¡ Deploy VLAN—Enter an ID or name of the VLAN to be assigned to the user through the access device. The value range of the VLAN ID is 1 to 4094. Other value is considered as a VLAN name. If you enter a VLAN name, make sure it already existing on the access device.

¡ Address Pool—Enter the name of the address pool from which the access device assigns addresses to access users. Make sure the address pool specified by the name is correctly configured on the access device. If the address pool does not exist on the access device, UAM cannot deploy the name of the address pool to the access device. Addresses in this address pool are typically IP addresses. The address pool can also be used for other types of addresses to match the protocols supported by the access device.

¡ Deploy User Profile—Select this option and enter a name of the user profile to assign to the user through the access device. Make sure the user profile already exists on the access device.

¡ Deploy ACL—Select this option to assign an ACL to the user through the access device.

The page refreshes to display the following options:

- Add Manually—Enter an ACL number or name. Make sure the ACL number or name already exists on the access device. The setting takes effect only on HP Comware switches and H3C devices.

- Select from List—Select an ACL from the ACL Management subcomponent of the IMC platform. If ACL Management is not deployed, this option is unavailable. The setting takes effect only on HP Comware switches and H3C devices.

- Access ACL List—Select an access ACL from the list. For information about configuring the access ACLs, see "Configuring access ACLs." The setting takes effect only on HP ProCurve switches.

5. On the Authentication Binding Information area, select the options to check in network access authentication. You can set the bound values on the binding information areas of the configuration page when you add or modify the access user account to which a service uses this access policy is assigned. Otherwise, UAM automatically stores parameter settings in the first successful authentication of the access user account as the bound values.

The binding options are in a logical AND relationship. To pass authentication, an access user must meet all selected binding requirements.

¡ Bind Access Device IP—Requires the access device to use the bound IP address. If the access device has multiple IP addresses, configure the IP address by which the device was added to the IMC platform.

¡ Bind Access Device Port—Requires the user endpoint to connect to an access device through the bound port. UAM uses the last portion of an interface number to match access ports. For example, if you enter 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

¡ Bind VLAN—Requires the packets of the user to carry the bound VLAN tag.

¡ Bind QinQ Double VLAN—Requires the QinQ packets of the user to carry the bound VLAN tags.

¡ Bind User IP—Requires the user endpoint to use the NIC with the bound IP address for authentication. If the endpoint has multiple NICs, configure the IP address of the NIC that will initiate the authentication process as the bound IP address.

¡ Bind User IPv6—Requires the user endpoint to use the NIC with the bound IPv6 address for authentication. If the endpoint has multiple NICs, configure the IPv6 address of the NIC that will initiate the authentication process as the bound IPv6 address.

¡ Bind User MAC—Requires the user endpoint to use the NIC with the bound MAC address for authentication. If the endpoint has multiple NICs, configure the MAC address of the NIC that will initiate the authentication process as the bound MAC address.

¡ Bind User IMSI—Requires the user endpoint to use the bound IMSI.

¡ Bind Computer Name—Requires the user endpoint to use the bound computer name.

¡ Bind Domain—Requires the bound domain to be used.

¡ Bind User SSID—Requires the bound SSID to be used.

¡ Bind Access Device SN—Requires the access device of the user endpoint to use the bound serial number.

¡ Control Access MAC Address—Requires UAM to check the MAC address of the user. For more information, see "Configuring access MAC addresses."

¡ Control Hard Disk Serial Number—Requires UAM to check serial numbers of the hard disks on the user endpoint. For more information, see "Configuring hard disk serial numbers."

¡ Enable SSID Access Control—Requires UAM to check the SSID to which the user endpoint is connected. For more information, see "Configuring access SSIDs."

¡ Control Motherboard Serial Number—Checks the serial number of the motherboard on the user endpoint. For more information, see "Configuring motherboard serial numbers."

¡ Bind User IMEI—Requires the user endpoint to use the bound international mobile equipment identification number (IMEI).

6. Configure the User Client Configuration area parameters:

¡ iNode Client Only—Select this option to require user authentication to be performed only through the iNode client.

¡ Authentication Password—Select the type of the passwords to be verified by UAM. Options are:

- Account Password—UAM verifies only the password of the user.

- Dynamic Password—UAM verifies only the verification code that the user dynamically gets through an SMS message. Verification codes typically have a short lifetime.

- Account Password + Dynamic Password—UAM verifies both the user password and the verification code that the user dynamically gets through an SMS message.

This parameter takes effect only on portal and SSL VPN connections in the iNode PC client.

If you select the Account Password + Dynamic Password option, perform the following tasks to ensure the verification success:

- Specify correct phone numbers in the account information for platform users and access users.

- Set the type of SMS notifications to Dynamic Password. For more information, see "Managing user SMS notifications."

- Configure the length of the dynamic password in system parameter settings if necessary. For more information, see "Configuring system parameters."

- Enable SMS dynamic password verification in the iNode PC client customization, so the password verification is required on the home page of the iNode PC client.

¡ Disable iNode DC for Windows—Select this option to block use of the iNode DC on Windows endpoints.

¡ Disable iNode DC for Linux/Mac OS—Select this option to block use of the iNode DC on Linux and Mac OS endpoints.

¡ Forbid Modifying IP When Online—Select this option to disable an online user from modifying the endpoint IP address. When the policy server feature is also enabled, the user is logged out immediately after the endpoint IP address is changed. When the policy server is disabled, the user is logged out several minutes after the endpoint IP address is changed. For information about configuring the policy server feature, see "Configuring policy server parameters."

¡ Auto Reconnect after Network Failure—Select this option to enable automatic reconnection for the iNode client in the case of a network failure.

¡ Retry Interval (Minutes)—Select an interval at which the iNode client automatically reconnects, in minutes. This parameter is displayed only when the Auto Reconnect after Network Failure option is selected.

¡ Retries—Select the maximum number of reconnection retries. This parameter is displayed only when the Auto Reconnect after Network Failure option is selected.

¡ Lowest Client Version—Configure the lowest version number of the iNode client that can be used on the network, such as 5.00-0105. Use this parameter with the iNode Client Only parameter of access services. If you select iNode Client Only for a service, the service users must use an iNode client of the specified version or a higher version for network access.

¡ Action for Violation—Select the action to take on the user who violates a check item. The action can be Kick Out or Monitor. The Kick Out option disconnects the online user or rejects the access request. The Monitor option logs the violation without affecting the user state. For more information about the violation logs, see "Managing authentication violation logs."

UAM checks the selected items on the user endpoint. The check items include:

- Disable Proxy Server—Prohibits the use of proxy servers.

- Disable Proxy Setting in IE—Prohibits the use of proxy settings in the Internet Explorer browser.

- Disable Multiple NICs—Prohibits the use of more than one NIC.

- Prohibit Multiple OSs—Prohibits installation of more than one Windows operating system.

- Prohibit Multi-IP on Authenticated NIC—Prohibits the authenticated NIC from using more than one IP address.

- Forbid Modifying MAC—Prohibits modifying the MAC address of the authenticated NIC.

- Reject Duplicate MAC Addresses—Prohibits the user's endpoint from using the same MAC address as an online user.

- Block VMware NAT Service—Prohibits the user from setting vNICs to NAT mode on VMs. When this option is enabled, unauthorized VMs cannot use the host computer's IP address for network access.

- Block VMware USB Service—Prohibits the user from using services named VMWareHostd and VMUSBArbService. When this option is enabled, VMs cannot use the USB devices that are mounted to the host computer. When both this option and Block VMware NAT Service are enabled, the host computer cannot share wireless hotspots that are created on the vNICs of VMs.

- Prohibit from Running on Virtual Machine—Prohibits the user from running the iNode client on a virtual machine.

- IP Address Assignment Method—Select the IP address assignment method on the endpoint: All, Static, or Dynamic.

7. Click OK.

The page refreshes to display the new access policy on the access policy list.

Modifying an access policy

1. Access the access policy list page.

2. Click the Modify icon for the access policy you want to modify.

The Modify Access Policy page opens.

3. Modify parameters of the access policy except its service group. For more information, see "Adding an access policy."

4. Click OK.

Deleting an access policy

An access policy cannot be deleted when it is selected in a service. To delete the access policy, first remove the association between the access policy and the service.

To delete an access policy:

1. Access the access policy list page.

2. Click the Delete icon for the access policy you want to delete.

A confirmation dialog box opens.

3. Click OK.

Configuring access SSIDs

UAM can control the accessible wireless networks by SSID. This feature must work with the iNode PC client.

When a service requires SSID check for wireless clients, UAM must perform SSID check for wireless clients according to the access control type.

· When the access control type is set to Deny, the following rules apply:

¡ If a match is found in the wireless client SSID list, the client cannot access the network.

¡ If no match is found in the wireless client SSID list, the client can access the network.

¡ If UAM cannot obtain the SSID bound to the client or the obtained SSID is empty, the client can access the network.

· When the access control type is set to Permit, the following rules apply:

¡ If a match is found in the wireless client SSID list, the client can access the network.

¡ If no match is found in the wireless client SSID list, the client cannot access the network.

¡ If UAM cannot obtain the SSID bound to the client or the obtained SSID is empty, the client can access the network.

The wireless client receives the SSID access control configuration from UAM and saves the configuration to the PC. The configuration also applies to the Windows built-in clients.

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Policy.

3. Click SSID Access Control on the upper right side of the access policy list.

Wireless client SSID list contents

¡ SSID—Service set identifier.

¡ Description—Description of the SSID.

¡ Modify—Click the Modify icon to modify the SSID.

¡ Delete—Click the Delete icon to delete the SSID.

The Set SSID Filter(Current: Deny/Permit) setting above the SSID list displays the SSID access control type.

Modifying the SSID access control type

The default SSID access control type is Deny. You can modify the access control type only when the SSID list is empty.

To modify the SSID access control type:

1. Access the wireless client SSID list page.

2. Click the Set SSID Filter(Current: Deny/Permit) link on the upper right side of the SSID list.

3. Select Permit or Deny from the SSID Filter list.

4. Click OK.

Querying SSIDs

1. Access the wireless client SSID list page.

2. In the Query Wireless Client SSIDs area, enter a partial or complete client SSID. For example, if you enter byod, all SSIDs that contain byod are matched.

3. Click Query. The list includes all SSIDs matching the query criteria.

4. Click Reset to clear the query criteria. The list includes all SSIDs in UAM.

Adding an SSID

1. Access the wireless client SSID list page.

2. Click Add to display the page for adding an SSID.

3. Enter an SSID and description.

4. Click OK.

Modifying an SSID

1. Access the wireless client SSID list page.

2. Click the Modify icon for the SSID you want to modify.

The page for modifying the SSID opens.

3. Modify the SSID and description.

4. Click OK.

Deleting SSIDs

1. Access the wireless client SSID list page.

2. Select one or more SSIDs you want to delete, or select the box in the table heading to select all SSIDs.

3. Click Delete.

A confirmation dialog box opens.

4. Click OK.

Configuring hard disk serial numbers

UAM uses a hard disk serial number list to control user access. This feature must work with the iNode PC client.

When a service requires hard disk serial number check to be performed, the iNode client collects all hard disk serial numbers of the user endpoint and sends the information to UAM. UAM permits the network access in the following conditions:

· A match is found in the permitted hard disk serial number list.

· The permitted hard disk serial number list is empty, which indicates that endpoints with any hard disk serial number can access the network.

If UAM fails to obtain the hard disk serial number or the obtained serial number is empty, UAM controls network access according to the setting for the Access for Endpoints with Hard Disk Serial numbers Unobtainded parameter:

· If the parameter is set to Permitted, UAM permits the network access.

· If the parameter is set to Denied, UAM prohibits the network access.

TIP:

Hard disk serial numbers can be checked by EVEREST Ultimate.

Accessing the hard disk serial number list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Policy.

3. Click Hard Disk Serial Number on the upper right side of the access policy list.

Hard disk serial number list contents

¡ Hard Disk Serial Number—A hexadecimal character string.

¡ Description—Detailed description about the hard disk serial number for easy maintenance.

¡ Modify—Click the Modify icon to modify the hard disk serial number.

Modifying access rights for endpoints with hard disk serial numbers unobtained

1. Access the hard disk serial number list page.

2. Click Access for Endpoints with Hard Disk Serial numbers Unobtainded in the upper right corner of the list.

3. Change the setting to Permitted or Denied.

Querying hard disk serial numbers

1. Access the hard disk serial number list page.

2. In the Query Hard Disk Serial Numbers area, enter a partial or complete hard disk serial number in the Hard Disk Serial Number field. For example, if you enter EF, all hard disk serial numbers that contain EF are matched.

3. Click Query. The list includes all hard disk serial numbers that match the query criteria.

4. Click Reset to clear the query criteria. The list includes all hard disk serial numbers in UAM.

Adding a hard disk serial number

1. Access the hard disk serial number list page.

2. Click Add to display the page for adding a hard disk serial number.

3. Enter a hard disk serial number (a hexadecimal character string) and a description to facilitate maintenance.

4. Click OK.

Importing hard disk serial numbers in batches

1. Access the hard disk serial number list page.

2. Click Batch Import.

The Import Hard Disk Serial Number wizard is displayed.

3. Click Browse to select the text file that stores hard disk serial numbers.

UAM supports importing only text files in the format of ANSI.

4. Select a column separator. Options include Space, TAB, comma (,), pound sign (#), and dollar sign ($).

5. Click Next to display the basic information page.

UAM automatically analyzes the column number in the text file and displays the number for the fields.

6. Specify the following basic information:

¡ Hard Disk Serial Number—Select a column number from the list. This parameter must be selected from the text file.

¡ Description—Select a column number from the list, or select Not Imported and enter a description in the field next to the list.

7. To preview the first 10 import results, click Preview. Click Close to return to the Import Motherboard Serial Number page.

8. Click OK.

UAM imports the hard disk serial numbers from the file.

It might take a few minutes to import a large number of hard disk serial numbers.

9. View the import result.

After the import is completed, the Operation Result page displays the total number of imported hard disk serial numbers and import failures.

If import failures exist, you can click Download to download or open the operation log. The log records the hard disk serial numbers that failed to be imported as well as the failure reason.

10. Click Back to return to the hard disk serial number list.

The imported hard disk serial numbers are displayed on the hard disk serial number list.

Modifying a hard disk serial number

1. Access the hard disk serial number list page.

2. Click the Modify icon for the hard disk serial number you want to modify.

The page for modifying the hard disk serial number opens.

3. Modify the hard disk serial number (a hexadecimal character string) and description.

4. Click OK.

Deleting hard disk serial numbers

1. Access the hard disk serial number list page.

2. Select one or more hard disk serial numbers you want to delete, or select the box in the table heading to select all hard disk serial numbers.

3. Click Delete.

A confirmation dialog box opens.

4. Click OK.

Configuring access MAC addresses

UAM can control user access by MAC address. When a service requires MAC address check for endpoint users, the following rules apply:

· If the endpoint MAC address is permitted, the user can access the network.

· If the endpoint MAC address is not permitted, the user cannot access the network.

· If UAM cannot obtain the endpoint's MAC address or the obtained MAC address is empty, the user can access the network.

The permitted access MAC address range is determined by a permitted or a denied access MAC list. For more information, see "Setting MAC filter."

Setting MAC filter

The following MAC filters are available:

· Permit—Enables the administrator to specify MAC addresses that are permitted to access the network. A user endpoint whose MAC address is in the permitted MAC address list can access the network successfully. Otherwise, the user cannot access the network. If no permitted MAC address is specified, all users can access the network.

· Deny—Enables the administrator to specify MAC addresses that are denied to access the network. A user endpoint whose MAC address is in the denied MAC address list is not allowed to access the network. Otherwise, the user can access the network.

To set the MAC filter:

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Condition.

3. Click Access MAC Address on the upper right side of the access policy list.

4. Remove all MAC addresses from the access MAC address list.

5. Click Set MAC Filter (Current: Permit) or Set MAC Filter (Current: Deny) on the upper right corner.

The Set MAC Filter page opens.

6. Select Permit or Deny for MAC Filter.

7. Click OK.

Accessing the access MAC address list page

The access MAC address list displays the current access MAC address type and all access MAC addresses.

To access and view the access MAC address list:

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Policy.

3. Click Access MAC Address on the upper right side of the access policy list.

Access MAC address list contents

¡ Set MAC Filter—Click the link to set a filter for the access MAC address list. For more information, see "Setting MAC filter."

¡ Permitted/Denied Access MAC—Endpoint MAC address that is allowed or prohibited for network access, according to the MAC filter setting.

¡ Description—Description of the access MAC address.

¡ Modify—Click the Modify icon to modify the MAC address.

Querying access MAC addresses

1. Access the access MAC address list page.

2. In the Query Access MAC Addresses field, enter a partial or complete access MAC address. For example, if you enter 65:FC, all access MAC addresses that contain 65:FC are matched.

3. Click Query.

The list includes all access MAC addresses that match the query criteria.

4. To restore default settings on the query area, click Reset.

The list includes all access MAC addresses in UAM.

Adding an access MAC address

1. Access the access MAC address list page.

2. Click Add to display the page for adding an access MAC address.

3. Enter a MAC address in the Permitted Access MAC or Denied Access MAC field, according to the MAC filter setting.

Valid MAC address formats include XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, and XX:XX:XX:XX:XX:XX.

4. Enter a description to facilitate maintenance.

5. Click OK.

Importing access MAC addresses in batches

1. Access the access MAC address list page.

2. Click Batch Import.

The Import Access MAC Address wizard is displayed.

3. Click Browse to select the text file that stores the target access MAC addresses.

UAM supports importing only text files in ANSI code.

4. Select a column separator. Options include Space, TAB, comma (,), pound sign (#), and dollar sign ($).

5. Click Next to display the basic information page.

UAM automatically analyzes the column number in the text file and displays the number for the fields.

6. Specify the following basic information:

¡ Access MAC Address—Select a column number from the list. This parameter must be selected from the text file.

¡ Description—Select a column number from the list, or select Not Imported and enter a description in the field next to the list.

7. Click Preview to view the expected import result.

8. Click OK.

UAM imports the MAC addresses from the file.

It may take a few minutes to import a large number of MAC addresses.

9. View the import result.

After import, the operation result page shows the total number of imported MAC addresses and import failures.

If the import fails, you can click Download to download or open the operation log that records the MAC addresses failed to be imported and the failure reason.

10. Click Back to return to the access MAC address list.

The imported access MAC addresses are displayed on the access MAC address list.

Modifying an access MAC address

1. Access the access MAC address list page.

2. Click the Modify icon for the access MAC address you want to modify.

The page for modifying the access MAC address opens.

3. Modify the access MAC address in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX.

4. Modify the description.

Detailed descriptions can facilitate maintenance.

5. Click OK.

Deleting access MAC addresses

1. Access the access MAC address list page.

2. Select one or more MAC addresses you want to delete, or select the box in the table heading to select all access MAC addresses.

3. Click Delete.

A confirmation dialog box opens.

4. Click OK.

Configuring motherboard serial numbers

UAM uses a motherboard serial number list to control user access. This feature must work with the iNode PC client.

If a service requires a motherboard serial number check, the iNode client obtains the motherboard serial number of the user endpoint and sends the information to UAM. UAM permits the network access under the following conditions:

· A match is found in the permitted motherboard serial number list.

· The permitted motherboard serial number list is empty, which indicates that endpoints with any motherboard serial number can access the network.

If UAM fails to obtain the motherboard serial number or the obtained serial number is empty, UAM controls the network access according to the setting for the Access for Endpoints with Motherboard Serial numbers Unobtainded parameter:

· If the parameter is set to Permitted, UAM permits the network access.

· If the parameter is set to Denied, UAM prohibits the network access.

TIP:

This feature is compatible with the earlier versions of the iNode PC client that do not support reporting motherboard serial numbers. UAM permits the network access for the earlier versions of the iNode PC client without performing a motherboard serial number check.

Viewing the motherboard serial number list

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Policy.

3. Click Motherboard Serial Number Pool on the upper right side of the access policy list.

Motherboard serial number list contents

¡ Endpoint Motherboard Serial Number—A hexadecimal character string (for example, 202020202020202020202020354D523347585143).

¡ Description—Description of the motherboard serial number.

¡ Modify—Click the Modify icon to modify the motherboard serial number.

Modifying access rights for endpoints with motherboard serial numbers unobtained

1. Access the motherboard serial number list page.

2. Click Access for Endpoints with Motherboard Serial numbers Unobtainded in the upper right corner of the list.

3. Change the setting to Permitted or Denied.

Querying endpoint motherboard serial numbers

1. Access the motherboard serial number list page.

2. In the Query Motherboard Serial Numbers area, enter a partial or complete motherboard serial number in the Motherboard Serial Number field. For example, if you enter EF, all motherboard serial numbers that contain EF are matched.

3. Click Query.

The list displays all motherboard serial numbers that match the query criteria.

4. Click Reset to clear the query criteria.

The list includes all motherboard serial numbers in UAM.

Adding a motherboard serial number

1. Access the motherboard serial number list page.

2. Click Add.

3. Enter a motherboard serial number (a hexadecimal character string) in the in the Motherboard Serial Number field.

4. Enter a description in the Description field.

5. Click OK.

Importing motherboard serial numbers in batches

1. Access the motherboard serial number list page.

2. Click Batch Import.

The Import Motherboard Serial Number page opens.

3. Click Browse to select a text or CSV file that stores motherboard serial numbers.

4. Select a column separator from the Column Separator list. Options include Space, TAB, comma (,), pound sign (#), and dollar sign ($).

Select the comma (,) if you have selected a CSV file.

5. Click Next to open the basic information page.

UAM automatically analyzes the column number in the text file and displays the number for the fields.

6. Specify the following basic information:

¡ Endpoint Motherboard Serial Number—Select a column number from the list. This parameter must be selected from the imported file.

¡ Description—Select a column number from the list, or select Not Imported, and then enter a description in the field next to the list.

7. To preview the first 10 import results, click Preview. Click Close to return the Import Motherboard Serial Number page.

8. Click OK.

UAM imports the motherboard serial numbers from the file.

It might take a few minutes to import a large number of motherboard serial numbers.

9. View the import results.

After the import is completed, the Operation Result page displays the total number of imported motherboard serial numbers and import failures.

If import failures exist, you can click Download to download or open the operation log. The log records the motherboard serial numbers that failed to be imported as well as the failure reason.

10. Click Back to return to the motherboard serial number list.

The imported motherboard serial numbers are displayed on the motherboard serial number list.

Modifying a motherboard serial number

1. Access the motherboard serial number list page.

2. Click the Modify icon for the motherboard serial number you want to modify.

The page for modifying the motherboard serial number opens.

3. Modify the motherboard serial number (a hexadecimal character string) and description.

4. Click OK.

Deleting motherboard serial numbers

1. Access the motherboard serial number list page.

2. Select one or more motherboard serial numbers you want to delete, or select the box in the table heading to select all motherboard serial numbers.

3. Click Delete.

A confirmation dialog box opens.

4. Click OK.

Configuring access ACLs

Operators can define access ACLs and apply them to access policies to restrict the devices that users can access. The access ACLs in UAM can be deployed only to HP ProCurve switches.

Accessing the access ACL list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Policy.

3. Click Access ACL on the upper right side of the access policy list.

Access ACL list contents

¡ ACL Name—Unique name of the access ACL. Click the name to display the ACL name details page.

¡ Service Group—Name of the service group to which the access ACL belongs.

¡ Description—Description of the access ACL.

¡ Modify—Click the Modify icon to modify settings of the access ACL.

¡ Delete—Click the Delete icon to delete the access ACL.

Managing access ACL rule sets

An access ACL rule set includes one or multiple ACL rules. You can gather the frequently used ACL rules into one ACL rule set, and then assign the rule set to different access ACLs.

Accessing the access ACL rule set list page

1. Access the access ACL list page.

2. Click the Access ACL Rule Set Management link above the access ACL list to open the Access ACL Rule Set Management page.

Access ACL rule set list contents

¡ Rule Set Name—Name of the access ACL rule set. Click the name to display detailed information about the ACL rule set.

¡ Description—Description of the access ACL rule set.

¡ Priority (Descending Order)—Priority level of the ACL rule set. To change the priority level of an ACL rule set, click the Move Up icon or Move Down icon for the rule set in this column. The ACL rule set list sorts ACL rule sets in descending order of priority. When matching packets to ACL rules, UAM checks ACL rule sets one by one in the display order of the ACL rule set list. In an ACL rule set, ACL rules are also sorted and matched in descending order of priority.

¡ Modify—Click the Modify icon to modify the access ACL rule set.

¡ Delete—Click the Delete icon to delete the access ACL rule set.

Viewing the access ACL rule set details

1. Access the Access ACL Rule Set Management page.

2. Click the name of an access ACL rule set to view its details.

Basic Information area parameter:

¡ Rule Set Name—Name of the access ACL rule set.

¡ Description—Description of the access ACL rule set.

ACL Rule List area parameters:

¡ Action—Action to take on packets that match the ACL rule: Permit or Deny. Permit forwards the packets. Deny drops the packets.

¡ Protocol—Name or number of the transport layer protocol. This field displays IP if the ACL rule applies to all transport layer protocols.

¡ Dest IP—Destination IP address.

¡ Dotted Decimal Mask—Subnet mask of the destination IP address, in dotted decimal notation.

¡ Dest Port—Destination port number. This parameter is displayed only when the transport layer protocol is TCP or UDP.

¡ Counting—Whether to count packets that match the ACL rule.

¡ Priority(high to low)—Priority level of the ACL rule. The ACL Rule List sorts ACL rules in descending order of priority. When matching packets, UAM checks ACL rules one by one in the display order of the ACL Rule List.

Adding an access ACL rule set

1. Access the Access ACL Rule Set Management page.

2. Click Add.

The Add Access ACL Rule Set page opens.

3. In the Basic Information area, configure the following parameters:

¡ Rule Set Name—Enter a unique name of the access ACL rule set.

¡ Description—Enter a description of the access ACL rule set to facilitate maintenance.

4. Configure ACL rules for the access ACL rule set:

a. On the ACL Rule List area, click Add.

The Add ACL Rule page opens.

b. Configure the following parameters:

- Action—Select an action, Permit or Deny. Permit forwards the matching packets. Deny drops the matching packets.

- Protocol—Select the name or number of the transport layer protocol. Select IP to apply the rule to all transport layer protocols.

- Dest IP—Enter the destination IP address in dotted decimal notation.

- Mask Length—Select the length of the subnet mask for the destination IP address. The Dotted Decimal Mask field is automatically populated with the dotted decimal notation of the subnet mask according to the selected mask length.

- Dest Port—Enter the destination port number. This parameter is displayed only when the transport layer protocol is TCP or UDP.

- Counting—Select whether to count packets that match the ACL rule.

- Insert at—Enter a sequence number for the ACL rule on the ACL rule list. For example, if you enter 1 for an ACL rule, the rule is listed in the first place. If this value is empty or greater than the maximum sequence number of existing ACL rules, the system adds the ACL rule to the end of the ACL rule list.

c. Click OK.

The ACL rule is added to the ACL Rule List.

d. To add more ACL rules, repeat the previous steps.

5. To change the priority level of an ACL rule, click the Move Up icon or Move Down icon for the rule in the Priority column. The ACL Rule List sorts ACL rules in descending order of priority. When matching packets, UAM checks ACL rules one by one in the display order of the ACL Rule List.

6. To modify an ACL rule, click the Modify icon for the rule.

7. To delete an undesired ACL rule, click the Delete icon for the rule.

8. Click OK.

Modifying an access ACL rule set

1. Access the access ACL rule set list.

2. Click the Modify icon for the access ACL rule set you want to modify.

Modify all parameters of the ACL rule set except the name. For more information, see "Adding an access ACL rule set."

3. Click OK.

Deleting an access ACL rule set

Access ACL rule sets that are used by access ACLs cannot be deleted. To delete such access ACL rule sets, first remove the association between access ACL rule sets and the access ACLs.

To delete an access rule set:

1. Access the access ACL rule set list.

2. Click the Delete icon for the access ACL rule set you want to delete.

A confirmation dialog box opens.

3. Click OK.

Viewing the access ACL details

1. Access the access ACL list page.

2. Click the name of the access ACL for which you want to view its details.

The Access ACL Details page includes the Basic Information and ACL Rules List areas.

Basic Information area parameters:

¡ ACL Name—Unique name of the access ACL.

¡ Default Action—Action to take on packets that do not match any ACL rule on the ACL Rule List area: Permit or Deny. Permit forwards the packets. Deny drops the packets.

¡ Count packets that do not match the ACL—Whether to count the packets that do not match any ACL rule on the ACL Rule List area.

¡ Description—Description of the access ACL.

¡ Service Group—Name of the service group to which the access ACL belongs.

- ACL Rules List area parameters:

¡ For the ACL rules that are manually added:

- Type—This parameter displays Add Manually.

- Action—Action to take on packets that match the ACL rule: Permit or Deny. Permit forwards the packets. Deny drops the packets.

- Protocol—Name or number of the transport layer protocol. This field displays IP if the ACL rule applies to all transport layer protocols.

- Dest IP—Destination IP address.

- Dotted Decimal Mask—Subnet mask of the destination IP address, in dotted decimal notation.

- Dest Port—Destination port number. This parameter is displayed only when the transport layer protocol is TCP or UDP.

- Counting—Whether to count packets that match the ACL rule.

- Priority(high to low)—Priority level of the ACL rule. The ACL Rule List sorts in descending order of priority. When matching packets, UAM checks ACL rules one by one in the display order of the ACL Rule List.

¡ For the ACL rule that is selected from an ACL rule set:

- Type—This parameter displays Select Access ACL Rule Set.

- Rule Set Name—Name of the ACL rule set.

- Description—Description of the ACL rule set.

- Priority(high to low)—Priority level of the ACL rule set. When matching packets, UAM checks ACL rule sets one by one in the display order of the ACL rule set list. In an ACL rule set, ACL rules are also sorted and matched in descending order of priority.

Adding an access ACL

1. Access the access ACL list page.

2. Click Add.

The Add Access ACL page opens.

3. In the Basic Information area, configure the following parameters:

¡ ACL Name—Enter a unique name of the access ACL.

¡ Default Action—Select an action to take on packets that do not match any ACL rule on the ACL Rule List area: Permit or Deny. Permit forwards the packets. Deny drops the packets.

¡ Count packets that do not match the ACL—Select this option if you want UAM to count the packets that do not match any ACL rule on the ACL Rule List area.

¡ Description—Enter a description of the access ACL to facilitate maintenance.

¡ Service Group—Select a service group from the list to assign the access ACL to that group for privilege-based management. Select Ungrouped if you do not want to assign the access ACL to any service group.

4. Manually add ACL rules for the access ACL as described in "Manually adding access ACL rules" or select ACL rules from ACL rule sets as described in "Selecting ACL rule sets."

Manually adding access ACL rules

1. On the ACL Rule List area, select Add Manually, and then click Add.

The Add ACL Rule window opens.

2. Configure the following parameters:

¡ Action—Select an action, Permit or Deny. Permit forwards the matching packets. Deny drops the matching packets.

¡ Protocol—Select the name or number of the transport layer protocol. Select IP to apply the rule to all transport layer protocols.

¡ Dest IP—Enter the destination IP address in dotted decimal notation.

¡ Mask Length—Select the length of the subnet mask for the destination IP address. The Dotted Decimal Mask field is automatically populated with the dotted decimal notation of the subnet mask according to the selected mask length.

¡ Dest Port—Enter the destination port number. This parameter is displayed only when the transport layer protocol is TCP or UDP.

¡ Counting—Select this option if you want UAM to count packets that match the ACL rule.

¡ Insert at—Enter a sequence number for the ACL rule on the ACL rule list. For example, if you enter 1 for an ACL rule, the rule is listed in the first place. If this value is empty or greater than the maximum sequence number of existing ACL rules, the system adds the ACL rule to the end of the ACL rule list.

3. Click OK.

The Add Access ACL page refreshes to display the new ACL rule on the ACL Rule List.

4. To add more ACL rules, repeat the previous steps.

5. To change the priority level of an ACL rule, click the Move Up icon or Move Down icon for that rule in the Priority column. The ACL Rule List sorts in descending order of priority level. Packets are matched against ACL rules in the order that they appear on the ACL Rule List.

a. To modify an ACL rule, click the Modify icon for the rule.

b. To delete an undesired ACL rule, click the Delete icon for the rule.

6. Click OK.

The page refreshes to display the new access ACL on the access ACL list.

Selecting ACL rule sets

1. On the ACL Rule List area, select Select Access ACL Rule Set, and then click Add.

2. The page for selecting ACL rule sets opens.

3. In the Query Access ACL Rule Sets area, enter a partial or complete ACL rule set name, and then click Query.

The Access ACL Rule Set List displays all ACL rule sets that match the query criterion.

To restore the full list, click Reset.

4. Select one or multiple ACL rule sets.

5. To delete an undesired ACL rule set, click the Delete icon for the rule set.

6. Click OK.

Modifying an access ACL

1. Access the access ACL list page.

2. Click the Modify icon for the access ACL you want to modify.

The Modify Access ACL page opens.

3. Modify parameters of the access ACL except its name and service group. For more information, see "Adding an access ACL."

4. Click OK.

Deleting an access ACL

An access ACL cannot be deleted when it is selected in an access policy. To delete the access ACL, first remove the association between the access ACL and the access policy.

To delete an access ACL:

1. Access the access ACL list page.

2. Click the Delete icon for the access ACL you want to delete.

A confirmation dialog box opens.

3. Click OK.

Managing endpoint identification

Endpoint identification maintains endpoint information (including vendor, type, and OS) to identify different endpoint devices. The endpoint information helps manage access scenarios and perform transparent authentication on smart endpoint devices.

UAM supports different resource types for endpoint identification. When the features of an endpoint device match more than one resource type, the resource type that has the highest priority takes effect. The resource type priorities vary by identification tasks, as described in Table 16.

Table 16 Resource priorities in endpoint identification

Endpoint identification tasks	Resource types in descending priority order
Endpoint vendor identification	· MAC address · iNode client · DHCP character · HTTP user agent
Endpoint vendor identification
Endpoint type identification Endpoint OS identification	· iNode client · DHCP character · HTTP user agent · MAC address
Endpoint type identification Endpoint OS identification

Managing endpoint fingerprint

Endpoint fingerprint includes endpoint vendors, endpoint types, and endpoint OSs.

Managing endpoint vendors

UAM preloads well-known endpoint vendors and supports user-defined vendors.

Accessing the vendor list page

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Fingerprint.

3. Click the Vendor tab.

The list includes all endpoint vendors.

Vendor list contents

¡ Vendor—Unique name of the endpoint vendor.

¡ Description—Description of the endpoint vendor.

¡ Modify—Click the Modify icon to modify settings of the endpoint vendor.

¡ Delete—Click the Delete icon to delete the endpoint vendor.

Querying endpoint vendors

1. Access the vendor list page.

2. On the Query Vendors area, enter a partial or complete vendor name.

3. Click Query.

The list includes all endpoint vendors matching the name.

4. To restore default settings on the query area, click Reset.

The list includes all endpoint vendors.

Adding an endpoint vendor

1. Access the vendor list page.

2. Click Add.

The Add Vendor page opens.

3. Enter the unique name and a description for the endpoint vendor.

4. Click OK.

The page refreshes to display the new endpoint vendor on the vendor list.

Modifying an endpoint vendor

1. Access the vendor list page.

2. Click the Modify icon for the endpoint vendor you want to modify.

The Modify Vendor page opens.

3. Modify the description of the endpoint vendor. The vendor name cannot be modified.

4. Click OK.

Deleting an endpoint vendor

You can delete endpoint vendors that are not associated with any vendor groups and are not used by any DHCP character, HTTP user agent, or MAC address range for endpoint identification.

To delete an endpoint vendor:

1. Access the vendor list page.

2. Click the Delete icon for the endpoint vendor you want to delete.

A confirmation dialog box opens.

3. Click OK.

Managing endpoint types

UAM predefines most well-known endpoint types and also supports custom endpoint types.

Endpoint types are managed in a two-level hierarchy:

· The first level defines the endpoint categories, such as Smartphone, Tablet, PC, and TV.

· The second level defines specific endpoint models in each category. For example, HTC One X and Huawei Ascend P6 are endpoint models included in the first-level endpoint type named Smartphone.

Accessing the endpoint type list page

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Fingerprint.

3. Click the Endpoint Type tab.

The list includes all first-level endpoint types.

Endpoint type list contents

¡ Endpoint Type—Unique name of the endpoint type. Click the Expand icon or Collapse icon to expand or collapse the second-level endpoint types contained in it.

¡ Display Name—Display name of the endpoint type. The display name is displayed on the user endpoint. If this field is empty, the system deploys the value of the endpoint type to the browser of the user endpoint.

¡ Description—Description of the endpoint type.

¡ Add Subtype—Click the Add Subtype icon to add a second-level endpoint type to the endpoint type.

¡ Modify—Click the Modify icon to modify settings of the endpoint type.

¡ Delete—Click the Delete icon to delete the endpoint type.

Querying endpoint types

1. Access the endpoint type list page.

2. On the Query Endpoint Types area, enter a partial or complete name of the endpoint type you want to query.

3. Click Query.

The list includes all endpoint types matching the query criterion.

4. To restore default settings on the query area, click Reset.

The list includes all endpoint types.

Adding a first-level endpoint type

1. Access the endpoint type list page.

2. Click Add.

The Add Endpoint Type page opens.

3. Configure the following parameters:

¡ Endpoint Type—Enter a unique name of the first-level endpoint type.

¡ Display Name—Enter a display name of the first-level endpoint type. The display name is displayed on the user endpoint. If this field is empty, the system deploys the value of the endpoint type to the browser of the user endpoint.

¡ Description—Enter a description for the first-level endpoint type.

4. Click OK.

The page refreshes to display the new endpoint type on the endpoint type list.

Adding a second-level endpoint type

1. Access the endpoint type list page.

2. Click the Add Subtype icon for a first-level endpoint type.

The Add Endpoint Type page opens.

3. Configure the following parameters:

¡ Endpoint Type—Enter a unique name of the second-level endpoint type.

¡ Display Name—Enter a display name of the second-level endpoint type. The display name is displayed on the user endpoint. If this field is empty, the system deploys the value of the endpoint type to the browser of the user endpoint.

¡ Description—Enter a description for the second-level endpoint type.

4. Click OK.

Modifying an endpoint type

1. Access the endpoint type list page.

2. Click the Modify icon for the endpoint type you want to modify.

The Modify Endpoint Type page opens.

3. Modify the display name and description of the endpoint type. The Endpoint Type field cannot be modified.

4. Click OK.

Deleting an endpoint type

You can delete endpoint types except the following:

· Endpoint types that include one or more second-level endpoints.

· Endpoint types that are associated with endpoint type groups.

· Endpoint types that are used by DHCP characters, HTTP user agents, or MAC address ranges for endpoint identification.

To delete an endpoint type:

1. Access the endpoint type list page.

2. Click the Delete icon for the endpoint type you want to delete.

A confirmation dialog box opens.

3. Click OK.

Managing endpoint OSs

UAM preloads more than 150 common OSs that run on endpoint devices, and supports user-defined OSs.

OSs are managed in a two-level hierarchy:

· The first level defines the OS types, such as Google Android and Apple iOS/OS X.

· The second level defines specific OS version in each type. For example, Android 3.x and Android 4.x are specific versions included in the first-level endpoint OS named Android.

Accessing the OS list page

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Fingerprint.

3. Click the OS tab.

The list includes all endpoint OSs of the first level.

OS list contents

¡ OS—Unique name of the endpoint OS. Click the Expand icon or Collapse icon to expand or collapse the second-level OSs contained in it.

¡ Description—Description of the endpoint OS.

¡ Add Subsystem—Click the Add Sub-OS icon to add a sub-OS to the OS.

¡ Modify—Click the Modify icon to modify settings of the endpoint OS.

¡ Delete—Click the Delete icon to delete the endpoint OS.

Querying endpoint OSs

1. Access the OS list page.

2. On the Query OSs area, enter a partial or complete OS name.

3. Click Query.

The list includes all endpoint OSs matching the name.

4. To restore default settings on the query area, click Reset.

The list includes all first-level endpoint OSs.

Adding a first-level endpoint OS

1. Access the OS list page.

2. Click Add.

The Add OS page opens.

3. Enter the unique name and a description for the endpoint OS.

4. Click OK.

The page refreshes to display the new endpoint OS on the OS list.

Adding a second-level endpoint OS

1. Access the OS list page.

2. Click the Add Sub-OS icon for an endpoint OS.

The Add OS page opens.

3. Enter the unique name and a description for the second-level endpoint OS.

4. Click OK.

Modifying an endpoint OS

1. Access the OS list page.

2. Click the Modify icon for the endpoint OS you want to modify.

The Modify OS page opens.

3. Modify the description of the endpoint OS. The OS name cannot be modified.

4. Click OK.

Deleting an endpoint OS

You can delete endpoint OSs except the following:

· Endpoint OS types that include one or more second-level endpoint OSs.

· Endpoint OSs that are associated with OS groups.

· Endpoint OSs that are used by DHCP characters or HTTP user agents for endpoint identification.

To delete an endpoint OS:

1. Access the OS list page.

2. Click the Delete icon for the endpoint OS you want to delete.

A confirmation dialog box opens.

3. Click OK.

Managing endpoint identification characters

UAM uses the following methods to identify endpoints:

· iNode client

· DHCP character

· HTTP user agent

· MAC address

Endpoint identification by the iNode client is an automatic process and does not require a parameter to be configured in UAM. The following information describes the endpoint identification methods except the iNode client method.

Managing DHCP characters

UAM works with the DHCP agent to identify endpoint information from DHCP requests. The DHCP agent is installed on the DHCP server, and monitors DHCP requests to provide the DHCP character strings to UAM. UAM searches the DHCP characters for a match to determine the endpoint information.

Accessing the DHCP character page

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Profiling.

3. Click the DHCP Character tab.

The DHCP Character tab displays all DHCP characters for endpoint identification.

DHCP character list contents

¡ DHCP Character—Unique string of the DHCP character.

¡ Vendor—Vendor of the endpoint device that is identified by the DHCP character.

¡ Endpoint Type—Type of the endpoint device that is identified by the DHCP character.

¡ OS—OS of the endpoint device that is identified by the DHCP character.

¡ Description—Description of the endpoint device that is identified by the DHCP character.

¡ Modify—Click the Modify icon to modify the DHCP character.

¡ Delete—Click the Delete icon to delete the DHCP character.

Querying DHCP characters

1. Access the DHCP character list page.

2. On the Query DHCP Characters area, enter one or more of the following query criteria:

¡ DHCP Character—Enter a partial or complete string of the DHCP character.

¡ Vendor—Enter a partial or complete name of the endpoint vendor.

¡ Endpoint Type—Enter a partial or complete name of the endpoint type.

¡ OS—Enter a partial or complete name of the endpoint OS.

The query ignores empty fields.

3. Click Query.

The list includes all DHCP characters matching the query criterion.

4. To restore default settings on the query area, click Reset.

The list includes all DHCP characters.

Adding a DHCP character

1. Access the DHCP Character tab.

2. Click Add.

The Add DHCP Character page opens.

3. Configure the following parameters:

¡ DHCP Character—Enter a unique string as the DHCP character. The string contains one or more integers separated by commas (,). The value range for each integer is 0 to 255.

¡ Vendor—Select the vendor of the endpoint device that is identified by the DHCP character. For information about vendor configuration, see "Managing endpoint vendors."

¡ Endpoint Type—Select the type of the endpoint device that is identified by the DHCP character. For information about endpoint type configuration, see "Managing endpoint types."

¡ OS—Select the OS of the endpoint device that is identified by the DHCP character. For information about OS configuration, see "Managing endpoint OSs."

¡ Description—Enter a description of the endpoint device that is identified by the DHCP character.

4. Click OK.

The page refreshes to display the new entry on the DHCP character list.

Importing DHCP characters in batches

1. Access the DHCP character list page.

2. Click Batch Import.

3. For the Import File box, click Browse to select the text file that saves the DHCP characters.

UAM supports importing only text files in ANSI format.

4. Select the column separator from the list. Options include TAB, pound sign (#), and dollar sign ($).

5. Click Next to display the basic information configuration page.

UAM automatically analyzes the number of columns available in the text file, and displays the result in the list of each parameter.

6. Configure the following parameters:

¡ DHCP Character—Select a column number as the DHCP character. This parameter must be selected from the text file.

¡ Vendor—Select a column from the list, or select Not Imported and enter a vendor in the field next to the list.

¡ Endpoint Type—Select a column number from the list, or select Not Imported and enter an endpoint type in the field next to the list.

¡ OS—Select a column number from the list, or select Not Imported and enter an OS in the field next to the list.

¡ Description—Select a column number from the list, or select Not Imported and enter a description in the field next to the list.

7. Click Preview to view the expected import result.

8. Click OK to import the DHCP characters in batches.

9. View the import result.

After import, the operation result page shows the total number of imported DHCP characters and import failures.

If the import fails, you can click Download to download or open the operation log that records the DHCP characters failed to be imported and the failure reason.

10. Click Back to return to the DHCP character list.

The imported DHCP characters are displayed on the DHCP character list.

Modifying a DHCP character

1. Access the DHCP character list page.

2. Click the Modify icon for the DHCP character you want to modify.

The Modify DHCP Character page opens.

3. Modify the parameters in the configuration. For more information, see "Adding a DHCP character."

4. Click OK.

Deleting a DHCP character

1. Access the DHCP character list page.

2. Click the Delete icon for the DHCP character you want to delete.

A confirmation dialog box opens.

3. Click OK.

Managing HTTP user agents

UAM monitors HTTP requests for Web authentication users and searches the HTTP user agent information for a match to identity an endpoint.

Accessing the HTTP user agent page

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Profiling.

3. Click the HTTP User Agent tab.

The HTTP User Agent tab displays all configurations for identifying endpoint devices by the HTTP user agent.

HTTP user agent list contents

¡ HTTP User Agent—Unique string of the HTTP user agent.

¡ Vendor—Vendor of the endpoint device that is identified by the HTTP user agent.

¡ Endpoint Type—Type of the endpoint device that is identified by the HTTP user agent.

¡ OS—OS of the endpoint device that is identified by the HTTP user agent.

¡ Description—Description of the endpoint device that is identified by the HTTP user agent.

¡ Modify—Click the Modify icon to modify the HTTP user agent.

¡ Delete—Click the Delete icon to delete the HTTP user agent.

Querying HTTP user agents

1. Access the HTTP user agent list page.

2. On the Query HTTP User Agents area, enter one or more of the following query criteria:

¡ HTTP User Agent—Enter a partial or complete string of the HTTP user agent.

¡ Vendor—Enter a partial or complete name of the endpoint vendor.

¡ Endpoint Type—Enter a partial or complete name of the endpoint type.

¡ OS—Enter a partial or complete name of the endpoint OS.

The query ignores empty fields.

3. Click Query.

The list includes all HTTP user agents matching the query criteria.

4. To restore default settings on the query area, click Reset.

The list includes all HTTP user agents.

Adding an HTTP user agent

1. Access the HTTP user agent list page.

2. Click Add.

The Add HTTP User Agent page opens.

3. Configure the following parameters:

¡ HTTP User Agent—Enter a unique string for the HTTP user agent. The string is the key information obtained from the User-Agent field of an HTTP request packet. For example, when a user accesses the network through the Safari browser on an iPad, the User-Agent field of the HTTP request packet is Mozilla/5.0(iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B314 Safari/531.21.10. You can configure the string as iPad&&like Mac OS X to represent the endpoint type and OS information, where the double ampersand (&&) indicates the AND operation.

¡ Vendor—Select the vendor of the endpoint device that is identified by the HTTP user agent. For information about configuring vendor, see "Managing endpoint vendors."

¡ Endpoint Type—Select the type of the endpoint device that is identified by the HTTP user agent. For information about configuring endpoint type, see "Managing endpoint types."

¡ OS—Select the OS of the endpoint device that is identified by the HTTP user agent. For information about configuring endpoint type, see "Managing endpoint OSs."

¡ Description—Enter a description of the endpoint device that is identified by the HTTP user agent.

4. Click OK.

The page refreshes to display the new entry on the HTTP user agent list.

Importing HTTP user agents in batches

1. Access the HTTP user agent list page.

2. Click Batch Import.

3. For the Import File box, click Browse to select the text file that saves the HTTP user agent information.

UAM supports importing only text files in ANSI format.

4. Select the column separator from the list. Options include TAB, comma (,), pound sign (#), and dollar sign ($).

5. Click Next to display the basic information configuration page.

UAM automatically analyzes the number of columns available in the text file, and display the result in the list of each parameter.

6. Specify the following basic information:

¡ HTTP User Agent—Select a column number as the HTTP user agent. This parameter must be selected from the text file.

¡ Vendor—Select a column number from the list, or select Not Imported and enter a vendor in the field next to the list.

¡ Endpoint Type—Select a column number from the list, or select Not Imported and enter an endpoint type in the field next to the list.

¡ OS—Select a column number from the list, or select Not Imported and enter an OS in the field next to the list.

¡ Description—Select a column number from the list, or select Not Imported and enter a description in the field next to the list.

7. Click Preview to view the expected import result.

8. Click OK to import the HTTP user agents in batches.

9. View the import result.

After import, the operation result page shows the total number of imported HTTP user agents and import failures.

If the import fails, you can click Download to download or open the operation log that records the HTTP user agents that failed to be imported and the failure reason.

10. Click Back to return to the HTTP user agent list.

The imported HTTP user agents are displayed on the HTTP user agent list.

Modifying an HTTP user agent

1. Access the HTTP user agent list page.

2. Click the Modify icon for the HTTP user agent you want to modify.

The Modify HTTP User Agent page opens.

3. Modify the parameters in the configuration. For more information, see "Adding an HTTP user agent."

4. Click OK.

Deleting an HTTP user agent

1. Access the HTTP user agent list page.

2. Click the Delete icon for the HTTP user agent you want to delete.

A confirmation dialog box opens.

3. Click OK.

Managing MAC addresses

UAM can use the MAC address of an endpoint to determine endpoint information.

Accessing the MAC address page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Endpoint Profiling.

3. Click the MAC Address tab.

The MAC Address tab displays all configurations for identifying endpoint devices by MAC address.

MAC address list contents

¡ Start MAC Address/End MAC Address—Unique range of MAC addresses for endpoint identification.

¡ Vendor—Vendor of the endpoint device that is identified by the MAC address range.

¡ Endpoint Type—Type of the endpoint device that is identified by the MAC address range.

¡ Description—Description of the endpoint device that is identified by the MAC address range.

¡ Modify—Click the Modify icon to modify the MAC address range for endpoint identification.

¡ Delete—Click the Delete icon to delete the MAC address range for endpoint identification.

Querying MAC addresses

1. Access the MAC address list page.

2. On the Query MAC Addresses area, enter one or more of the following query criteria:

¡ MAC Address—Enter a complete MAC address in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX. This query criterion filters out all MAC address ranges that contain the specified MAC address.

¡ Vendor—Enter a partial or complete name of the endpoint vendor.

¡ Endpoint Type—Enter a partial or complete name of the endpoint type.

The query ignores empty fields.

3. Click Query.

The list includes all MAC addresses matching the query criterion.

4. To restore default settings on the query area, click Reset.

The list includes all MAC addresses in UAM.

Adding a MAC address range

1. Access the MAC address list page.

2. Click Add.

The Add MAC Address page opens.

3. Configure the following parameters:

¡ Start MAC Address/End MAC Address—Unique range of MAC addresses for endpoint identification. The end MAC address cannot be smaller than the start MAC address. Both MAC addresses must be in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX. MAC address ranges in UAM cannot overlap.

¡ Vendor—Select the vendor of the endpoint device that is identified by the MAC address range. For information about configuring vendors, see "Managing endpoint vendors."

¡ Endpoint Type—Select the type of the endpoint device that is identified by the MAC address range. For information about configuring endpoint types, see "Managing endpoint types."

¡ Description—Enter a description of the endpoint device that is identified by the MAC address range.

4. Click OK.

The page refreshes to display the new entry on the MAC address List.

Importing MAC address ranges in batches

1. Access the MAC address list page.

2. Click Batch Import.

3. For the Import File box, click Browse to select the text file that saves the MAC address ranges.

UAM supports importing only text files in ANSI format.

4. Select the column separator from the list. Options include TAB, comma (,), pound sign (#), and dollar sign ($).

5. Click Next to display the basic information configuration page.

UAM automatically analyzes the number of columns available in the text file, and display the result in the list of each parameter.

6. Configure the following parameters:

¡ Start MAC Address/End MAC Address—Select a column number as the start MAC address/end MAC address. This parameter must be selected from the text file.

¡ Vendor—Select a column number from the list, or select Not Imported and enter a vendor in the field next to the list.

¡ Endpoint Type—Select a column number from the list, or select Not Imported and enter an endpoint type in the field next to the list.

¡ Description—Select a column number from the list, or select Not Imported and enter a description in the field next to the list.

7. Click Preview to view the expected import result.

8. Click OK to import the MAC address ranges for endpoint identification in batches.

9. View the import result.

After import, the operation result page shows the total number of imported MAC addresses and import failures.

If the import fails, you can click Download to download or open the operation log that records the MAC addresses failed to be imported and the failure reason.

10. Click Back to return to the MAC address list.

The imported MAC address ranges are displayed on the MAC address list.

Modifying a MAC address range

1. Access the MAC address list page.

2. Click the Modify icon for the MAC address range you want to modify.

The Modify MAC Address page opens.

3. Modify the parameters in the configuration. For more information, see "Adding a MAC address range."

4. Click OK.

Deleting a MAC address range

1. Access the MAC address list page.

2. Click the Delete icon for the MAC address range you want to delete.

A confirmation dialog box opens.

3. Click OK.

Endpoint identification configuration example

Access scenarios obtain the following information from Endpoint Identification Management:

· Endpoint vendor

· Endpoint type

· Endpoint OS

To provide more access scenarios, operators can define new endpoint devices for endpoint identification.

To define a new Samsung endpoint type that runs Android:

1. Add a vendor.

This step is optional because UAM already contains Samsung in the system-defined vendors. For more information, see "Adding an endpoint vendor."

2. Add an endpoint type:

a. Click the User tab.

b. From the navigation tree, select User Endpoint > Endpoint Fingerprint.

c. Click the Endpoint Type tab.

d. Click Add.

e. Enter Samsung as the name and description of the endpoint type.

f. Click OK.

3. Add an OS.

This step is optional because UAM already contains Android in the system-defined OSs. For more information, see "Adding a first-level endpoint OS."

4. Modify DHCP characters.

UAM categorizes Samsung endpoint devices as smartphones or mobiles. To modify the configurations:

a. From the navigation tree, select User Endpoint > Endpoint Fingerprint.

b. Click the DHCP Character tab.

c. In the query area, enter Samsung in the Vendor field and click Query.

The list includes all DHCP characters that match the query criterion.

d. Click the Modify icon for the first entry on the list, select Samsung from the Endpoint Type list, and click OK.

e. Repeat the previous step for all the remaining entries.

5. Modify HTTP user agents.

a. From the navigation tree, select User Endpoint > Endpoint Fingerprint.

b. Click the HTTP User Agent tab.

c. In the query area, enter Samsung in the Vendor field and click Query.

The list includes all HTTP user agents that match the query criterion.

d. Click the Modify icon for the first entry on the list, select Samsung from the Endpoint Type list, and click OK.

e. Repeat the previous step for all the remaining entries.

6. Modify MAC addresses.

This step is optional because UAM has system-defined MAC address ranges for Samsung endpoint devices. For more information, see "Adding a MAC address range."

Configuring BYOD

Overview

BYOD offers a solution to implement scenario-specific user access control. An access scenario defines the access policy that a user uses to access the network from different access conditions.

To implement BYOD, complete the following tasks:

1. Define access conditions and access policies in UAM.

2. Define access scenarios and assign the access policies to access conditions in each access scenario when you add a service.

3. Assign the service to users.

When a user accesses the network from an access scenario, UAM applies the matching access policy to the user.

For more information about access conditions and access policies, see "Configuring access conditions" and "Configuring user access policies."

Configuring access services

A service contains a group of access policies specific to access scenarios and default access policies. UAM uses services to control user access authentication and network access behaviors.

Accessing the access service list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Service.

The list includes all services.

Access service list contents

¡ Service Name—Unique name of the service in UAM. Click the name to display the service name details page.

¡ Description—Description of the service.

¡ Service Suffix—Identifies the name of the domain to be used for endpoint user authentication. The user name and service suffix entered by the endpoint user is related to the authentication domain, as described in Table 17.

¡ Service Group—Service group to which the service belongs.

¡ Modify—Click the Modify icon to modify the service.

¡ Delete—Click the Delete icon to delete the service.

The commands listed in Table 17 are available on HP Comware devices. The commands used on other access devices can vary.

Table 17 Service suffix and other configurations

Authentication user name	Authentication domain on the access device	Commands configured on the access device	Service suffix in UAM	Username prefix conversion mode
X@Y Y\X Y/X	Y	user-name-format with-domain	Y	Change to Suffix
X@Y Y\X Y/X	Y	user-name-format without-domain	None	Remove
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format with-domain	[Default Domain]	Change to Suffix
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format without-domain	None	Remove

3. Click Refresh on top of the list to view the latest services.

Viewing access service details

1. Access the access service list page.

2. Click the name of the service whose detailed information you want to view.

The Access Service Details page opens.

Basic Information

¡ Service Name—Unique name of the service in UAM.

¡ Service Suffix—Identifies the name of the domain to be used for endpoint authentication. The user name and service suffix entered by the endpoint user is related to the authentication domain. For more information, see Table 17.

¡ Service Group—Service group to which the service belongs.

¡ Default Access Policy—Name of the access policy applied to users matching no predefined access scenario. Click the policy name to view its details. Do not use means to deny the user access to the network. For more information about access policies, see "Configuring access policies."

¡ Default Security Policy—Name of the security policy applied to users matching no predefined access scenario. Click the policy name to view its details. If no default security policy is configured, this field displays Do not use. This field is displayed only when the EAD component is installed. For more information, see HPE Intelligent Management Center v7.3 EAD Security Policy Administrator Guide.

¡ Default Internet Access Policy—Name of the Internet access configuration applied to users matching no predefined access scenario. Click the name to view its details. If no default Internet access configuration is configured, this field displays Do not use. This field is displayed only when the EAD component is installed. For more information, see HPE Intelligent Management Center v7.3 EAD Security Policy Administrator Guide.

¡ Default Proprietary Attribute Assignment Policy—Name of the proprietary attribute assignment policy applied to users matching no predefined access scenario. Click the policy name to view its details. If no default proprietary attribute assignment policy is configured, this field displays Do not use. For more information, see "Configuring proprietary attribute assignment policies."

¡ Default BYOD Page—Name of the BYOD page applied to users matching no predefined access scenario. For more information about BYOD, see "Configuring MAC/BYOD authentication."

¡ Default Max. Number of Bound Endpoints—Maximum number of endpoints to be bound to the same user account in access scenarios that are not included in the service. When endpoints bound to an account reach the maximum value, no more endpoints can access the network by using the account. A value of 0 indicates there is no limit on the number of bound endpoints.

¡ Default Max. Number of Online Endpoints—Maximum number of online endpoints using the same user account in access scenarios that are not included in the service. When online endpoints of an account reach the maximum value, no more endpoints can access the network by using the account. A value of 0 means not limited.

¡ Daily Max. Online Duration—Total online duration (in minutes) allowed per day for an endpoint using the service. If this value is reached, the account is forced offline and is not allowed to access the network on the same day. The value for this parameter can only be an integer. A value of 0 means not limited.

¡ Description—Description of the service.

¡ Available—Identifies whether the service is available to endpoint users.

¡ Transparent Authentication—Identifies whether the service supports transparent authentication. For more information about transparent authentication, see "Configuring transparent portal authentication" and "Transparent MAC authentication."

Access Scenario List

The Access Scenario List displays policies that are configured for different access scenarios. The Access Scenario Name column uniquely identifies a set of access conditions, and other columns display the access policies corresponding to the access conditions. Click the Details icon for an entry to view its details.

The Security Policy and Internet Access Configuration columns appear only when the EAD component is installed.

The access scenarios displayed in the Access Scenario List are in descending order of priority. If a user matches multiple access scenarios, the access policy that includes the access scenario with the highest priority applies to the user.

User Group That Applies for the Service

This area displays all users groups in UAM. The user groups that are selected have applied for the service. UAM automatically assigns the service to all users in the selected user groups next morning.

This area is displayed only when the system parameter Apply for Service by User Group is enabled. For more information about system parameters, see "Configuring system parameters."

3. Click Back to return to the access service list page.

Adding an access service

1. Access the access service list page.

2. Click Add.

The Add Access Service page opens.

3. Configure basic information:

¡ Service Name—Enter the unique name of the service.

¡ Service Suffix—Enter the service suffix. UAM uses the service suffix to identify the name of the domain to be used for endpoint authentication. The user name and service suffix entered by the endpoint user is related to the authentication domain. For more information, see Table 17.

¡ Service Group—Select a service group or Ungrouped from the list. You can add services to different service groups to facilitate management.

¡ Default Access Policy—Select an access policy for users who do not match an access scenario, or select Do not use to prevent these users from accessing the network. For information about access policies, see "Configuring user access policies."

¡ Default Security Policy—Select a security policy for users who do not match an access scenario, or select Do not use to not use a security policy for these users. This field is displayed only when the EAD component is installed. For more information about security policies, see HPE Intelligent Management Center v7.3 EAD Security Policy Administrator Guide.

¡ Default Internet Access Policy—Select an Internet access configuration for users who do not match an access scenario, or select Do not use to disable the Internet access configuration for these users. This field is displayed only when the EAD component is installed. For more information, see HPE Intelligent Management Center v7.3 EAD Security Policy Administrator Guide.

¡ Default Proprietary-Attribute Assignment Policy—Select a proprietary-attribute assignment policy for users who do not match an access scenario, or select Do not use to not use a proprietary-attribute assignment policy for these users. For more information, see "Configuring proprietary attribute assignment policies."

¡ Default BYOD Page—Select a BYOD page for users who do not match an access scenario. For more information about BYOD authentication and the BYOD page, see "Configuring MAC/BYOD authentication" and "Managing and applying BYOD page sets."

¡ Default Max. Number of Bound Endpoints—Enter the maximum number of endpoints to be bound to the same access user account for users who do not match an access scenario. To disable the limit, enter 0.

If an access user is assigned more than one service, the total number of endpoint devices that can be bound to the same account is determined by the following parameters:

- Default Max. Number of Bound Endpoints of each service.

- Max. Devices for Single Account of each access scenario in the services.

- Max. Devices for Single Account in the global user endpoint settings.

The user must pass the following check on the number of bound endpoint devices:

- If the user does not match an access scenario, the number of bound devices cannot exceed the Default Max. Number of Bound Endpoints of the service.

- If the user matches an access scenario, the number of bound devices cannot exceed the Max. Devices for Single Account of the matching access scenario.

- The total number of bound devices in scenarios of all assigned services cannot exceed the Max. Devices for Single Account in the global user endpoint settings.

¡ Default Max. Number of Online Endpoints—Enter the maximum number of online endpoints using the same user account in access scenarios that are not included in the service. When online endpoints of an account reach the maximum value, no more endpoints can access the network by using the account. A value of 0 indicates there is no limit on the number of concurrent online users. To disable the limit, enter 0.

¡ Description—Enter a description of the service to facilitate maintenance.

¡ Available—Select this option to make the service available to endpoint users.

¡ Transparent Authentication—Select this option to enable transparent authentication. For more information, see "Configuring transparent portal authentication" and "Transparent MAC authentication."

4. Configure the Access Scenario List, which includes policies specified for a set of access conditions.

a. Click Add in the Access Scenario List area.

The Add Access Scenario window opens.

b. Enter the unique name of the access scenario in the Access Scenario Name field.

An access service cannot include access scenarios of the same name.

c. Configure access condition information:

All parameters are in a logical AND relationship. A user matching all the parameter settings matches the access scenario.

- Access Location Group—Select the access location group of the user from the list, or select Unlimited to match any access device.

- Endpoint IP Group—Select the endpoint IP group to which the user's IP address belongs, or select Unlimited to match any endpoint IP address.

- SSID Group—Select the SSID group to which the wireless user attempts to connect, or select Unlimited to match any SSID.

- Endpoint MAC Group—Select the endpoint MAC group to which the MAC address of the user endpoint must belong, or select Unlimited to match any endpoint MAC address.

- Endpoint Vendor Group—Select the endpoint vendor group to which the vendor of the user endpoint must belong, or select Unlimited to match any endpoint vendor.

- Endpoint OS Group—Select the endpoint OS group to which the operating system running on the user endpoint must belong, or select Unlimited to match any endpoint OS.

- Endpoint Type Group—Select the endpoint type group to which the type of the user endpoint must belong, or select Unlimited to match any endpoint type.

- AP Group—Select the AP group to which the AP of the wireless user must belong, or select Unlimited to match any AP.

- Access Period Policy—Select the access period policy to which the access period of the endpoint user must belong, or select Unlimited to match any access period.

d. Configure policy information:

- Access Policy—Select the access policy to control the access behaviors of users matching the access scenario, or select Do not use to deny network access of the matching users.

- Security Policy—Select the security policy used for security checks on users matching the access scenario, or select Do not use to perform no security checks on the matching users. This parameter is displayed only when the EAD component is installed.

- Proprietary-Attribute Assignment Policy—Select the proprietary-attribute assignment policy to apply to users matching the access scenario, or select Do not use to apply no proprietary-attribute assignment policy to the matching users.

- Internet Access Configuration—Select the Internet access configuration to control the Internet access behaviors of users matching the access scenario, or select Do not use to apply no Internet access control to the matching uses. This parameter is displayed only when the EAD component is installed.

- BYOD Page—Select a BYOD authentication page for users matching the access scenario.

- Max. Number of Bound Endpoints—Enter the maximum number of endpoints to be bound to the same access user account in access scenarios that are not included in the service. When endpoints bound to an account reach the maximum value, no more endpoints can access the network by using the account. To disable the limit, enter 0.

- Max. Number of Online Endpoints—Enter the maximum number of online endpoints using the same user account in access scenarios that are not included in the service. When online endpoints of an account reach the maximum value, no more endpoints can access the network by using the account. A value of 0 indicates there is no limit on the number of concurrent online users. To disable the limit, enter 0.

If an access user is assigned more than one service, the total number of endpoint devices that can be bound to the same account is determined by the following parameters:

Parameters	Remarks
Default Max. Number of Bound Endpoints of each service.	If the user does not match an access scenario, the number of bound devices cannot exceed the setting for this parameter.
Max. Devices for Single Account of each access scenario in the services.	If the user matches an access scenario, the number of bound devices cannot exceed the setting for this parameter.
Max. Devices for Single Account in the global user endpoint settings.	The total number of bound devices in scenarios of all assigned services cannot exceed the setting for this parameter.

e. Click OK.

The new access scenario is added to the Access Scenario List.

f. Repeat steps a through e to add more access scenarios.

g. To change the priority level of an access scenario, click the Move Up icon or Move Down icon for that scenario in the Priority column. If a user matches multiple access scenarios, the access policy assigned to the highest priority scenario applies to the user.

h. To modify an access scenario, click the Modify icon for the access scenario.

i. To delete an access scenario, click the Delete icon for the access scenario.

5. Specify user groups for the service.

Click the Expand all link to expand all user groups and select user groups for which you want to apply for the service. UAM automatically assigns the service to all users in the selected user groups next morning.

This area is displayed only when the system parameter Apply for Service by User Group is enabled. For more information, see "Configuring global system settings."

6. Click OK.

Modifying a service

1. Access the access service list page.

2. Click the Modify icon for the service you want to modify.

The Modify Service page opens.

3. Modify parameters of the service except its suffix and service group.

For more information, see "Adding an access service."

4. Click OK.

Deleting a service

Before deleting a service that has been assigned to user accounts, cancel the service for these accounts in batches by using the Batch Maintain Accounts (Query Mode) function. For more information, see "Batch operations."

To delete a service:

1. Access the access service list page.

2. Click the Delete icon for the service you want to delete.

A confirmation dialog box opens.

3. Click OK.

Managing access users

Access users and platform users

Users configured in the IMC platform are referred to as platform users, and are not related to any services. The term "user" refers to an access user, unless otherwise specified.

An access user:

· Is used for network access only.

· Identifies a network user.

· Is attached to a platform user. Multiple access users can be attached to the same platform user.

An office network typically contains a large number of users who need to access the Internet. In some cases, one user may need multiple different access privileges.

In UAM, you use the user + service mode to apply for multiple services for the same user, where each service contains one or more access scenarios that map to different access conditions and access control policies. With the user + Access Service, different access policies can apply to the same user who meets different access conditions.

IMC UAM offers a unified user management platform that classifies access users into ordinary access users, mute terminal users, LDAP users, and guests.

· Ordinary access user—Endpoint users who have long-term requirements on network access with the user data stored in UAM.

· Mute terminal user—Endpoints that cannot actively initiate authentication, such as IP phones and printers.

· LDAP user—Endpoint users who have long-term requirements on network access with the user data stored in UAM and the LDAP server.

· Guest—Endpoint users who have temporary network access requirements.

Table 18 Support of different users for functions

Function	Ordinary access user	Mute terminal user	LDAP user	Guest
User data storage location	UAM	UAM	UAM and LDAP server	UAM
Batch operations	Yes	Yes	Yes	No
Access control method
802.1X authentication	Yes	No	Yes	Yes
Portal authentication	Yes	No	Yes	Yes
VPN authentication	Yes	No	Yes	Yes
MAC authentication *The user name must be in MAC address format.	Yes*	Yes	Yes*	Yes*
Authentication method
UAM local authentication	Yes	Yes	Yes	Yes
RSA authentication	Yes	No	No	Yes
Roaming authentication	Yes	No	Yes	Yes
Certificate authentication	Yes	No	Support for this authentication method depends on LDAP user types and certificate-based EAP types. For more information, see "Configuring certificate authentication."	Yes
Access policy
Transparent portal authentication	Yes	No	Yes	No
Proprietary attribute assignment policy	Yes	Yes	Yes	Yes
Access period	Yes	Yes	Yes	Yes
Allocate IP	Yes	No	Yes	No
Upstream/downstream rate	Yes	Yes	Yes	Yes
Priority	Yes	Yes	Yes	Yes
Deploy VLAN	Yes	Yes	Yes	Yes
Deploy user profile	Yes	Yes	Yes	Yes
Deploy user group	Yes	Yes	Yes	Yes
Deploy ACL	Yes	Yes	Yes	Yes
Bind access device IP	Yes	Yes	Yes	Yes
Bind access device port	Yes	Yes	Yes	Yes
Bind VLAN	Yes	Yes	Yes	Yes
Bind QinQ double VLAN	Yes	Yes	Yes	Yes
Bind user IP address	Yes	No	Yes	Yes
Bind user IPv6 address	Yes	No	Yes	Yes
Bind user MAC address	Yes	No	Yes	Yes
Bind IMSI	Yes	No	Yes	Yes
Bind computer name	Yes	No	Yes	Yes
Bind domain	Yes	No	Yes	Yes
Logon domain	Yes	No	Yes	Yes
Bind user SSID	Yes	No	Yes	Yes
Control motherboard serial number	Yes	No	Yes	Yes
Bind user IMEI	Yes	No	Yes	Yes
Bind access device sequence number	Yes	Yes	Yes	Yes
Access MAC address control	Yes	Yes	Yes	Yes
Hard disk serial number control	Yes	No	Yes	Yes
SSID access control	Yes	No	Yes	Yes
iNode client only	Yes	No	Yes	Yes
Disable iNode DC for Windows	Yes	No	Yes	Yes
Disable iNode DC for Linux/Mac OS	Yes	No	Yes	Yes
Forbid modifying IP when online	Yes	No	Yes	Yes
Auto reconnect after network failure	Yes	No	Yes	Yes
Disable proxy server	Yes	No	Yes	Yes
Disable proxy setting in IE	Yes	No	Yes	Yes
Disable multiple NICs	Yes	No	Yes	Yes
Prohibit multiple OSs	Yes	No	Yes	Yes
Prohibit multi-IP on authenticated NIC	Yes	No	Yes	Yes
Forbid modifying MAC	Yes	Yes	Yes	Yes
Reject duplicate MAC addresses	Yes	No	Yes	Yes
Block VMware NAT service	Yes	No	Yes	Yes
Block VMware USB service	Yes	No	Yes	Yes
Prohibit from running on virtual machine	Yes	No	Yes	Yes
Lock Internet access ability (EAD component required)	Yes	No	Yes	Yes
IP address obtaining method	Yes	No	Yes	Yes

UAM provides the following access user management functions. For an illustration of the relationships between access users and functions, see Figure 87.

· Blacklist users—You can prohibit users from accessing the network by blacklisting them. A blacklisted user can be manually or automatically released from the blacklist.

· Delete access users—Operators can manually delete access users or allow IMC to automatically delete access users that have been idle for a long time.

· Postpone user expiration time—When an access user expires, the user cannot be used any longer. To continue to use the user, IMC operators can manually postpone the expiration time before the user expires.

· Change preregistered user to access user—Endpoint users can preregister access users in the self-service center. An IMC operator can approve the preregistered users to change them into access users.

· Configure user as guest manager—Endpoint users can preregister guests in the self-service center. An IMC operator can configure an ordinary access user or LDAP user as a guest manager, which can approve preregistered guests to change them into guests. Guests can pass authentication and access the network.

Figure 87 Relationships among access users and functions

Determining appropriate access user type

Figure 88 shows the decisions used to determine the appropriate access user type.

Figure 88 Determining the access user type

Determining authentication priorities

UAM performs MAC-based authentication for the following users:

· Mute terminal users who always use MAC addresses as their user names

· Ordinary access users, LDAP users, and guests who use MAC addresses as their user names

UAM also provides a transparent MAC authentication function to offer fast network access to ordinary access users and LDAP users. For more information about transparent MAC authentication, see "Transparent MAC authentication."

UAM uses operator-set authentication priorities to determine which authorization process to use.

Figure 89 shows the generic authentication process.

Figure 89 Generic authentication process

Managing ordinary access users

This section provides details about managing ordinary access users.

Accessing the access user list page

1. Click the User tab.

2. From the navigation tree, select Access User > All Access Users.

The list includes all access users.

NOTE:

You can point to the Expand icon to the right of All Access Users to display the user group menu. Click a user group name to display its access user list that includes all access users without subgroups.

Access user list contents

¡ Account Name—Account name of the access user. The account name is used for access user authentication and must be unique in UAM. Account names with the Bind User icon are LDAP users. For information about LDAP user management, see "Managing LDAP users."

¡ User Name—Name of the platform user to which the access user is attached.

¡ User Group—User group to which the platform user belongs. Platform users with different rights are divided into multiple user groups for easy management.

¡ Creation Date —Date when the access user was created.

¡ Start Time—Date and time when the access user becomes valid. An empty field indicates that the access user is already valid.

¡ End Time—Date and time when the access user expires and becomes invalid. An empty field indicates that the access user never expires.

¡ Account Status—Options are Normal, Trial, Temporarily Cancelled, Unactivated, and Cancelled. Only accounts in Normal state can be authenticated.

- Trial—A user account that is not counted in the user accounts managed by a license.

- Temporarily Cancelled—An invalid account that is temporarily deleted.

- Unactivated—A preregistered account that is registered but is not activated. For more information about preregistering accounts, see "Preregistering access users." To activate an approved account, go to system parameter configuration. For more information, see "Configuring global system settings."

- Cancelled—An invalid account that is permanently deleted.

¡ Modify—Click the Modify icon to modify settings of the access user.

Querying ordinary access users

UAM allows both basic and advanced queries.

· Basic query—For quick searches. Offers only four fields for search criteria.

· Advanced query—For more precise results than basic queries. Offers many fields for search criteria.

Basic query

1. Access the access user list page.

2. Click the Basic Query link on the upper right side of the All Access Users area.

You can perform a basic query if you see Advanced Query on the upper right side of the All Access Users area.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete access account name. The access user uses the account name for authentication. For example, if you enter x, all account names that contain x are matched.

¡ User Name—Enter a partial or complete platform user name. For example, if you enter y, all user names that contain y are matched.

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window. You can select only one user group for query.

¡ Service Name—Select Unapplied or an existing service from the list.

The query ignores empty fields.

4. Click Query. The list shows all access users that match the query criteria.

5. Click Reset to clear the query criteria. The list shows all access users in UAM.

Advanced query

1. Access the access user list page.

2. Click the Advanced Query link on the upper right side of the All Access Users area.

You can perform an advanced query if you see Basic Query on the upper right side of the Query Access Users area.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete access user account name. The account name is for authentication. For example, if you enter x, all account names that contain x are matched.

¡ User Name—Enter a partial or complete platform user name. For example, if you enter y, all user names that contain y are matched.

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window. You can select only one user group for query.

¡ Service Name—Select Unapplied or an existing service from the list.

¡ Account Status—Select the account state from the list. Options include Normal, Trial, Temporarily Cancelled, Unactivated, Cancelled, and Non-Cancelled. Only accounts in the Normal state can be authenticated.

- Trial—A user account that is not counted in the user accounts managed by a license.

- Temporarily Cancelled—An invalid account that is temporarily deleted.

- Unactivated—A preregistered account that is registered but is not activated. For more information about preregistering accounts, see "Preregistering access users." For more information about formal registration, see "Managing preregistered users." To activate an approved account, go to system parameter configuration. For more information, see "Configuring global system settings."

- Cancelled—An invalid account that is permanently deleted.

- Non-Cancelled—Normal, trial, temporarily cancelled, and unactivated users are all categorized as non-canceled users. To filter out cancelled accounts, select Non-Cancelled from the list.

¡ Identity Number—Enter a partial or complete identity number for the platform user associated with the access user. For example, if you enter z, all identity numbers that contain z are matched.

¡ Contact Address—Enter a partial or complete contact address for the platform user associated with the access user. For example, if you enter a, all contact addresses that contain a are matched.

¡ Creation Date From/To—Click the Calendar icon to select the time range when the account was created, or enter the time range in YYYY-MM-DD format.

¡ Last Logoff From/To—Click the Calendar icon to select the time range when the access user last logged off, or enter the time range in YYYY-MM-DD format.

¡ Start Time From/To—Click the Calendar icon to select the time range when the account becomes valid, or enter the time range in YYYY-MM-DD format.

¡ End Time From/To—Click the Calendar icon to select the time range when the account expires, or enter the time range in YYYY-MM-DD format.

¡ Email—Enter a partial or complete email address for the platform user associated with the access user. For example, if you enter com, all email addresses that contain com are matched.

¡ Port—Enter the last portion of the interface number to which the access user is bound. For example, if an access user is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port. UAM supports only an exact match for this field.

¡ Max. Concurrent Logins—Enter the upper limit of concurrent logins allowed for the access user. UAM supports only an exact match for this field.

¡ Max. Idle Time (Minutes)—Enter the maximum idle time allowed for the access user. UAM supports only an exact match for this field.

¡ Device IP Address Range From/To—Enter an IP address range for the access device to which the access user is bound. You must enter a complete IPv4 address in each field.

¡ Computer Name—Enter a partial or complete name of the computer to which the access user is bound. For example, if you enter a, all computer names that contain a are matched.

¡ User SSID—Enter a partial or complete SSID of the wireless network that the access user can access. For example, if you enter a, all SSIDs that contain a are matched.

¡ VLAN ID/Inner VLAN ID—Enter a VLAN ID or inner VLAN ID to which the access user is bound. UAM supports only an exact match for this field.

¡ Outer VLAN ID—Enter the outer VLAN ID to which the access user is bound. UAM supports only an exact match for this field.

¡ LDAP Synchronization Policy—Select the LDAP synchronization policy to which the access user is bound. This query criterion is effective on LDAP users only. For more information about the LDAP users, see "Managing LDAP users."

¡ LDAP User Status—Select the LDAP user state from the list. Options include Unknown, Existent, and Nonexistent. The Unknown option indicates that an LDAP user has not synchronized information from the LDAP server. The Existent option indicates that the LDAP server contains an LDAP user that is associated with the access user. The Nonexistent option indicates that the LDAP server does not contain any LDAP user that is associated with the access user. This query criterion is effective on LDAP users only. For more information, see "Managing LDAP users."

¡ User IP Address Range From/To—Enter an IP address range for the endpoint to which the access user is bound. You must enter a complete IPv4 address in each field.

¡ User MAC Address—Enter a partial or complete MAC address of the computer to which the access user is bound. The value can be in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX. For example, if you enter AA-BB, all MAC addresses that contain AA-BB are matched.

¡ Third-Party Authentication Users—Select Yes if the access user uses the third-party authentication, or select No if the access user does not use the third-party authentication.

¡ IMSI—Enter a partial or complete IMSI of the computer to which the access user is bound. For example, if you enter EF, all IMSIs that contain EF are matched.

¡ Device SN—Enter a partial or complete device sequence number bound to the access user. For example, if you enter EF, all device sequence numbers that contain EF are matched.

¡ Endpoint MAC Address—Enter a partial or complete MAC address of the smart device bound to the access user account. A complete MAC address must be in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX. For example, if you enter 00-ef, all MAC addresses that contain 00-ef are matched.

¡ Windows Domain—Enter a partial or complete name of the Windows domain to which the computer of the access user is bound. For example, if you enter a, all Windows domain names that contain a are matched.

¡ WLAN Cell Phone Number—Enter a partial or complete phone number to which the access user is bound. For example, if you enter 138, all phone numbers that contain 138 are matched. This field is displayed only when Third-Party Authentication System is enabled in the UAM system settings. For more information, see "Configuring the third-party authentication system."

¡ Device IPv6—Enter a partial or complete IPv6 address of the access device to which the access user is bound. For example, if you enter EF, all device IPv6 addresses that contain EF are matched. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ User IPv6 Address—Enter a partial or complete IPv6 address of the endpoint to which the access user is bound. For example, if you enter EF, all endpoint IPv6 addresses that contain EF are matched. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ Creator—Enter a partial or complete name of the operator that created the access user. The creator is $SYSTEM for third-party authentication users and users synchronized from LDAP servers based on an on-demand sync policy.

The query ignores empty fields.

4. Click Query. The list shows all access users that match the query criteria.

5. Click Reset to clear the query criteria. The list shows all access users in UAM.

Viewing ordinary access user details

1. Access the access user list page.

2. Click the account name of the access user you want to view.

The access user details page opens.

Basic Information area

· User Name—Name of the platform user to which the access user is attached.

· ID Number—Identity number of the platform user to which the access user is attached.

· Contact Address—Contact address of the platform user to which the access user is attached.

· Telephone—Telephone number of the platform user to which the access user is attached.

· Email—Email address of the platform user to which the access user is attached.

· User Group—User group to which the access user belongs. If the user group has a parent group or subgroups, this field displays the complete group hierarchy of the user group.

Access Information area

· Account Name—Unique account name of the access user. The account name is used for access user authentication. When an access user is blacklisted, the account name of the user is followed by Blacklisted Users.

· Account Status—Options are Normal, Trial, Temporarily Cancelled, Unactivated, and Cancelled. Only accounts in the Normal state can be authenticated.

¡ Trial—A user account that is not counted in the user accounts managed by a license.

¡ Temporarily Cancelled—An invalid account that is temporarily deleted.

¡ Unactivated—A preregistered user account that is registered but is not activated. For more information about preregistering accounts, see "Preregistering access users." For more information about formal registration, see "Managing preregistered users." To activate an approved account, go to system parameter configuration. For more information, see "Configuring global system settings."

¡ Cancelled—An invalid account that is permanently deleted.

· Allow User to Change Password—Displays Yes if the access user is allowed to change the login password in the self-service center or iNode client. This field displays No if the access user is prohibited from changing the login password. For more information, see "Using the user self-service."

· Enable Password Strategy—Displays Yes if the access user must comply with the password strategy when the user tries to change the password through the iNode client. This field displays No if password strategy is not used. An IMC administrator can change the login password of any access user regardless of whether a password strategy is used. For more information, see "Configuring the password strategy."

· Creation Date—Date when the access user was created.

· Modify Password at Next Login —Displays Yes if the access user must change the login password next time the user passes authentication. After the access user changes the login password as required, this field changes to No. This field displays No if the access user is not required to change the login password.

· Start Time—Date and time when the access user becomes valid. An empty field indicates that the access user is already valid.

· End Time—Date and time when the access user expires and becomes invalid. An empty field indicates that the access user never expires.

· Max. Idle Time (Minutes)—Maximum idle time that the access user is allowed. The access user is forcibly logged off when the idle time expires. An empty field indicates that the access user can always stay online.

· Max. Concurrent Logins—Upper limit of concurrent logins that the access user is allowed. An empty field indicates that the concurrent logins of the access user are not restricted.

· Availability—Indicates whether the access user is online.

· Last Logoff—Time when the access user last logged off.

· WLAN Cell Phone Number—Phone number to which the access user is bound. This field is displayed only when Third-Party Authentication System is enabled in the UAM system settings. For more information, see "Configuring the third-party authentication system."

· Login Message—Message delivered to the access user when the user passes authentication.

· Guest Manager Type—Value can be Guest Manager or Super Guest Manager. This parameter is displayed only when the access user is a guest manager or super guest manager. For more information, see "Managing guests."

Access Service area

The list includes all services that are assigned to the access user account.

· When Apply for Service by User Group is disabled, the area displays all services that are manually assigned to the account by operators.

· When Apply for Service by User Group is enabled, the area displays all services that UAM automatically assigns to the account according to the user group to which the account belongs.

For information about configuring Apply for Service by User Group, see "Configuring global system settings."

Access service list contents

· Service Name—Name of a service, which must be unique in UAM.

· Service Suffix —Identifies the name of the domain to be used for endpoint user authentication. For more information, see Table 19. The user name and service suffix entered for user authentication are closely related to the domain where the access device authenticates the user.

· Allocate IP—IP address assigned by the service to the access user. An empty field indicates that no IP address is assigned.

The commands listed in Table 19 are available on HP Comware devices. The commands used on other access devices can vary.

Table 19 Service suffix and other configurations

Authentication user name	Authentication domain on the access device	Commands configured on the access device	Service suffix in UAM	Username prefix conversion mode
X@Y Y\X Y/X	Y	user-name-format with-domain	Y	Change to Suffix
X@Y Y\X Y/X	Y	user-name-format without-domain	None	Remove
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format with-domain	[Default Domain]	Change to Suffix
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format without-domain	None	Remove

When user names in Y\X or Y/X format do not exist in the access user list or the LDAP temporary user list, UAM automatically converts the user names. Names in Y\X or Y/X format are converted to the X@Y or X format according the username prefix conversion mode. For more information about the username prefix conversion mode, see "Configuring system parameters."

Transparent Authentication MAC Address Binding area

The Transparent Authentication MAC Address Binding area displays all endpoint MAC addresses that are bound to the access user account for transparent authentication.

· Service Name/MAC Address—Service name and MAC address that are bound to the account for transparent portal authentication.

· Transparent Authentication—Whether the MAC address is allowed to use the account and service for transparent portal authentication. The status can be Enabled or Disabled.

· Enabled/Disabled Time—When transparent authentication is enabled, this field indicates the time when the smart device MAC address was bound to the user and service. When transparent authentication is disabled, this field indicates the time when transparent authentication on smart devices was automatically or manually disabled.

Access Device Binding Information area

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings. The query ignores empty fields.

· Device SN—Requires the access user to connect to the access device that has the specified sequence number.

· Port—Requires the access user to be connected through the specified port of the access device. The value is the last portion of an interface number. For example, if an access user is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

· Outer VLAN ID—Requires the access user's packets to carry the specified outer VLAN ID.

· VLAN ID/Inner VLAN ID—Requires the access user's packets to carry any of the specified VLAN IDs or inner VLAN IDs.

· User SSID—Requires the access user to connect to the network that uses any of the specified SSIDs.

· Device IP—Requires the access user to connect to the access device that uses any of the specified IPv4 addresses. Each entry on the list represents the IPv4 address of an access device bound to the access user. If a device has multiple IP addresses, use the IPv4 address of the corresponding access device in UAM.

· Device IPv6 Address—Requires the access user to connect to the access device that uses any of the specified IPv6 addresses. Each entry on the list represents the IPv6 address of an access device bound to the access user. If a device has multiple IPv6 addresses, use the IPv6 address of the corresponding access device in UAM. This field is displayed only when IPv6 is enabled in the UAM system settings.

Terminal Binding Information area

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings. The query ignores empty fields.

· Computer Name—Requires the access user to connect from the specified computer.

· IMSI—Requires the access user endpoint to use the specified IMSI.

· Windows Domain—Requires the access user endpoint to join or log in to the specified domain.

· Terminal IP Address—Requires the access user endpoint to use any of the specified IPv4 address.

· Terminal MAC Address—Requires the access user endpoint to use any of the specified MAC address.

· Terminal IPv6 Address—Requires the access user endpoint to use any of the specified IPv6 addresses. This field is displayed only when IPv6 is enabled in the UAM system settings.

· IMEI—Requires the access user endpoint to use the specified IMEI.

Action menu

The Action menu is located to the right of the Access Account Info pane, and offers the following actions:

· Refresh—Refresh the detailed information about the access user.

· Modify—Modify the access user. For more information, see "Modifying an ordinary access user."

· Cancel Account—Delete the access user.

· Add to Blacklist—Add the access user to the blacklist. The link is displayed only when the access user is not blacklisted.

· Release from Blacklist—Release the access user from the blacklist. The link is displayed only when the access user is blacklisted.

· Authentication Failure Log—View the list of authentication failure logs for the access user. For more information, see "Managing authentication failure logs."

· Authentication Violation Log—View the list of authentication violation logs for the access user. For more information, see "Managing authentication violation logs."

· Access Details—View the list of access details for the access user. For more information, see "Managing access detail records."

· Security Log—View the list of security logs for the access user. This option is displayed only when EAD is deployed.

· View Internet Access Audit Logs—View the list of Internet access audit logs for the access user. This option is displayed only when EAD is deployed.

· MAC Address Entry—View the list of MAC addresses that are bound to the user account only for transparent authentication. This link is displayed only when transparent authentication in user endpoint settings is enabled on UAM. For more information about transparent MAC authentication, see "Configuring MAC/BYOD authentication."

· Basic User Info—View detailed information about the platform user to which the access user is attached.

· Send Password via SMS—Send an SMS message that is defined by an operator and contains the user name and password of the account, so the user can retrieve the password. To use this function, first configure the SMS settings in the IMC platform. For information about configuring SMS system parameters, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. For information about configuring the SMS message content, see "Delivering messages."

· Temporary Cancel—Cancel the account temporarily. The link is displayed only when the account is in Normal state.

· Undo TempCancel—Change the account to the Normal state. The link is displayed only when the account is in Temporarily Cancelled state.

· Approve Trial—Approve the account. The link is displayed only when the account is in Trial state.

Adding an ordinary access user

1. Access the access user list page.

2. Click Add.

The Add Access User page opens.

3. Configure the access information:

¡ User Name—Configure the name of the platform user to which the access user is attached. In the Window that opens, click Select to select an existing platform user, or click Add User to add a new platform user.

¡ Account Name—Enter the account name of an access user. The account name must be unique in UAM, and is used for access user authentication. An account name can contain letters, numbers, spaces, hyphens (-), underscores (_), and dots (.).

¡ Trial Account—Sets the access user as a trial account. You can also configure the fast access user or computer user as a trial account. Trial accounts are excluded from the user accounts managed by a license, and cannot pass authentication. Trial accounts are typically configured by batch operations. For more information, see "Importing accounts in batches."

¡ Default BYOD User—Sets the access user as the BYOD anonymous user. This field is displayed only when UAM has no BYOD anonymous user created. When this field is selected, the Account Name field is automatically populated by byodanonymous and the Computer User, MAC Authentication User, and Fast Access User fields are hidden. The user account is for anonymous MAC authentication. For more information, see "Anonymous MAC authentication."

¡ MAC Authentication User—Sets the access user as a MAC authentication user who uses the MAC address as the user name and password for network access. When this field is selected, the following fields are hidden:

- Default BYOD User

- Computer User

- Fast Access User

- Password

- Confirm Password

- Allow User to Change Password

- Enable Password Strategy

- Modify Password at Next Login

- Max. Concurrent Logins

TIP:

These parameters are hidden to simplify the user configuration page. Except Default BYOD User, Computer User, and Fast Access User, the hidden parameters are still available for the MAC authentication user. You can display and configure the parameters when modifying the user.

¡ Computer User—Sets the access user as the computer user. This field is displayed only when UAM has no computer user created. When this field is selected, the Account Name field is automatically populated by computer and the following fields are hidden:

- Default BYOD User

- MAC Authentication User

- Fast Access User

- Password

- Confirm Password

- Allow User to Change Password

- Enable Password Strategy

- Modify Password at Next Login

After the computer user is created in UAM, the user can create an 802.1X connection with the PC authentication mode in the iNode client.

¡ Fast Access User—Sets the access user as the fast access user. This field is displayed only when UAM has no fast access user created. When this field is selected, the Account Name field is automatically populated by anonymous and the following fields are hidden:

- Default BYOD User

- MAC Authentication User

- Computer User

- Password

- Confirm Password

- Allow User to Change Password

- Enable Password Strategy

- Modify Password at Next Login

After the fast access user is created in UAM, the user can create a quick authentication connection in the iNode client for authentication.

¡ Password—Enter the access user password.

¡ Confirm Password—Enter the password again.

¡ Allow User to Change Password—Enables the access user to change the password in the self-service center or iNode client.

¡ Enable Password Strategy—Enables the password control strategy for the access user. The strategy requires that the access user must meet certain requirements when the user tries to change the password through the iNode client. An IMC administrator can change the password of any access user regardless of whether a password strategy is used. This option is available only when the Allow User to Change Password option is selected.

¡ Modify Password at Next Login—Requires that the access user must change the password next time the user passes authentication. This option can be configured only when the Enable Password Strategy option is selected. After the access user changes the password, this parameter is automatically unselected. Transparent portal authentication does not take effect if the access user does not change the password as required by the Modify Password at Next Login option. In this situation, the user account name cannot be bound with the MAC address of the endpoint used for network access.

¡ Start Time—Enter the date and time when the access user becomes valid. If you leave this field empty, the access user becomes valid immediately after being created.

¡ End Time—Enter the date and time when the access user expires and becomes invalid. An empty field indicates that the access user never expires.

¡ Max. Idle Time (Minutes)—Enter the maximum idle time permitted for an online user. When the time expires, the user is forcibly logged off. An empty field indicates that the access user can always be online without performing any operations.

¡ Max. Concurrent Logins—Enter the maximum number of concurrent online users of the account. An empty field indicates no restrictions on the number of concurrent online users using the account.

¡ WLAN Cell Phone Number/WLAN Password/Confirm Password—Enter the phone number and password to which the access user is bound. This field is displayed only when Third-Party Authentication System is enabled in the UAM system settings. When this function is enabled, UAM sends the phone number and password for second authentication by the third-party authentication system. For information about third-party system authentication, see "Configuring the third-party authentication system." For information about phone number configuration restrictions, see "Configuring the cell phone number ranges."

¡ Login Message—Enter the message to be displayed on the user endpoint when the user passes authentication.

4. In the Access Service area, select the access services on the access service list. You can select multiple services with different suffixes for the access user.

When Apply for Service by User Group is enabled, UAM hides the Access Service area and automatically assigns services of each user group to their respective users. For information about configuring Apply for Service by User Group, see "Configuring global system settings."

The access service list contains the following parameters:

¡ Service Name—Name of the access service, which must be unique in UAM.

¡ Service Suffix—Identifies the name of the domain to be used for endpoint user authentication. For more information, see Table 20. The user name and service suffix entered for user authentication are closely related to the domain where the access device authenticates the user.

¡ Default Security Policy—Default security policy in the service. This parameter is displayed only when the EAD component is installed.

¡ Status—Whether an access service can be applied for. Unavailable services do not appear on the access service list.

¡ Allocate IP—IP address that the access service allocates to the user. An empty field indicates that the access service does not allocate any IP address.

The commands in Table 20 are available on HP Comware devices. The commands used on other access devices may vary.

Table 20 Service suffix and other configurations

Authentication user name	Authentication domain on the access device	Commands configured on the access device	Service suffix in UAM	Username prefix conversion mode
X@Y Y\X Y/X	Y	user-name-format with-domain	Y	Change to Suffix
X@Y Y\X Y/X	Y	user-name-format without-domain	None	Remove
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format with-domain	[Default Domain]	Change to Suffix
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format without-domain	None	Remove

5. Configure the access device or terminal binding information.

The binding parameters in this area take effect only when they are selected in the Authentication Binding Information area of the selected access policies. For example, the Device IP parameter applies to access policies with the Bind Access Device IP option selected.

If you select a binding option for an access policy without specifying a value for the parameter in the Access Device Binding Information area, UAM automatically acquires the binding information for the access policy when a user first passes authentication.

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings.

¡ Device SN—Enter the sequence number of the access device to which the access user is connected.

¡ Port—Enter the port through which the access user is connected to the access device. The value is the last portion of an interface number. For example, if an access user is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

¡ Outer VLAN ID—Enter the outer VLAN ID that is contained in the access user's packets.

¡ VLAN ID/Inner VLAN ID—Enter a list of VLAN IDs or inner VLAN IDs that can be contained in the access user's packets.

¡ User SSID—Enter a list of SSIDs to which the access user can be connected.

¡ Device IP—Enter a list of IPv4 address for the access devices to be bound to the access user. Each entry on the list represents the IP address of an access device bound to the access user. If a device has multiple IP addresses, use the IP address of the corresponding access device in UAM.

¡ Device IPv6 Address—Enter a list of IPv6 address for the access devices to be bound to the access user. Each entry on the list represents the IPv6 address of an access device bound to the access user. If a device has multiple IPv6 addresses, use the IPv6 address of the corresponding access device in UAM.

¡ Computer Name—Enter the name of the computer to be bound to the access user.

¡ IMSI—Enter the IMSI of the endpoint to be bound to the access user.

¡ Windows Domain—Enter the name of the Windows domain that the user endpoint must join or log in to.

¡ Terminal IP Address—Enter a list of IPv4 addresses or IPv4 address ranges for the endpoints from which the access user can access the network. The IPv4 address ranges must be specified in the format X.X.X.X-X.X.X.X.

¡ Terminal MAC Address—Enter a list of MAC addresses for the endpoints from which the access user can access the network.

¡ Terminal IPv6 Address—Enter a list of IPv6 addresses for the endpoints from which the access user can access the network. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ IMEI—Enter the IMEI of the endpoint to be bound to the access user.

6. Click OK or OK & Print.

If you click OK, UAM adds the access user and displays the access user list.

If you click OK & Print, a print preview window opens. You can view the access user information, and then click Print at the top of the window.

Bulk importing ordinary access users

1. Access the access user list page.

2. Click Batch Import.

The Import Accounts in Batches page opens. For subsequent steps, see "Importing accounts in batches."

Bulk exporting ordinary access users

1. Access the access user list page.

2. Select one or more access user accounts you want export.

3. Click More and select Batch Export from the shortcut menu.

The Export File Format page opens.

4. Select the format of the file to store the exported account information from the File Format list. Options are TXT and CSV. You can open a .csv file in Microsoft Excel.

5. Select a column separator to use in the .txt export file from the Column Separator list. Options are Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). This field is displayed only when TXT is selected in the File Format list.

6. Select the way in which the exported passwords are stored from the Export Plain Password list. If you select Yes, all user passwords are exported in plain text. If you select No, all user passwords are exported in encrypted format.

7. Configure the account parameters to be exported.

By default, the exported account information includes Account Name, User Name, User Group, and Expiration Time. UAM also provides you with the ability to export one or more of the following parameters:

¡ Password

¡ Identity Number

¡ Telephone

¡ Contact Address

¡ E-mail

¡ Account Status

¡ Creation Time

¡ Access Device IP

¡ Access Device IPv6 Address

¡ Port

¡ VLAN ID/Inner VLAN ID

¡ Outer VLAN ID

¡ User SSID

¡ User IP

¡ User IPv6

¡ User MAC

¡ Max. Concurrent Logins

¡ Max. Idle Time (Minutes)

¡ Access Service List

¡ Computer Name

¡ Windows Domain

¡ Login Message

¡ Device SN

¡ IMSI

¡ IMEI

¡ WLAN Cell Phone Number/WLAN Password

NOTE:

Access Device IPv6 Address and User IPv6 appear only when IPv6 is enabled in system parameters.

WLAN Cell Phone Number/WLAN Password is displayed only when Third-Party Authentication System is enabled.

All parameters on the Output List will be exported to the file. You can perform the following operations:

¡ Select a parameter on the Option List and click the Copy icon to move it to the Output List.

¡ Click the Copy all icon to move all parameters from the Option List to the Output List.

¡ Select an undesired parameter on the Output List and click the Remove icon to move it back to the Option List.

¡ Click the Remove all icon to move all parameters from the Output List to the Option List.

You can sort the Output List by performing the following operations:

¡ Click the Top icon to move a selected parameter to the top of the Output List.

¡ Click the Up icon to move up a selected parameter in the Output List.

¡ Click the Down icon to move down a selected parameter in the Output List.

¡ Click the Bottom icon to move a selected parameter to the bottom of the Output List.

8. Click OK.

UAM exports information about the selected access user accounts and displays the export results.

9. Click Download to view the export file or save it to another place.

By default, the export file is stored at the tmp directory in the IMC installation path on the IMC master server and is named in the format of exportAccountexport-time.

Approving trial accounts

Trial accounts are excluded from the user accounts managed by a license, and cannot pass authentication. Trial accounts are typically configured by batch operations. For more information, see "Importing accounts in batches."

Trial accounts become normal accounts after they are approved by an operator.

Approving trial accounts on the access user list page

1. Access the access user list page.

2. Select one or more access accounts in Trial state.

3. Click More and select Approve Trial from the shortcut menu.

UAM changes the selected accounts to normal accounts, and then displays the number of successfully approved accounts and the number of failures. If failures exist, you can click Download to load or view the failure reasons in the operation log.

Approving a trial account on the access user details page

1. Access the access user list page.

2. Click the name of an access account in Trial state.

The access user details page opens.

3. Click Approve Trial on the Action menu on the right.

A confirmation dialog box opens.

4. Click OK.

Modifying an ordinary access user

1. Access the access user list page.

2. Click the Modify icon for the access user you want to modify.

The Modify Access User page opens.

3. Modify parameters for the access user account. The user name and account name cannot be modified. For more information, see "Adding an ordinary access user."

4. Click OK.

Bulk modifying ordinary access users

1. Access the access user list page.

2. Select one or more account names you want to modify.

3. Click Modify Account.

The Modify Account page opens. For subsequent steps, see "Querying and maintaining accounts in batches."

Temporarily canceling normal accounts

Operators can temporarily cancel access user accounts that will not access the network for a period of time. Temporarily cancelled accounts cannot pass authentication. However, they are counted in the user accounts managed by a license, and can be easily restored to normal accounts.

Temporarily canceling normal accounts on the access user list page

1. Access the access user list page.

2. Select one or more access accounts in Normal state.

3. Click More and select Temporary Cancel from the shortcut menu.

UAM changes the selected accounts to temporarily cancelled accounts, and then displays the number of successfully cancelled accounts and the number of failures. If failures exist, you can click Download to load or view the failure reasons in the operation log.

Temporarily canceling a normal account on the access user details page

1. Access the access user list page.

2. Click the name of an access account in Normal state.

The access user details page opens.

3. Click Temporary Cancel on the Action menu on the right.

A confirmation dialog box opens.

4. Click OK.

Restoring temporarily cancelled accounts to normal accounts

Operators can restore temporarily cancelled accounts to normal accounts. Temporarily cancelled accounts cannot pass authentication, but they are counted in the user accounts managed by a license.

Restoring temporarily cancelled accounts on the access user list page

1. Access the access user list page.

2. Select one or more access accounts in Temporarily Cancelled state.

3. Click More and select Undo TempCancel from the shortcut menu.

UAM changes the selected accounts to normal accounts, and then displays the number of successfully restored accounts and the number of failures. If failures exist, you can click Download to load or view the failure reasons in the operation log.

Restoring a temporarily cancelled account on the access user details page

1. Access the access user list page.

2. Click the name of an access account in Temporarily Cancelled state.

The access user details page opens.

3. Click Undo TempCancel on the Action menu on the right.

A confirmation dialog box opens.

4. Click OK.

Deleting ordinary access users

1. Access the access user list page.

2. Select one or more account names you want to delete.

3. Click Cancel Accounts.

The Cancel Accounts page contains a Delete Platform Users option.

When you release a user from the blacklist, the user can pass authentication for network access. For more information about the blacklist, see "Managing blacklisted users."

Releasing a user from the blacklist on the access user details page

1. Access the access user list page.

2. Click the account name of the access user you want to release from the blacklist.

3. Click Release from Blacklist in the Action menu on the right.

A confirmation dialog box opens.

4. Click OK.

Releasing users from the blacklist on the blacklist user management page

To release users from the blacklist on the blacklist user management page:

1. Click the User tab.

2. From the navigation tree, select Access User > Blacklisted User.

The list includes all blacklisted users.

3. Select one or more account names you want to release from the blacklist.

4. Click Release from Blacklist.

A confirmation dialog box opens.

5. Click OK.

Applying for services for ordinary access users

When Apply for Service by User Group is enabled, the Apply for Service button does not appear in the access user list area, and operators cannot manually apply for services for access users. For information about configuring Apply for Service by User Group, see "Configuring global system settings."

To apply for services for ordinary access users:

1. Access the access user list page.

2. Select one or more account names for which you want to apply for services.

3. Click Apply for Service.

The Service List page opens. For subsequent operation steps, see "Querying and maintaining accounts in batches."

Canceling a service for ordinary access users

When Apply for Service by User Group is enabled, the Cancel Service button does not appear in the access user list area, and operators cannot manually cancel services for access users. For information about configuring Apply for Service by User Group, see "Configuring global system settings."

You cannot cancel a service for the online user if the service is being used by that user.

To cancel a service for ordinary access users:

1. Access the access user list page.

2. On the query area, select a service from the Service Name list.

3. Select one or more account names for which you want to cancel the applied service.

4. Click Cancel Service.

¡ Allocate IP—IP address that the access service allocates to the user. An empty field indicates that the access service does not allocate any IP address.

5. Click OK.

Regrouping ordinary access users

1. Access the access user list page.

2. Select one or more access users for which you want to change their user groups.

3. Click More and select Regroup from the shortcut menu.

The Regroup page opens.

4. Select the user group that you want to move the selected access users to.

A confirmation dialog box opens.

5. Click OK.

Managing preregistered users

Endpoint users can preregister access user accounts in the self-service center. For more information, see "Preregistering access users."

Preregistered users cannot be authenticated. Operators can turn them into ordinary access users through formal registration.

Accessing the preregistered user list page

1. Click the User tab.

2. From the navigation tree, select Access User > Preregistered User.

The list includes all preregistered users.

Preregistered user list contents

¡ Account Name—Account name of the preregistered user. Click the name to view its details.

¡ User Name—Real name of the preregistered user.

¡ Registration Date—Date when the user was preregistered.

¡ Expiration Time—Time when the preregistered user expires and is deleted from the preregistered user list.

¡ Register—Click the Register icon to change the preregistered user into an ordinary access user.

Querying preregistered users

UAM provides basic query and advanced query. Basic query criteria include several key parameters for quick search. Advanced query offers various query criteria for precise match.

Basic query

1. Access the preregistered user list page.

2. On the Query Preregistered Users area, click the Basic Query link at the upper right corner.

You can perform a basic query if you see Advanced Query on the upper right side of the Query Preregistered Users area.

3. Specify one or more of the following query criteria:

¡ User Name—Enter a partial or complete name of the preregistered user. For example, if you enter jack, all user names that contain jack are matched.

¡ Account Name—Enter the account name of the preregistered user. For example, if you enter jack, all account names that contain jack are matched.

¡ Registered From/To—Click the Calendar icon to select the time range when the user was preregistered, or enter the time range in YYYY-MM-DD format.

The query ignores empty fields.

4. Click Query.

The list includes all preregistered users matching the query criteria.

Advanced query

1. Access the preregistered user list page.

2. On the Query Preregistered Users area, click the Advanced Query link at the upper right corner.

You can perform an advanced query if you see Basic Query on the upper right side of the Query Preregistered Users area.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of the preregistered user. For example, if you enter jack, all account names that contain jack are matched.

¡ User Name—Enter a partial or complete real name of the preregistered user. For example, if you enter jack, all user names that contain jack are matched.

¡ ID Number—Enter a partial or complete identity number of the preregistered user. For example, if you enter 123, all ID numbers that contain 123 are matched.

¡ Contact Address—Enter a partial or complete contact address of the preregistered user. For example, if you enter lab321, all contact addresses that contain lab321 are matched.

¡ Registered From/To—Click the Calendar icon to select the time range when the user was preregistered, or enter the time range in YYYY-MM-DD format.

¡ Email—Enter a partial or complete email address of the preregistered user. For example, if you enter hp.com, all email addresses that contain hp.com are matched.

The query ignores empty fields.

4. Click Query.

The list includes all preregistered users matching the query criteria.

5. To clear the query criteria, click Reset.

The list includes all preregistered users.

Viewing preregistered user details

1. Access the preregistered user list page.

2. Click the account name of the preregistered user you want to view.

The preregistered user details page opens.

Basic Information area

¡ User Name—Name of the preregistered user.

¡ ID Number—Identity number of the preregistered user.

¡ Contact Address—Contact address of the preregistered user.

¡ Telephone—Telephone number of the preregistered user.

¡ Email—Email address of the preregistered user.

Additional Information area

This area display additional information about the preregistered user.

Access Account Information area

¡ Account Name—Account name of the preregistered user.

¡ User IP—IPv4 addresses or IPv4 address ranges of the preregistered user.

¡ MAC Address—MAC addresses of the preregistered user.

¡ User IPv6 Address—IPv6 addresses of the preregistered user. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ Registration Date—Date when the user was preregistered.

3. Click Back to return to the preregistered user list page.

Registering as an ordinary access user

1. Access the preregistered user list page.

2. Click the Register icon for the preregistered user you want to change into an ordinary access user.

The Register page opens.

3. Configure the following basic information:

¡ User Name—Enter the name of the endpoint user or leave the preregistered user name unchanged.

¡ ID Number—Enter the identity number of the endpoint user or leave the preregistered ID number unchanged.

¡ Contact Address—Enter the contact address of the endpoint user or leave the preregistered contact address unchanged.

¡ Telephone—Enter the telephone number of the endpoint user or leave the preregistered telephone number unchanged.

¡ Email—Enter the email address of the endpoint user or leave the preregistered email address unchanged.

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window. You can select only one user group.

4. Configure the access information:

¡ Account Name—Enter the account name of the access user or leave the preregistered account name unchanged. The account name must be unique in UAM, and can contain letters, numbers, spaces, hyphens (-), underscores (_), and dots (.).

¡ Password/Confirm Password—Enter the access user password and confirm the password. If you leave the fields blank, you use the preregistered password.

¡ Allow User to Change Password—Enables the access user to change the password in the self-service center or iNode client.

¡ Enable Password Strategy—Enables password control strategy for the access user. The strategy requires that the access user meet certain requirements when trying to change the password through the iNode client. An IMC administrator can change the password of any access user regardless of whether a password strategy is used. This option is available only when the Allow User to Change Password option is selected.

¡ Modify Password at Next Login—Requires that the access user must change the password the next time the user passes authentication. This option can be configured only when the Enable Password Strategy option is selected. After the access user changes the password, this parameter is automatically unselected.

¡ Start Time—Enter the date and time when the access user becomes valid. Leave this field empty if you want the access user to become valid immediately after being created.

¡ End Time—Enter the date and time when the access user expires and becomes invalid. An empty field indicates that the access user never expires.

¡ Login Message—Enter the message to be displayed on the user endpoint when the user passes authentication.

¡ Max. Concurrent Logins—Enter the maximum number of concurrent online users of the account. An empty field indicates no restriction on the number of concurrent online users using the account.

¡ WLAN Cell Phone Number/WLAN Password/Confirm Password—Phone number and password to which the access user is bound. These fields appear only when Third-Party System Authentication is enabled in the UAM system settings. When this function is enabled, UAM sends the phone number and password for second authentication by the third-party authentication system. For more information about third-party system authentication, see "Configuring the third-party authentication system." For more information about phone number configuration restrictions, see "Configuring the cell phone number ranges."

5. Configure the access services.

When Apply for Service by User Group is enabled, UAM hides this area and automatically assigns services of each user group to their respective users. For information about configuring Apply for Service by User Group, see "Configuring global system settings."

Select the access services on the access service list. You can select multiple services with different suffixes for the access user.

The access service list contains the following parameters:

¡ Service Name—Name of the access service, which must be unique in UAM.

¡ Service Suffix—Identifies the name of the domain to be used for endpoint user authentication. For more information, see Table 21. The user name and service suffix entered for user authentication are closely related to the domain where the access device authenticates the user.

The commands listed in Table 21 are available on HP Comware devices. The commands used on other access devices can vary.

Table 21 Service suffix and other configurations

Authentication user name	Authentication domain on the access device	Commands configured on the access device	Service suffix in UAM	Username prefix conversion mode
X@Y Y\X Y/X	Y	user-name-format with-domain	Y	Change to Suffix
X@Y Y\X Y/X	Y	user-name-format without-domain	None	Remove
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format with-domain	[Default Domain]	Change to Suffix
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format without-domain	None	Remove

6. Configure the access device binding information.

The binding parameters in this area take effect only when they are selected in the Authentication Binding Information area of the selected services. For example, the Device IP parameter is effective to the services with the Bind Access Device IP option selected.

If you select a binding option for a service but do not specify a value for the parameter in the Access Device Binding Information area, UAM automatically acquires the binding information for the service when each user first passes authentication.

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings.

¡ Device SN—Enter the sequence number of the access device to which the access user is connected.

¡ Outer VLAN ID—Enter the outer VLAN ID that is contained in the access user's packets.

¡ VLAN ID/Inner VLAN ID—Enter a list of VLAN IDs or inner VLAN IDs that can be contained in the access user's packets.

¡ User SSID—Enter a list of SSIDs to which the access user can be connected.

7. Configure the terminal binding information.

The binding parameters in this area take effect only when they are selected in the Authentication Binding Information area of the selected services. For example, the Computer Name parameter is effective to the services with the Bind Computer Name option selected.

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings.

¡ Computer Name—Enter the name of the computer to be bound to the access user.

¡ IMSI—Enter the IMSI of the endpoint to be bound to the access user.

¡ Windows Domain—Enter the name of the domain that the user endpoint must join.

¡ Terminal MAC Address—Enter a list of MAC addresses for the endpoints from which the access user can access the network.

¡ IMEI—Enter the IMEI of the endpoint to be bound to the access user.

8. Click OK.

The preregistered user changes into an ordinary access user, and is added to the access user list.

Bulk registering as ordinary access users

You can bulk register preregistered users as ordinary access users and configure their common parameters. Bulk registration does not change the basic information about the preregistered users, such as the user name, telephone, and user IP.

To bulk register ordinary access users:

1. Access the preregistered user list page.

2. Select the preregistered users you want to change into ordinary access users.

3. Click Register.

The Register page opens.

4. Configure the access information:

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window. You can select only one user group.

¡ Allow User to Change Password—Enables the access users to change the password in the self-service center or iNode client.

¡ Enable Password Strategy—Enables the password control strategy for the access users. The strategy requires that the access users meet certain requirements when trying to change the password through the iNode client. An IMC administrator can change the password of any access user regardless of whether a password strategy is used. This option is available only when the Allow User to Change Password option is selected.

¡ Modify Password at Next Login—Requires that each access user must change the password next time the user passes authentication. This option can be configured only when the Enable Password Strategy option is selected. After the access user changes the password, this parameter is automatically unselected.

¡ Start Time—Enter the date and time when the access user becomes valid. Leave this field empty if you want the access user to become valid immediately after being created.

¡ End Time—Enter the date and time when the access user expires and becomes invalid. An empty field indicates that the user's access never expires.

¡ Max. Idle Time (Minutes)—Enter the maximum idle time permitted for each online user. When the time expires, the user is forcibly logged off. An empty field indicates that the access users can always be online without performing any operations.

¡ Login Message—Enter the message to be displayed on user endpoints when users pass authentication.

¡ Max. Concurrent Logins—Enter the maximum number of concurrent online users of the same account. An empty field does not restrict the number of concurrent online users using the same account.

5. Configure the access services.

Select the access services on the access service list. You can select multiple services with different suffixes for each access user.

The access service list contains the following parameters:

¡ Service Name—Name of the access service, which must be unique in UAM.

¡ Service Suffix—Identifies the name of the domain to be used for endpoint user authentication. For more information, see Table 22. The user name and service suffix entered for user authentication are closely related to the domain where the access device authenticates the user.

¡ Allocate IP—IP address that the access service allocates to the user. An empty field indicates that the access service does not allocate any IP address.

The commands listed in Table 22 are available on HP Comware devices. The commands used on other access devices can vary.

Table 22 Service suffix and other configurations

Authentication user name	Authentication domain on the access device	Commands configured on the access device	Service suffix in UAM	Username prefix conversion mode
X@Y Y\X Y/X	Y	user-name-format with-domain	Y	Change to Suffix
X@Y Y\X Y/X	Y	user-name-format without-domain	None	Remove
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format with-domain	[Default Domain]	Change to Suffix
X [Default Domain]\X [Default Domain]/X	[Default Domain] (Default domain on the access device)	user-name-format without-domain	None	Remove

6. Configure the access device binding information.

If you select a binding option for a service without specifying a value for the parameter in the Access Device Binding Information area, UAM automatically acquires the binding information for the service when each user first passes authentication.

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings.

¡ Device SN—Enter the sequence number of the access device to which the access user is connected.

¡ Outer VLAN ID—Enter the outer VLAN ID that is contained in the access user's packets.

¡ VLAN ID/Inner VLAN ID—Enter a list of VLAN IDs or inner VLAN IDs that can be contained in the access user's packets.

¡ User SSID—Enter a list of SSIDs to which the access user can be connected.

7. Configure the terminal binding information.

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings.

¡ Windows Domain—Enter the name of the domain that the user endpoint must join or log in to.

8. Click OK.

The preregistered users change into ordinary access users and appear on the access user list.

Deleting preregistered users

When a preregistered user is deleted from the preregistered user list, you cannot register it as an ordinary access user.

To delete one or more preregistered users:

1. Access the preregistered user list page.

2. Select one or more preregistered users you want to delete.

3. Click Delete.

A confirmation dialog box opens.

4. Click OK.

Managing mute terminal users

Network terminals such as IP phones and printers do not offer authentication pages and cannot actively initiate authentication requests. They are categorized as mute terminals. To enable them to access the network, you can configure mute terminal users in UAM.

To reduce the workload of configuring mute terminal users separately, the following workflow applies:

· Configure a list of permitted MAC address ranges for mute terminals, and configure UAM to generate a set of predefined accounts.

· When a mute terminal is connected to the network, UAM checks the MAC address of the terminal. If the MAC address is permitted, UAM automatically changes the predefined account into a formal mute terminal user account, which is represented by the MAC address of the mute terminal in XX:XX:XX:XX:XX:XX format.

To improve efficiency, UAM predefines a set of special accounts that contain common mute terminal information. The predefined accounts are hidden from the configuration pages. When you create a mute terminal user, UAM simply adds the customized information to a predefined account, shortening the initial authentication time.

UAM offers the following functions for mute terminal user management:

· Managing the permitted MAC addresses for mute terminals—This function is performed by the mute terminal user configuration functional module.

· Managing the automatically generated mute terminal users—You can manage mute terminal users as you manage ordinary access users. Because you cannot change the password of a mute terminal user, the configuration page does not contain the options Allow User to Change Password, Enable Password Strategy, and Modify Password at Next Login. For other functions of mute terminal user management, see "Managing ordinary access users."

Accessing the mute terminal user configuration profile list page

A mute terminal user configuration profile determines the MAC addresses of mute terminals that are permitted to access the network.

To view the mute terminal user configuration profile list:

1. Click the User tab.

2. From the navigation tree, select Access User > Mute Terminal User.

The list includes all mute terminal user configuration profiles.

Mute terminal user configuration profile list contents

¡ Profile Name—Unique name of the mute terminal user configuration profile. Click the link to view profile name information.

¡ User Name Prefix—UAM creates a platform user named User Name Prefix+Mute Terminal MAC Address together with each mute terminal user.

¡ Service Group—Service group to which the mute terminal user configuration profile belongs for decentralized management.

¡ User Group—User group to which the mute terminal user generated based on the configuration profile belongs.

¡ Expiration Date—Date when the generated mute terminal user expires and becomes invalid. An empty field indicates that the mute terminal user never expires.

¡ Priority—Priority of the mute terminal user configuration profile. A smaller value represents a higher priority. If the MAC address of a mute terminal matches multiple MAC address ranges of different mute terminal user configuration profiles, the profile with the highest priority is used.

¡ Filter—Network access control of mute terminals when their MAC addresses are in the MAC address range of the user configuration profile. When Permit is displayed, the mute terminals are allowed to access the network. When Deny is displayed, the mute terminals are prohibited from accessing the network.

¡ Modify—Click the Modify icon to modify the mute terminal user configuration profile.

3. Click Refresh to view the latest list of mute terminal user configuration profiles.

Viewing mute terminal user configuration profile details

1. Access the mute terminal user configuration profile list page.

2. Click the name of the mute terminal user configuration profile you want to view.

Mute Terminal User area

¡ Profile Name—Name of the mute terminal user configuration profile, which must be unique in UAM.

¡ User Name Prefix—UAM creates a platform user named User Name Prefix+Mute Terminal MAC Address together with each mute terminal user.

¡ Service Group—Service group to which the mute terminal user configuration profile belongs for decentralized management.

¡ User Group—User group to which the mute terminal user belongs.

¡ Expiration Date—Date when the mute terminal user expires and becomes invalid. An empty field indicates that the mute terminal user never expires.

¡ Description—Description of the mute terminal user configuration profile for easy maintenance.

MAC Address Range area

Configure the range of MAC addresses for the mute terminals that are permitted or denied to access the network. You can configure multiple ranges. A mute terminal is permitted or denied to access the network when it belongs to one MAC address range.

¡ Start MAC—Lowest MAC address of mute terminals permitted or denied to access the network.

¡ End MAC—Highest MAC address of mute terminals permitted or denied to access the network.

¡ Description—Description of the MAC address range.

Access Service area

¡ Service Name—Name of the access service, which must be unique in UAM.

¡ Description—Description of the access service for easy maintenance.

¡ Service Suffix—Identifies the name of the domain to be used for mute terminal user authentication. For more information, see Table 23. The service suffix for authenticating a mute terminal is closely related to the MAC authentication domain on the access device.

¡ Status—Whether mute terminal users can apply for the service. A mute terminal user can apply for the access services in Available state only.

The commands listed in Table 23 are available on HP Comware devices. The commands used on other access devices can vary.

Table 23 Service suffix and other configurations

MAC authentication domain on the access device	Commands configuration on the access device	Service suffix in UAM
Y	user-name-format with-domain	Y
Y	user-name-format without-domain	None

Adding a mute terminal user configuration profile

The system supports a maximum of 1024 mute terminal user configuration profiles.

To add a mute terminal user configuration profile:

1. Access the mute terminal user configuration profile list page.

2. Click Add.

3. Configure the mute terminal user configuration profile parameters:

¡ Profile Name—Enter the name of the mute terminal user configuration profile, which must be unique in UAM.

¡ User Name Prefix—Enter the platform user prefix. UAM creates a platform user named User Name Prefix+Mute Terminal MAC Address together with each mute terminal user.

¡ Service Group—Select the service group to which the mute terminal user configuration profile belongs for decentralized management.

¡ User Group—Click the Select User Group icon to select the group to which the mute terminal user belongs in the Select User Group window.

¡ Expiration Date—Click the Calendar icon to select the expiration date, or enter the expiration date in YYYY-MM-DD format on which the mute terminal user expires and becomes invalid. An empty field indicates that the mute terminal user never expires.

¡ Priority—Enter an integer value to represent the priority of the mute terminal user configuration profile. A smaller value represents a higher priority. If the MAC address of a mute terminal matches multiple MAC address ranges of different mute terminal user configuration profiles, the profile with the highest priority is used. Do not configure the same priority for user configuration profiles that have a MAC address range overlap.

¡ Filter—Select the type of network access control of mute terminals when their MAC addresses are in the MAC address range of the user configuration profile. If Permit is selected, the mute terminals are allowed to access the network. If Deny is selected, the mute terminals are prohibited from accessing the network.

¡ Description—Description of the mute terminal user configuration profile for easy maintenance.

4. Configure the MAC address ranges:

Add one or more MAC address ranges. You can configure multiple ranges. A mute terminal can access the network when it belongs to one MAC address range.

To add one MAC address range at a time:

a. Click Add.

b. Enter the start and end MAC addresses in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX. Make sure that the start and end MAC addresses have the same first three bytes, indicating that they belong to the same vendor.

c. Enter the description of the MAC address range to facilitate maintenance.

d. Click OK.

e. Click the Delete icon to delete an undesired MAC address range.

f. Repeat the previous steps to add more MAC address ranges.

To import MAC address ranges in batches:

a. Click Batch Import.

b. Click Browse next to Import File to select a text or CSV file that stores MAC address ranges.

UAM supports importing only text and CSV files in ANSI code.

c. Select a column delimiter from the Column Delimiter list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($).

Select the comma (,) if you have selected a CSV file.

d. Click Next to open the basic information page.

UAM automatically analyzes the number of columns available in the file and displays the results in the list of each parameter.

e. Specify the following basic information:

- Start MAC—Lowest MAC address of the MAC address range. This parameter must be selected from the imported file.

- End MAC—Highest MAC address of the MAC address range. This parameter must be selected from the imported file.

- Description—Description of the MAC address range. Select a column number from the list, or select Not Imported, and then enter a description in the field next to the list. The description you entered applies to all imported MAC address ranges.

f. Click OK.

The Operation Result page displays the total number of imported MAC address ranges and import failures.

If import failures exist, you can click Download to download or open the operation log. The log records the MAC address ranges that failed to be imported as well as the failure reason.

To delete an undesired MAC address range, click the Delete icon for the MAC address range.

5. Select access services for the mute terminal user. You can select only one service.

Access service list content

¡ Service Name—Name of the access service, which must be unique in UAM.

¡ Description—Description of the access service for easy maintenance.

¡ Service Suffix—Identifies the name of the domain to be used for mute terminal user authentication. For more information, see Table 24. The service suffix for authenticating a mute terminal is closely related to the MAC authentication domain on the access device.

¡ Status—Identifies whether the mute terminal user can apply for the service. The mute terminal user can apply for the access services in Available state only.

The commands listed in Table 24 are available on HP Comware devices. The commands used on other access devices can vary.

Table 24 Service suffix and other configurations

MAC authentication domain on the access device	Commands configuration on the access device	Service suffix in UAM
Y	user-name-format with-domain	Y
Y	user-name-format without-domain	None

6. Click OK.

Modifying a mute terminal user configuration profile

1. Access the mute terminal user configuration profile list page.

2. Click the Modify icon for the mute terminal user configuration file you want to modify.

3. Modify the parameters as needed. The profile name and service group cannot be modified. For more information, see "Adding a mute terminal user configuration profile."

Table 25 Account number and profile number range matrix

Activating mute terminal user configuration profiles

This feature enables UAM to immediately create a number of predefined accounts based on based on the rule described in Table 25.

Number of generated predefined accounts per user configuration profile	Range of the number of muter terminal user configuration profiles
1000	1 to 16
200	17 to 64
50	65 to 700
20	701 to 1000

Mute terminal user configuration profiles can be automatically activated or manually activated. UAM automatically activates mute terminal user configuration profiles every 15 minutes.

To manually activate mute terminal user configuration profiles:

1. Access the mute terminal user configuration profile list page.

2. Click Activate.

After the predefined accounts of a mute terminal user configuration profile are changed into formal mute terminal user accounts, the number of predefined accounts reduces. When the profile is activated again, the number of the predefined accounts in the profile increases to the full specification. For example, mute terminal user configuration profile A has generated 1000 predefined accounts. When 100 predefined accounts are changed into formal mute terminal user accounts, the number of predefined accounts reduces by 100. The number of predefined accounts in this profile increases by 100 when the profile is activated.

If the predefined accounts of a profile are not changed into formal user accounts, the number of predefined accounts does not change as the number of profiles increases. For example, each profile generates 1000 predefined accounts if 10 profiles exist on UAM. If another 10 profiles are added, each new profile generates 200 predefined accounts and the number of predefined accounts in the existing profiles does not increase when they are activated. However, if some of the predefined accounts in an existing profile are changed into formal mute terminal user accounts, the number of predefined accounts in the profile reduces. If the number of predefined accounts in each existing profile is no less than 200, the number of predefined accounts in these profiles does not change when they are activated. If the number of predefined accounts in an existing profile is less than 200, the following events occur when these profiles are activated:

· The number of predefined accounts in the profile increases to 200.

· The number of predefined accounts in all other existing profile reduces to 200.

Deleting mute terminal user configuration profiles

1. Access the mute terminal user configuration profile list page.

2. Select one or more profile names you want to delete.

3. Click Delete.

5. Click Back to return to the guest manager list page.

4. Click OK.

Managing LDAP users

On some networks, LDAP servers such as Microsoft Active Directory are used to manage users. UAM can synchronize user data from LDAP servers and manage the LDAP users.

With LDAP user management, UAM is seamlessly integrated into existing networks and guarantees user data consistency.

For more information about LDAP user management, see "Managing LDAP users."

Managing guests

A guest refers to an endpoint user who temporarily needs to access the network, typically a visitor to an enterprise.

UAM provides the following procedures for managing and maintaining guests:

· A visitor preregisters a guest, and then the guest manager registers a preregistered guest.

· A guest manager creates a guest.

A visitor preregisters a guest and the guest manager registers a preregistered guest

1. In UAM, create guest managers and guest services.

2. Customize a login page that includes the Guest Preregister link for the Self-Service Center or Guest Center.

3. On the Self-Service Center or Guest Center login page, a visitor preregisters a guest.

4. In the Self-Service Center or Guest Center, a guest manager registers the preregistered guest, and specifies a service for the guest.

5. The visitor uses the guest account to access the network.

6. In UAM, IMC administrators can manage and maintain guests.

On the Self-Service Center or Guest Center login page, a visitor preregisters a guest for auto-registration

1. In UAM, create guest managers and guest services, and specify the default guest manager and the default guest service.

2. In Guest Parameters Settings, enable Guest Auto-Registration.

3. Customize a login page that includes the Guest Preregister link for the Self-Service Center or Guest Center.

4. On the Self-Service Center or Guest Center login page, a visitor preregisters a guest. UAM automatically registers the guest account, associates it with the default guest manager, and assigns it the default guest service.

5. The visitor uses the guest account to access the network.

6. In UAM, IMC administrators can manage and maintain guests.

On the portal login page, a visitor preregisters a guest for auto-registration

1. In UAM, create guest managers and guest services, and specify a default guest manager and a default guest service.

2. In Guest Parameters Settings, enable Guest Auto-Registration.

3. In portal management, configure the portal server to use the default Web login page.

4. When an endpoint user attempts to access the network, it is redirected to the default portal login page.

5. On the portal login page, the visitor preregisters a guest. UAM automatically registers the guest account, associates it with the default guest manager, and assigns it the default guest service.

6. The visitor uses the guest account for portal authentication to access the network.

7. In UAM, IMC administrators can manage and maintain guests.

This process is also known as lite guest registration.

A guest manager creates a guest

1. In UAM, create guest managers and guest services in guest management.

2. A guest manager logs in to the self-service center, manually adds a guest, and assigns a service to the guest.

3. The visitor uses the guest account to access the network.

4. In UAM, IMC administrators can manage and maintain guests.

Managing guest managers in UAM

Because it is hard for the IMC administrator to centrally manage guests and the guests are received by the enterprise staff, guest management is authorized to the enterprise staff. In other words, it is the enterprise staff that manages the guests. The specific implementation is as follows:

In UAM, specify an access user (typically corresponding to an enterprise staff) as a guest manager. A guest manager can manage the guests.

Accessing the guest manager list page

1. Click the User tab.

2. From the navigation tree, select Guest > Guest Manager. The Guest Manager page opens by default.

Guest manager list contents

¡ Account Name—Account name of the access user. The account name is used to log in to the self-service center. Click the name to display the access user details page. For more information, see "Viewing ordinary access user details."

¡ User Name—Name of the platform user to whom the access user is attached.

¡ User Group—User group to which the platform user belongs.

¡ Guest Manager Type—Value can be Guest Manager or Super Guest Manager. A guest manager can manage only part of the guests. A super guest manager can manage all guests.

¡ Guest Maximum Validity Time—Maximum validity period that the guest manager can set for a guest during registration. For information about guest preregistration, see "Registering a single preregistered guest" and "Bulk registering preregistered guests." If you do not set the parameter, the guest manager can specify the expiration time for managed guests without limitation.

¡ Managed Guest Group—User group to which guests approved by the guest manager are automatically assigned. When the guest manager approves a guest on the registration page, the name of the guest group is auto-populated in the User Group field and cannot be modified. If the managed guest group is not specified, the guest manager can assign a guest to any group when approving the guest.

¡ Send Approval Notification via SMS—Whether or not to send an SMS message to notify the guest of the registration.

¡ Send Approval Notification via Email—Whether or not to send an email to notify the guest of the registration.

¡ Default Guest Manager—Whether or not the account is the default guest manager for guests that are automatically registered. The value can be Yes or No. Only one guest manager can be configured as the default guest manager. Click Yes to cancel the default guest manager. Click No to set the guest manager as the default guest manager and cancel the previous default guest manager. This column is displayed only when guest auto-registration is enabled.

NOTE:

The Default Guest Manager column does not change immediately after the guest auto-registration setting is modified. To view the latest guest manager list, log in to IMC again.

Querying guest managers

1. Access the guest manager list page.

2. In the query area, specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of an access user. The access user uses the account name to log in to the self-service center. For example, if you enter x, all account names that contain x are matched.

¡ User Name—Enter a partial or complete platform user name. For example, if you enter y, all platform user names that contain y are matched.

¡ User Group—Click the Select User Group icon to select a group from the user group tree in the Select User Group window. You can select only one user group for query.

¡ Guest Manager Type—Select Guest Manager or Super Guest Manager from the list.

The query ignores empty fields.

3. Click Query. The list shows all guest managers that match the query criteria.

4. Click Reset to clear the query criteria. The list shows all guest managers in UAM.

Viewing guest manager details

1. Access the guest manager list page.

2. Click the account name of the guest manager whose detailed information you want to view.

The access user details page opens. For more information, see "Viewing ordinary access user details."

Adding a guest manager

1. Access the guest manager list page.

2. Click Add.

The Add Guest Manager page opens.

3. Select the guest manager type from the list: Guest Manager or Super Guest Manager.

A guest manager can manage only the guests that the guest manager has privileges to. A super guest manager can manage all guests.

4. Click the Select User Group icon next to the Managed Guest Group field. In the Select User Group window, select a group to which guests approved by the guest manager are assigned, and then click OK.

The selected user group is displayed in the Managed Guest Group field. All guests approved by the guest manager are automatically assigned to the group and cannot be changed. To remove the configuration, click the Delete icon .

If you do not specify a managed guest group, the guest manager can assign a guest to any group when approving the guest.

5. Enter a time value in the Guest Maximum Validity Time field, and then select the measurement unit. This parameter determines the validity period for all guests managed by the guest manager and affects the following settings:

¡ Limits the value ranges when the guest manager sets the validity time and expiration time for a guest, for example:

- Registering a preregistered guest in the PC-version self-service center.

- Adding guests in batches to UAM.

¡ Determines the validity period of guests for whom the guest manager cannot manually set the validity time and expiration time, for example:

- Guests automatically registered after being preregistered on the self-service center.

- Guests registered through SMS messages.

- Guests created by the guest manager in the touch-version self-service center.

The validity period of the previous guests is also affected by the Default validity period of guests parameter of the guest policy assigned to them. If the two parameters use different values, the parameter with the smaller value applies to the guests.

6. Select Send Approval Notification via SMS, Send Approval Notification via Email, or both as Approval Notification Types.

7. Select the access users you want to configure as guest managers.

a. Click Select in the Selected Access Users area.

The Select Access User page opens.

b. In the Query Access Users area, specify one or more of the following query criteria:

- Account Name—Enter a partial or complete account name of an access user. The access user uses the account name to log in to the self-service center. For example, if you enter x, all account names that contain x are matched.

- User Name—Enter a partial or complete platform user name. For example, if you enter y, all platform user names that contain y are matched.

- User Group—Click the Select User Group icon to select a group in the Select User Group window. You can select only one user group for query.

c. Click Query.

The list includes all access users matching the query criteria.

d. Select one or more account names.

e. Click OK.

The Select Access User page closes. On the Add Guest Manager page, the Selected Access Users area is automatically populated with the selected account names.

8. Click OK.

The Operation Result page opens, showing the number of guest managers successfully added and the number of failures. If failures exist, you can click Download to download or view the failure reasons in the operation log.

9. Click Back to return to the guest manager list page.

Modifying a guest manager

1. Access the guest manager list page.

2. Select one or more guest managers you want to modify.

Make sure the Guest Manager Type field is Guest Manager. Super guest managers cannot be modified.

3. Click Modify.

4. Select the guest manager type from the list: Guest Manager and Super Guest Manager.

A guest manager can manage only the guests that the guest manager has privileges to. A super guest manager can manage all guests.

5. Click the Select User Group icon next to the Managed Guest Group field. In the Select User Group window, select a group to which guests approved by the guest manager are assigned, and then click OK.

If you do not specify a managed guest group, the guest manager can assign a guest to any group when approving the guest.

6. Modify the value and measurement unit of the Guest Maximum Validity Time parameter. This parameter determines the validity period for all guests managed by the guest manager and affects the following settings:

¡ Limits the value ranges when the guest manager sets the validity time and expiration time for a guest, for example:

- Registering a preregistered guest in the PC-version self-service center.

- Adding guests in batches to UAM.

¡ Determines the validity period of guests for whom the guest manager cannot manually set the validity time and expiration time, for example:

- Guests automatically registered after being preregistered on the self-service center.

- Guests registered through SMS messages.

- Guests created by the guest manager in the touch-version self-service center.

7. Select Send Approval Notification via SMS, Send Approval Notification via Email, or both for Approval Notification Types.

8. Click OK.

The Operation Result page opens, showing the number of guest managers successfully modified and the number of failures. If failures exist, click Download to download or view the failure reasons in the operation log.

9. Click Back to return to the guest manager list page.

Deleting guest managers

Deleting a guest manager does not delete the access user corresponding to the guest manager.

Deleting a guest manager does not delete the guests that are managed by the guest manager.

To delete one or more guest managers:

1. Access the guest manager list page.

2. Select one or more guest managers you want to delete.

3. Click Delete.

A confirmation dialog box opens.

4. Click OK.

The Operation Result page opens, showing the number of guest managers successfully deleted and the number of failures. If failures exist, click Download to download or view the failure reasons in the operation log.

Specifying the default guest manager

When guest auto-registration is enabled, UAM automatically uses the default guest manager to manage all guest accounts that are automatically registered.

On the guest manager list, click No in the Default Guest Manager column to configure a guest manager as the default guest manager. This operation also cancels the previous default guest manager at the same time.

The Default Guest Manager column is displayed only when guest auto-registration is enabled. The column does not change immediately after the guest auto-registration setting is modified. To view the latest guest manager list, log in to IMC again.

Accessing the guest manager group list page

1. Click the User tab.

2. From the navigation tree, select Guest > Guest Manager.

3. Click the Guest Manager Group tab.

The list includes all guest manager groups.

Guest manager group list contents

¡ User Group—User group of the platform user associated with the guest manager.

¡ Guest Manager Type—Value can be Guest Manager or Super Guest Manager. A guest manager can manage only part of the guests. A super guest manager can manage all guests.

¡ Send Approval Notification via SMS—Whether or not to send an SMS message to notify the guest of the registration.

¡ Send Approval Notification via Email—Whether or not to send an email to notify the guest of the registration.

¡ Modify—Click the Modify icon to modify a guest manager group.

¡ Delete—Click the Delete icon to delete a guest manager group.

Adding a guest manager group

1. Access the guest manager group list page.

2. Click Add.

The Add Guest Manager Group page opens.

3. Select the guest manager type from the list: Guest Manager or Super Guest Manager.

A guest manager can manage only the guests that the guest manager has privileges to. A super guest manager can manage all guests.

4. Enter a time value in the Guest Maximum Validity Time field, and then select the measurement unit. This parameter determines the validity period for all guests managed by the guest manager and affects the following settings:

¡ Limits the value ranges when the guest manager sets the validity time and expiration time for a guest, for example:

- Registering a preregistered guest in the PC-version self-service center.

- Adding guests in batches to UAM.

¡ Determines the validity period of guests for whom the guest manager cannot manually set the validity time and expiration time, for example:

- Guests automatically registered after being preregistered on the self-service center.

- Guests registered through SMS messages.

- Guests created by the guest manager in the touch-version self-service center.

5. Select SMS, Email, or both for the Send Approval Notification by field.

6. Select user groups.

7. Click OK.

Access users in the selected user groups are all assigned as guest managers.

Modifying a guest manager group

1. Access the guest manager group list page.

2. Click the Modify icon for a group.

3. Modify the guest manager type, guest maximum validity period, and approval notification method. For more information, see "Adding a guest manager group."

4. Click OK.

Deleting a guest manager group

Deleting a guest manager group will cancel the guest manager role for all access users in the group.

To delete a guest manager group:

1. Access the guest manager group list page.

2. Click the Delete icon for a group.

A confirmation dialog box opens.

3. Click OK.

Configuring guest services in UAM

A guest service is dedicated to guests. You do not need to add guest services.

You can configure existing services in UAM as guest services. However, if a service's Allocate IP parameter in one or more access policies is configured as Yes, then the service cannot be configured as a guest service.

Accessing the guest service list page

1. Click the User tab.

2. From the navigation tree, select Guest > Guest Service.

The list includes all guest services.

Guest service list contents

¡ Service Name—Name of the service. Click the link to display the access user details page. For more information, see "Viewing ordinary access user details."

¡ Status—Indicates whether guests can apply for the service. Services in Unavailable state cannot be applied for.

¡ Description—Description of the service.

¡ Service Suffix—Identifies the name of the domain to be used for guest authentication.

¡ Service Group—Service group to which the service belongs for decentralized management.

¡ Default Security Policy—Name of the security policy to be applied to users who do not match any predefined access scenario. This parameter is displayed only when the EAD component is installed.

¡ Default Guest Service—Whether or not the service is used as the default guest service. The value can be Yes or No. The default guest service is assigned to the following guests:

- Guests registered and authenticated through SMS messages.

- Guests automatically registered and authenticated through QR codes.

- Guests automatically registered in the PC-version self-service center.

- Automatically registered BYOD guests.

- Guests created and registered in the touch-version self-service center.

Only one service can be configured as the default guest service. Click Yes to cancel the service. Click No to use the service as the default guest service and cancel the previous setting. This column is displayed only when guest auto-registration is enabled.

NOTE:

The Default Guest Service column does not change immediately after the guest auto-registration setting is modified. To view the latest guest service list, log in to IMC again.

3. Click Refresh to view the latest guest service list.

Viewing guest service details

1. Access the guest service list page.

2. Click the name of the guest service whose detailed information you want to view.

The service details page opens. For more information, see "Viewing access service details."

Adding guest services

1. Access the guest service list page.

2. Click Add.

This page lists all services that can be applied for.

3. Select one or more services.

4. Click OK.

The Operation Result page opens, showing the number of guest services successfully added and the number of failures. If failures exist, click Download to download or view the failure reasons in the operation log.

5. Click Back to return to the guest service list page.

Deleting guest services

You cannot delete guest services that are being used by guests. Also, deleting a guest services does not delete the access service corresponding to the guest service.

To delete one or more guest services:

1. Access the guest service list page.

2. Select one or more guest services you want to delete.

3. Click Delete.

A confirmation dialog box opens.

4. Click OK.

The Operation Result page opens, showing the number of guest services successfully deleted and the number of failures. If failures exist, click Download to download or view the failure reasons in the operation log.

5. Click Back to return to the guest service list page.

Specifying the default guest service

When guest auto-registration is enabled, configure the default guest service. UAM assigns the service to the guest accounts that are automatically registered.

On the guest service list, click No in the Default Guest Service column to specify a service as the default guest service. This operation also cancels the previous default guest service at the same time.

The Default Guest Service column is displayed only when guest auto-registration is enabled. The column does not change immediately after the guest auto-registration setting is modified. To view the latest guest manager list, log in to IMC again.

Managing guest policies

A guest policy is a set of guest registration parameters that are applied to users based on their registration time, registration location, and endpoint used.

To apply a guest policy to guest registration:

1. Configure a guest policy and assign it to a guest group in UAM.

2. Configure a page push policy. Associate a guest login page and the guest group with specific conditions in the policy. Conditions indicate the location, access time, and endpoint of users.

When an endpoint user attempts to access the network, UAM automatically obtains user access information. If the user attempts to access unauthorized resources, UAM performs the following operations:

· Pushes the login page associated with the matching conditions to the user.

· Determines the guest group for the user according to the matching conditions, and then applies the guest policy of the guest group. If no guest policy is assigned to the guest group, UAM applies the default guest policy to the user.

Accessing the guest policy list page

1. Click the User tab.

2. From the navigation tree, select Guest > Guest Policy.

The list includes all guest policies.

Guest policy list contents

¡ Policy Name—Name of the guest policy. Click the name to view the guest policy details.

¡ Description—Description of the guest policy.

¡ Modify—Click the Modify icon to modify the guest policy.

¡ Delete—Click the Delete icon to delete the guest policy.

Modifying the default guest policy

UAM predefines a policy named Default Guest Policy for all guests located in a guest group with no guest policy assigned. The default guest policy must use the default guest service.

If no default guest service is specified, configure the default guest service first. For more information, see "Specifying the default guest service." After the default guest service is specified, it is automatically assigned to the default guest policy and cannot be deleted.

Viewing guest policy details

1. Access the guest policy list page.

2. Click the name of the guest policy with the detailed information you want to view. The guest policy details page includes the following parameters:

Basic Information

¡ Policy Name—Name of the guest policy.

¡ Description—Description of the guest policy.

Guest Parameters Settings

¡ Guest Auto-Registration—Whether or not preregistered guests can be automatically registered without the approval of a guest manager. The value can be Enable or Disable. This parameter takes effect only when the Guest Auto-Registration parameter is enabled on the Guest Parameters page.

¡ Send Guest Password by—This parameter determines the way in which UAM sends the password to a guest that is successfully registered. Options are SMS Message and Email.

- To send guest passwords by SMS message, configure the SMS message content. For information about configuring SMS system parameters, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. For information about configuring the SMS message content, see "Delivering messages."

- To send guest passwords by email, make sure the mail server settings are correctly configured in the system configuration of the IMC platform. The email content is predefined by the system and cannot be modified.

If neither option is selected, UAM does not send passwords to guests.

¡ Display QR Code after Guest Preregistration—Whether or not to display a QR code after a guest is preregistered. The guest manager can scan the QR code to approve the guest registration.

¡ Validate Guest at—Determines the time when a guest is validated. This parameter applies to all guests except those preregistered on the self-service center. The value can be Specified Time or First Login.

- Specified Time—After a guest is automatically registered, the guest validity time specified by the guest manager applies to the guest.

- First Login—A registered guest becomes valid at first login.

¡ Default validity period of guests—Default validity period of guests whose expiration time is not configured or cannot be configured. The validity period of those guests are also affected by the Guest Maximum Validity Time parameter of a guest manager. If the two parameters use different values, the parameter with the smaller value applies to the guests. For information about configuring the Guest Maximum Validity Time parameter, see "Adding a guest manager."

¡ Guest Password Lifetime—Maximum time in which a guest password is valid. Once the password is expired, the guest cannot access the network. The value 0 indicates the guest password never expires.

¡ Password Generation Rule—Rule that defines the type of passwords dynamically generated by UAM. UAM supports the following password generation rules:

- N Bit Numeric.

- N Bit Letters.

- N Bit Alphanumeric.

N is an integer in the range of 1 to 32. This parameter does not take effect when guests manually enter passwords for registration.

¡ Default Online Guests—Default value of Max. Concurrent Logins displayed on the guest preregistration page.

¡ Max. Online Guests—Maximum value that can be specified for Max. Concurrent Logins on the guest preregistration page.

Quick Account Creation

¡ Guest Lite Registration Verification—Method of verifying endpoint users for guest registration. The value can be:

- Verification Code—The user must enter the verification code generated on the SMS guest sign-in and authentication page.

- License Code[XXX]—The user must enter the correct license code generated in the brackets ([]).

- No Verification—The user does not need to be verified.

Use Verification Code or License Code to prevent malicious registration.

¡ Name Generation Rule—Rule for UAM to generate guest account names. The value can be Millisecond value for system time, Prefix[XXXX]+millisecond value, or YYMMDDhhmmss+4-digit random number.

For example, if a guest is registered at 2014-01-01 08:08:08:123 (1388534888123 in milliseconds), UAM generates one of the following account names for the guest:

- 1388534888123 when Millisecond value for system time is selected.

- auto1388534888123 when Prefix+millisecond value is selected and the prefix is set to auto.

- 140101080808ZZZZ when YYMMDDhhmmss+4-digit random number is selected. ZZZZ indicates the 4-digit random number.

Guest Service List

The list displays the default guest service to be assigned to guests who use this guest policy. The guest manager can modify the guest service for individual guests when approving the guest registration.

Guest Group List

The list displays the guest groups to which this guest policy is assigned.

3. Click Back.

Querying guest policies

1. Access the guest policy list page.

2. In the Query Guest Policies area, specify one or more of the following query criteria:

¡ Policy Name—Enter a partial or complete name of the guest policy.

¡ Guest Service—Select a guest service from the list.

¡ Guest Group—Click the Select User Group icon . In the Select User Group window, select a user group and click OK.

The query ignores empty fields.

3. Click Query. The list shows all guest policies that match the query criteria.

4. Click Reset to clear the query criteria. The list shows all guest policies in UAM.

Adding a guest policy

1. Access the guest policy list page.

2. Click Add.

The Add Guest Policy page opens.

3. Configure the basic parameters:

¡ Policy Name—Enter a unique name for the guest policy.

¡ Description—Enter a description for the guest policy.

4. Configure the basic functions settings:

¡ Guest Auto-Registration—Select whether or not to allow preregistered guests to be automatically registered without the approval of a guest manager. Options are Enable and Disable. This parameter takes effect only when the Guest Auto-Registration parameter is enabled on the Guest Parameters page and the default guest manager and guest service are configured.

¡ Send Guest Password by—Select the way in which UAM sends the password to a guest that is successfully registered. Options are SMS Message and Email.

If neither option is selected, UAM does not send passwords to guests.

¡ Display QR Code after Guest Preregistration—Select whether or not to display a QR code after a guest is preregistered. The guest manager can scan the QR code to approve the guest registration.

¡ Validate Guest at—Select the time to validate a guest. This parameter applies to all guests except those preregistered on the self-service center. Options are Specified Time or First Login.

- Specified Time—After a guest is automatically registered, the guest validity time specified by the guest manager applies to the guest.

- First Login—A registered guest becomes valid at first login.

¡ Default validity period of guests—Specify the default validity period of guests whose expiration time is not configured or cannot be configured. The validity period of those guests are also affected by the Guest Maximum Validity Time parameter of a guest manager. If the two parameters use different values, the parameter with the smaller value applies to the guests. For information about configuring the Guest Maximum Validity Time parameter, see "Adding a guest manager."

¡ Guest Password Lifetime—Specify the time period in which a guest password is valid. For example, if Guest Password Lifetime is 2 days, a password set on 2014-10-10 10:00 will expire on 2014-10-12 10:00. Once the password is expired, the guest cannot access the network. The value 0 indicates the guest password never expires.

¡ Password Generation Rule—Configure the rule to define the type of passwords dynamically generated by UAM. UAM supports the following password generation rules:

- N Bit Numeric.

- N Bit Letters.

- N Bit Alphanumeric.

N is an integer in the range of 1 to 32. This parameter does not take effect when guests manually enter passwords for registration.

¡ Default Online Guests—Enter the default value of Max. Concurrent Logins displayed on the guest preregistration page.

¡ Max. Online Guests—Enter the maximum value that can be specified for Max. Concurrent Logins on the guest preregistration page.

5. Configure the quick guest creation settings:

¡ Guest Lite Registration Verification—Select the method for verifying endpoint users for guest registration. The value can be:

- Verification Code—The user must enter the verification code generated on the SMS guest sign-in and authentication page.

- License Code[XXX]—The user must enter the correct license code generated in the brackets ([ ]).

- No Verification—The user does not need to be verified.

Use Verification Code or License Code to prevent malicious registration.

¡ Name Generation Rule—Select the rule for UAM to generate guest account names. Options are Millisecond value for system time, Prefix + millisecond value, and YYMMDDhhmmss + 4-digit random number. If Prefix + millisecond value is selected, enter the prefix in the text box next to this field.

For example, if a guest is registered at 2014-01-01 08:08:08:123 (1388534888123 in milliseconds), UAM generates one of the following account names for the guest:

- 1388534888123 when Millisecond value for system time is selected.

- auto1388534888123 when Prefix+millisecond value is selected and the prefix is set to auto.

- 140101080808ZZZZ when YYMMDDhhmmss + 4-digit random number is selected. ZZZZ indicates the 4-digit random number.

6. On the Guest Service List, select the default guest service for guests to whom this policy is assigned. Only one service can be selected. For information about configuring guest services, see "Adding guest services."

7. On the Guest Group List, select the guest groups to which this guest policy is assigned. Guest groups are unavailable if they are already assigned to other guest policies.

To automatically select the parent groups and subgroups of the selected guest groups, select the following option: The father and child groups are automatically selected when you select a user group.

8. Click OK.

Modifying a guest policy

1. Access the guest policy list page.

2. Click the Modify icon for the guest policy you want to modify.

The Modify Guest Policy page opens.

3. Modify the guest policy parameters. For information about the parameter descriptions, see "Adding a guest policy."

4. Click OK.

Deleting a guest policy

1. Access the guest policy list page.

2. Click the Delete icon for the guest policy you want to delete.

A confirmation dialog box opens.

Figure 90 XML for print preview page

Configuring guest service parameters

The guest service parameters take effect on the guest management module.

To configure guest service parameters:

1. Click the User tab.

2. From the navigation tree, select Guest > Guest Parameters.

3. Configure functionality settings:

¡ Expired Guest Retention Time (Days)—Enter the duration before an expired guest is permanently from UAM.

¡ SMS Retrieval Interval (seconds)—Enter the minimum interval between two password retrievals for the same guest account through an SMS message. This parameter takes effect only on guests verified through an SMS message.

¡ SMS Reset Password—Configure whether to reset the password each time a guest gets a password for login. Options are Enable and Disable. When you select Enable, a guest gets a new password. When you select Disable, a guest uses the last login password until the password expires, and uses a new password after the password expires.

¡ Guest Preregistration—Configure the guest preregistration function. Options are Enable and Disable.

If you select Enable, UAM allows endpoint users to preregister guest accounts. The Display option is automatically selected for the Guest Preregister link on the self-service login page.

If you select Disable, the endpoint users cannot preregister guest accounts. The Display option is automatically cleared for the Guest Preregister link on the self-service login page.

For information about modifying the self-service login page, see "Modifying the self-service login page for PCs" and "Modifying the self-service login page for mobile devices."

¡ Allow Duplicate Phone Numbers—Configure whether or not to allow duplicate phone numbers for guest preregistration. Options are Yes and No. If you select Yes, endpoint users can preregister multiple guests by using the same phone number. If you select No, endpoint users must specify a unique phone number in each guest preregistration.

¡ Associate Existing Users—Configure whether or not to check the combination of the account name and identity number for guest preregistration. Options are Yes and No. If you select Yes, UAM does not check whether the combination is already registered by a guest. If you select No, endpoint users must use a combination that is not registered by other guests for preregistration.

¡ Default user group for guests—Click the Select User Group icon . The Select User Group window opens. Select a group and click OK. You can select only one user group. After you select a user group, all new guests are added to the user group. This operation does not change the user group of existing guests.

¡ Password Strategy for Guest Preregistration—Select Enable or Disable to enable or disable the password strategy for guest preregistration.

If you select Enable, the password set by a guest for preregistration must meet the requirements of the password strategy. This restriction does not apply when the guest modifies the password after approval.

For information about configuring the password strategy, see "Configuring global system settings."

4. Click OK.

Customizing and printing guest information

UAM provides a configuration file for the page of printing guest information. You can modify this configuration file to customize the guest information to be printed.

To modify the configuration file:

1. Click the User tab.

2. From the navigation tree, select Guest > Guest Information Print Configuration.

The Guest Information Print Configuration page opens.

3. In the Logo field, click Browse to select a logo image, and click Upload to upload the logo to UAM.

If no logo is specified, the printed guest information will contain no logo.

4. Configure contents in the XML for Print Preview Page field.

Figure 90 shows the sample XML file contents for printing guest information.

Table 26 Field description

No.	Description
1	Root node of the file. The file must contain one root node.
2	Logo location and size. The <logo-style></logo-style>. tags appear only when a logo image has been imported to UAM. The height:6px string indicates the height of the logo is 6 pixels. As a best practice, set either the width value or the height value to adjust the logo based on the original aspect ratio. If no width or height is specified, the original logo size is used.
3	Title format settings, including: · The color:red string indicates that the title font color is red. · The font-size:20px string indicates that the title font size is 20 pixels. · The font-weight:bold string indicates that the title text is in bold. · The padding-left:20px string indicates a left padding of 20 pixels. · The font-family:"Times New Roman" string indicates that the title font is Times New Roman.
4	Title content. Edit the text to add additional information to the title. In this example, the title is Guest Details($fullName), where $fullName represents the guest name.
5	Settings for the delimiter between titles and page contents. The width:260px;height:1px string indicates that the delimiter is 260 pixels wide and 1 pixel high.
6	Page content format settings, including: · The font-size:15px string indicates that the page font size is 15 pixels. · The padding-top:10px string indicates a top padding of 100 pixels. · The font-style:normal string indicates that the page font style is normal. · The padding-left:30px string indicates a left padding of 30 pixels. · The font-family:"Times New Roman" string indicates that the page font is Times New Roman. · The align:right string indicates that the page content is right aligned.
7	Page contents. Each line indicates a parameter name and the value. To add other parameters to the page, make sure the new strings are consistent with the field names in the user additional information. For example, to add the company name for the guest, configure <line>Company name: $Company name</line>. For more information about user additional information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide.

NOTE:

· UAM ignores contents that are not enclosed by tags.

· To configure the size of the print preview page, add <window-size></window-size> tags to the root node. For example, use <window-size width="550" height="650"></window-size> to indicate a page of 650 × 550 pixels.

5. Click Print Preview.

The Print Preview page displays the most recent guest information.

6. Click OK.

Preregistering a guest on the self-service center login page (by a guest)

This topic describes how to preregister a guest on the self-service center login page. For more information about the self-service center, see "Using the user self-service."

To allow a guest to perform preregistration, complete the following configurations:

· Specify at least one access user as a guest manager in guest management. For more information, see "Adding a guest manager."

· Specify at least one service as a guest service in guest management. For more information, see "Adding guest services."

· Customize a Self-Service Center login page that includes the Guest Preregister link. For more information, see "Customizing and applying self-service pages."

To preregister a guest:

1. Open the Web browser, and enter http://ip:port/selfservice in the address bar to open the self-service center login page.

In http://ip:port/selfservice, ip is the IP address of the server with the self-service component installed and port is the HTTP or HTTPS service port number provided by the self-service component.

2. Click the Preregister Guest link.

3. Configure the following basic information:

¡ Guest Name—Real name of the guest.

¡ Identity Number—Number of the guest's identity certificate, for example, ID card or passport.

¡ Organization—Organization of the guest.

¡ Telephone—Telephone number of the guest.

¡ Email—Email address of the guest.

4. Configure the user access information:

¡ Account Name—Account name that the guest uses to access the network. The account name must be unique in UAM.

¡ Guest Manager—Guest manager who is responsible for managing the guest's account. You can select a guest manager from the list.

¡ Password/Confirm Password—Password that the guest uses to access the network.

¡ Visited Department—Department that the guest visits.

¡ Receptionist—Name of the person who the guest visits. Generally, the receptionist is the enterprise staff corresponding to the guest manager.

¡ Max. Concurrent Logins—Maximum number of concurrent online users who can use the guest account.

¡ Verification Code—Letters and numbers that display on the image at the right.

5. Click OK.

6. Click Reset to restore all information to the default.

The approval process for a preregistered guest varies depending on whether or not guest auto-registration is enabled.

· When guest auto-registration is disabled, UAM displays the registration result page after a guest account is preregistered. The guest manager uses either of the following methods to approve the guest registration:

¡ Scans the QR code on the registration result page to access the page for approving registration of the guest.

The QR code is displayed only when the Display QR Code after Guest Preregistration parameter is set to Yes in the guest policy. After approval, the guest can scan the QR code to get the endpoint authenticated for network access.

¡ Logs in to the self-service center to approve the guest registration.

If Display QR Code after Guest Preregistration is set to No in the guest policy, UAM sends an approval notification message by SMS or email to the guest manager. The guest manager must log in to the self-service center to approve registration of the guest.

· When guest auto-registration is enabled, UAM automatically registers the guest account immediately after the account is preregistered. It then sends the account name and password to the guest by SMS and email. The sending result is displayed on the registration result page.

For more information about configuring guest auto-registration, see "Managing guest policies."

To use the SMS function, enable IMC to send SMS messages, and configure a telephone number or account name for the guest in the required format. To use the email function, first configure the mail server settings. For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. Make sure the email address configured for the guest is valid.

Managing preregistered guests in the self-service center (by a guest manager)

This topic describes only how a guest manager manages preregistered guests in the self-service center. For more information about the self-service center, see "Using the user self-service."

Open the Web browser, and enter http://ip:port/selfservice in the address bar to open the self-service center login page. Then, input the account name, password, and verification code, select Ordinary user from the User type list, and click Login to log in to the self-service center.

In http://ip:port/selfservice, ip is the IP address of the server with the self-service component installed and port is the HTTP or HTTPS service port number provided by the self-service component.

Accessing the preregistered guest list page

To view preregistered guests, select Guest Management > All Preregistered Guests from the navigation tree.

If you are a super guest manager, the list includes all preregistered guests. If you are a guest manager, the list includes only preregistered guests who have selected the guest manager during guest preregistration.

Preregistered guest list contents

· Account Name—Account name of the preregistered guest. The preregistered guest uses this account name for authentication.

· Guest Name—Real name of the preregistered guest.

· Registration Date—Date when the guest account is preregistered.

· Expiration Time—Date and time when the preregistered guest expires and becomes invalid. By default, the expiration time is 7 days after the preregistration date.

· Visited Department—Department that the preregistered guest visits.

· Receptionist—Name of the person who the preregistered guest visits.

· Register—Click the Register icon to change the preregistered guest into a guest.

· Delete—Click the Delete icon to delete the preregistered guest.

Performing a basic query for preregistered guests

1. Access the preregistered guest list page.

2. Click the Basic Query link on the upper right side of the Query Preregistered Guests area to use the basic query.

You can perform a basic query if you see Advanced Query on the upper right side of the Query Preregistered Guests area.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of a preregistered guest. For example, if you enter x, all account names that contain x are matched.

¡ Guest Name—Enter a partial or complete real name of a preregistered guest. For example, if you enter y, all guest names that contain y are matched.

¡ Receptionist—Enter a partial or complete name of the person who a preregistered guest visits. For example, if you enter x, all receptionist names that contain x are matched.

¡ Visited Department—Enter a partial or complete name of the department that a preregistered guest visits. For example, if you enter y, all visited department names that contain y are matched.

The query ignores empty fields.

4. Click Query. The list shows all preregistered guests that match the query criteria.

5. Click Reset to clear the query criteria. The list shows all preregistered guests in the self-service center.

Performing an advanced query for preregistered guests

1. Access the preregistered guest list page.

2. Click the Advanced Query link on the upper right side of the page.

You can perform an advanced query if you see Basic Query on the upper right side of the page.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of a preregistered guest. For example, if you enter x, all account names that contain x are matched.

¡ Guest Name—Enter a partial or complete real name of a preregistered guest. For example, if you enter y, all guest names that contain y are matched.

¡ Receptionist—Enter a partial or complete name of the person who a preregistered guest visits. For example, if you enter x, all receptionist names that contain x are matched.

¡ Visited Department—Enter a partial or complete name of the department that a preregistered guest visits. For example, if you enter y, all department names that contain y are matched.

¡ Registration Date From/To—Click the Calendar icon to enter the date when a guest is preregistered. The registration date is in the format of YYYY-MM-DD. In the time field that is displayed, select the registration date range.

¡ Guest Manager—If you are a guest manager, this field cannot be modified. If you are a super guest manager, you can select a guest manager from the list.

The query ignores empty fields.

4. Click Query. The list shows all preregistered guests that match the query criteria.

5. Click Reset to clear the query criteria. The list shows all preregistered guests in the self-service center.

Viewing preregistered guest details

1. Access the preregistered guest list page.

2. Click the account name of the preregistered guest whose detailed information you want to view.

The account details page opens.

Basic Information area

¡ Guest Name—Name of the preregistered guest.

¡ Identity Number—Number of the preregistered guest's identity certificate, for example, ID card or passport.

¡ Organization—Organization of the preregistered guest.

¡ Telephone—Telephone number of the preregistered guest.

¡ Email—Email address of the preregistered guest.

User Access Information area

¡ Account Name—Account name that the preregistered guest uses to access the network.

¡ Registration Date—Date when the guest is preregistered.

¡ Visited Department—Department that the preregistered guest visits.

¡ Receptionist—Name of the person who the preregistered guest visits. Generally, the receptionist is the enterprise staff corresponding to the guest manager.

¡ Max. Concurrent Logins—Maximum number of concurrent online users who can use the guest account.

3. Click Back to return to the preregistered guest list page.

Guest registration prerequisites

When a guest account is successfully preregistered, UAM sends the account name and password to the guest by SMS and email.

To use the SMS function, enable IMC to send SMS messages, and configure a telephone number or account name for the guest in the required format. For information about configuring SMS system parameters, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. For information about configuring the SMS message content, see "Delivering messages."

To use the email function, first configure the mail server settings. For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. Make sure the email address configured for the guest is valid.

You can either register a single preregistered guest or bulk register multiple guests.

Registering a single preregistered guest

When you register a single preregistered guest, you can configure detailed information for the preregistered guest. However, registering preregistered guests one at a time is not time efficient.

To register a preregistered guest:

1. Access the preregistered guest list page.

2. Click the Register icon for the preregistered guest you want to register.

The Register page opens.

3. Modify the following basic information as needed:

¡ Guest Name—Name of the guest.

¡ Identity Number—The number of the guest's identity certificate, for example, ID card or passport.

¡ Organization—Organization of the guest.

¡ Telephone—Telephone number of the guest.

¡ Email—Email address of the guest.

¡ User Group—Click the Select User Group icon . In the Select User Group window, select the user group to which the guest belongs, and then click OK.

This field is configurable only if the guest manager does not have a managed guest group. If the guest manager has a managed guest group, this field displays the name of the managed guest group and cannot be modified.

4. Configure the user access information as needed:

¡ Account Name—Account name that the guest uses to access the network. The account name must be unique in UAM.

¡ Start Time—Date and time when the guests become valid. Leave this field empty if you want the guests to become valid immediately after being created.

¡ End Time—Date and time when the guest expires and becomes invalid.

¡ Password/Confirm Password—Set the password for the guest to access the network.

¡ Visited Department—Department that the guest visits.

¡ Receptionist—Name of the person who the guest visits. Generally, the receptionist is the enterprise staff corresponding to the guest manager.

¡ Guest Manager—If you are a super guest manager, you can select a guest manager for the preregistered guest from the list, and the selected guest manager is responsible for managing the guest accounts. If you are a guest manager, this field cannot be modified.

¡ Max. Concurrent Logins—Maximum number of concurrent online users who can use the guest account.

¡ Comments—Comments for easy maintenance of guest information.

5. In the Guest Service area, select an access service for the guest. You can select only one access service for a guest.

Guest Service List content

¡ Service Name—Name of the service.

¡ Description—Description of the service for easy maintenance.

¡ Service Suffix—Identifies the name of the domain to be used for guest authentication.

¡ Status—Whether guests can apply for the service. A guest can apply for services in Available state only.

¡ Default Security Policy—Default security policy contained in the service. This parameter is displayed only when the EAD component is deployed.

6. Configure the access device binding information.

The binding parameters in this area take effect only when they are selected in the Authentication Binding Information area of the selected service. For example, the Device IP parameter is effective to the services with the Bind Access Device IP option selected.

If a binding parameter is selected for a service but the binding parameter is not configured, the self-service center automatically acquires the binding parameter information. The self-service center uses the information of the first successful authentication of the guest as the binding information.

To pass authentication, the guest must meet all requirements of the access device bindings and terminal bindings.

¡ Device SN—Enter the sequence number of the access device to which the guest is connected.

¡ Port—Enter the port through which the guest is connected to the access device. The value is the last portion of an interface number. For example, if a guest is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

¡ Outer VLAN ID—Enter the outer VLAN ID that is contained in the guest's packets.

¡ VLAN ID/Inner VLAN ID—Enter a list of VLAN IDs or inner VLAN IDs that can be contained in the guest's packets.

¡ User SSID—Enter a list of SSIDs to which the guest can be connected.

¡ Device IP—Enter a list of IPv4 address for the access devices to be bound to the guest. Each entry on the list represents the IP address of an access device bound to the guest. If a device has multiple IP addresses, use the IP address of the corresponding access device in UAM.

¡ Device IPv6 Address—Enter a list of IPv6 address for the access devices to be bound to the guest. Each entry on the list represents the IPv6 address of an access device bound to the guest. If a device has multiple IPv6 addresses, use the IPv6 address of the corresponding access device in UAM.

7. Configure the terminal binding information.

The binding parameters in this area take effect only when they are selected in the Authentication Binding Information area of the selected service. For example, the Computer Name parameter is effective to the services with the Bind Computer Name option selected.

If a binding parameter is selected for a service but the binding parameter is not configured, the self-service center automatically acquires the binding parameter information. It uses the information of the first successful authentication of the user as the binding information.

To pass authentication, the guest must meet all requirements of the access device bindings and terminal bindings.

¡ Computer Name—Enter the name of the computer to which the guest is bound.

¡ IMSI—Enter the IMSI of the endpoint to be bound to the guest.

¡ Windows Domain—Enter the name of the domain that the guest endpoint must join or log in.

¡ Terminal IP Address—Enter a list of IPv4 addresses or IPv4 address ranges for the endpoints from which the guest can access the network. The IPv4 address ranges must be specified in the format X.X.X.X-X.X.X.X.

¡ Terminal MAC Address—Enter a list of MAC addresses for the endpoints from which the guest can access the network.

¡ Terminal IPv6 Address—Enter a list of IPv6 addresses for the endpoints from which the guest can access the network. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ IMEI—Enter the IMEI of the endpoint to be bound to the guest.

8. Click OK or OK & Print.

If you click OK, UAM registers the guest.

If you click OK & Print, UAM registers the guest and displays the guest details page. Click Print at the upper right corner to display the print preview window. The window supports custom settings, such as the page size, title, and fields. For more information, see "Customizing and printing guest information." To print guest information, click Print at the top of the print preview page.

Bulk registering preregistered guests

When you bulk register preregistered guests, you can only configure the expiration time and select the guest manager and guest service for the guests. Bulk registering preregistered guests is more time-efficient than single registration. However, you cannot configure dedicated information for each preregistered guest.

To bulk register multiple preregistered guests:

1. Access the preregistered guest list page.

2. Select the account names you want to register.

3. Click Register.

The Register page opens.

4. Configure the following access information:

¡ Guest Manager—If you are a super guest manager, you can select a guest manager from the list to manage the preregistered guests. If you are a guest manager, this field displays the account name of the current guest manager.

¡ User Group—Click the Select User Group icon . In the Select User Group window, select the user group to which the guest belongs, and then click OK.

¡ Validity Time—Enter the date and time when the guests become valid. Leave this field empty if you want the guests to become valid immediately after being created.

¡ Expiration Time—Enter the date and time when the guests expire and become invalid.

5. Select a guest service for the guests. You can select only one guest service.

The Guest Service List contains the following parameters:

¡ Service Name—Name of the service.

¡ Description—Description of the service for easy maintenance.

¡ Service Suffix—Identifies the name of the domain to be used for guest authentication.

¡ Status—Whether guests can apply for the service. A guest can apply for services in Available state only.

¡ Default Security Policy—Default security policy contained in the service. This parameter is displayed only when the EAD component is deployed.

6. Click OK.

Deleting a single preregistered guest

1. Access the preregistered guest list page.

2. Click the Delete icon for the preregistered guest you want to delete.

A confirmation dialog box opens.

3. Click OK.

Bulk deleting preregistered guests

1. Access the preregistered guest list page.

2. Select one or more account names of the preregistered guests you want to delete.

3. Click Delete.

4. Click OK.

Managing registered guests in the self-service center (by a guest manager)

You can manage registered guests in the self-service center. For more information about the self-service center, see "Using the user self-service."

Accessing the guest list page

To view guests, select Guest Management > All Guests from the navigation tree.

· If you are a super guest manager, the list includes all the guests.

· If you are a guest manager, the list includes only the guests who have selected the guest manager when the guests are registered or added.

Guest list contents

· Account Name—Account name of the guest. The guest uses this account name for authentication.

· Guest Name—Real name of the guest.

· Validity Time—Date and time when the guest becomes valid. Leave this field empty if you want the guest to become valid immediately after being created.

· Expiration Time—Date and time when the guest expires and becomes invalid.

· Guest Group—User group to which the guest belongs.

· Modify Password—Click the Modify Password icon to modify the password of the guest.

· Modify Information—Click the Modify icon to modify the guest information.

· Change Service—Click the Change Service icon to modify the service of the guest.

· Send Password SMS Message Notifications—Click the Send Password SMS Message Notifications icon to send an SMS message to the guest. For information about requirements for sending SMS messages, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide.

· Send Password Email Message Notifications—Click the Send Password Email Message Notifications icon to send an email to the guest. To use this function, configure the email server first and make sure the correct email address is configured in the guest's basic information. For more information about configuring the email server, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide.

Performing a basic query for guests

1. Access the guest list page.

2. Click the Basic Query link on the upper right side of the Query Guests area to use the basic query.

You can perform a basic query if you see Advanced Query on the upper right side of the Query Guests area.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of the guest. For example, if you enter x, all account names that contain x are matched.

¡ Guest Name—Enter a partial or complete real name of the guest. For example, if you enter y, all guest names that contain y are matched.

¡ Guest Service—Select a guest service from the list.

The query ignores empty fields.

4. Click Query. The list shows all guests that match the query criterion.

5. Click Reset to clear the query criteria. The list shows all guests in the self-service center.

Performing an advanced query for guests

1. Access the guest list page.

2. Click the Advanced Query link on the upper right side of the page.

You can perform an advanced query if you see Basic Query on the upper right side of the page.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of the guest. For example, if you enter x, all account names that contain x are matched.

¡ Guest Name—Enter a partial or complete real name of the guest. For example, if you enter y, all guest names that contain y are matched.

¡ Guest Manager—If you are a guest manager, this field cannot be modified. If you are a super guest manager, you can select a guest manager from the list.

¡ Guest Service—Select a guest service from the list.

¡ Visited Department—Enter a partial or complete name of the department that the guest visits. For example, if you enter y, all department names that contain y are matched.

¡ Receptionist—Enter a partial or complete name of the person who the guest visits. For example, if you enter x, all receptionist names that contain x are matched.

¡ Expiration From/To—Click the Calendar icon to select the date and time range when the account becomes invalid, or enter the date and time range in YYYY-MM-DD hh:mm format.

¡ Creation Date From/To—Click the Calendar icon to select the date and time range when the account was created, or enter the date and time range in YYYY-MM-DD hh:mm format.

The query ignores empty fields.

4. Click Query. The list shows all guests that match the query criterion.

5. Click Reset to clear the query criteria. The list shows all guests in the self-service center.

Viewing guest details

1. Access the guest list page.

2. Click the account name of the guest whose detailed information you want to view.

The account details page opens.

Basic Information area

¡ Guest Name—Name of the guest.

¡ Identity Number—Number of the guest's identity certificate, for example, ID card or passport.

¡ Organization—Organization of the guest.

¡ Telephone—Telephone number of the guest.

¡ Email—Email address of the guest.

¡ Guest Group—User group to which the guest belongs.

¡ Manager—Guest manager of the guest. This field is displayed only when the current account is a super guest manager.

User Access Information area

¡ Account Name—Account name that the guest uses to access the network.

¡ Guest Password Expiration Time—Date and time when the guest password expires. An empty field indicates the guest password never expires.

¡ Start Time—Date and time when the guest becomes valid. An empty field indicates that the guest becomes valid immediately after being created.

¡ End Time—Date and time when the guest expires and becomes invalid.

¡ Visited Department—Name of the department that the guest visits.

¡ Receptionist—Name of the person who the guest visits. Generally, the receptionist is the enterprise staff corresponding to the guest manager.

¡ Max. Concurrent Logins—Maximum number of concurrent online users who can use the guest account.

Apply Guest Service area

This area displays the guest service that the guest uses. A guest can apply for only one service.

¡ Service Name—Name of the service.

¡ Description—Description of the service for easy maintenance.

¡ Service Suffix—Identifies the name of the domain to be used for guest authentication.

¡ Default Security Policy—Default security policy contained in the service. This parameter is displayed only when the EAD component is deployed.

Access Device Binding Information area

To pass authentication, the guest must meet all requirements of the access device bindings and terminal bindings. The query ignores empty fields.

¡ Device SN—Requires the guest connect to the access device that has the specified sequence number.

¡ Port—Requires the guest be connected through the specified port of the access device. The value is the last portion of an interface number. For example, if a guest is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

¡ Outer VLAN ID—Requires the guest's packets carry the specified outer VLAN ID.

¡ VLAN ID/Inner VLAN ID—Requires the guest's packets carry any of the specified VLAN IDs or inner VLAN IDs.

¡ User SSID—Requires the guest connect to the network that uses any of the specified SSIDs.

¡ Device IP—Requires the guest connect to the access device that uses any of the specified IPv4 addresses. Each entry on the list represents the IPv4 address of an access device bound to the guest. If a device has multiple IP addresses, use the IPv4 address of the corresponding access device in UAM.

¡ Device IPv6 Address—Requires the guest connect to the access device that uses any of the specified IPv6 addresses. Each entry on the list represents the IPv6 address of an access device bound to the guest. If a device has multiple IPv6 addresses, use the IPv6 address of the corresponding access device in UAM. This field is displayed only when IPv6 is enabled in the UAM system settings.

Terminal Binding Information area

To pass authentication, the guest must meet all requirements of the access device bindings and terminal bindings. The query ignores empty fields.

¡ Computer Name—Requires the guest connect from the specified computer.

¡ IMSI—Requires the guest endpoint to use the specified IMSI.

¡ Windows Domain—Requires the guest endpoint to join or log in to specified domain.

¡ Terminal IP Address—Requires the guest endpoint to use any of the specified IPv4 addresses or an IP address in the specified IPv4 address ranges. IP address ranges are specified in the format X.X.X.X-X.X.X.X.

¡ Terminal MAC Address—Requires the guest endpoint to use any of the specified MAC addresses.

¡ Terminal IPv6 Address—Requires the guest endpoint to use any of the specified IPv6 addresses. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ IMEI—Requires the guest endpoint to use the specified IMEI.

Print link

Click Print at the upper right corner to display the print preview window. The window supports custom settings, such as the page size, title, and fields. For more information, see "Customizing and printing guest information."

To print guest information, click Print at the top of the print preview page.

3. Click Back to return to the guest list page.

Adding a guest

A guest manager can add guests in the self-service center. A guest added in this way can perform authentication directly and can access the network without being registered.

To add a guest:

1. Access the guest list page.

2. Click Add.

3. Configure the following basic information:

¡ Guest Name—Enter the name of the guest.

¡ Identity Number—Enter the number of the guest's identity certificate, for example, ID card or passport.

¡ Organization—Enter the organization of the guest.

¡ Telephone—Enter the telephone number of the guest.

¡ Email—Enter the email address of the guest.

¡ User Group—Click the Select User Group icon . In the Select User Group window, select the user group to which the guest belongs, and then click OK.

¡ Guest Manager—If you are a super guest manager, you can select a guest manager to manage the preregistered guest from the list. If you are a guest manager, this field does not appear.

4. Configure the user access information:

¡ Account Name—Enter the unique account name that the guest uses to access the network.

¡ Auto Generate Password—Select this option to enable UAM to automatically generate and send a password to the guest by email. When this option is selected, the Password and Confirm Password fields are hidden.

¡ Start Time—Enter the date and time when the guest becomes valid. Leave this field empty if you want the guest to become valid immediately after being created.

¡ End Time—Enter the date and time when the guest expires and becomes invalid.

¡ Password/Confirm Password—Set the password that the guest uses to access the network.

¡ Visited Department—Enter the name of the department that the guest visits.

¡ Receptionist—Enter the name of the person who the guest visits. Generally, the receptionist is the enterprise staff corresponding to the guest manager.

¡ Max. Concurrent Logins—Enter the maximum number of concurrent online users who can use the guest account.

5. Apply for a service for the guest. A guest can apply for only one service.

The Guest Service List contains the following parameters:

¡ Service Name—Name of the service.

¡ Description—Description of the service for easy maintenance.

¡ Service Suffix—Identifies the name of the domain to be used for guest authentication.

¡ Status—Whether guests can apply for the service. A guest can apply for services in Available state only.

¡ Default Security Policy—Default security policy contained in the service. This parameter is displayed only when the EAD component is deployed.

6. Configure the access device binding information.

If a binding parameter is selected for a service but the binding parameter is not configured, the self-service center automatically acquires the binding parameter information from the first successful authentication of the guest.

To pass authentication, the guest must meet all requirements of the access device bindings and terminal bindings.

¡ Device SN—Enter the sequence number of the access device to which the guest is connected.

¡ Outer VLAN ID—Enter the outer VLAN ID that is contained in the guest's packets.

¡ VLAN ID/Inner VLAN ID—Enter a list of VLAN IDs or inner VLAN IDs that can be contained in the guest's packets.

¡ User SSID—Enter a list of SSIDs to which the guest can be connected.

7. Configure terminal binding information.

If a binding parameter is selected for a service but the binding parameter is not configured, the self-service center automatically acquires the binding parameter information from the first successful authentication of the user.

To pass authentication, the guest must meet all requirements of the access device bindings and terminal bindings.

¡ Computer Name—Enter the name of the computer to which the guest is bound.

¡ IMSI—Enter the IMSI of the endpoint to be bound to the guest.

¡ Windows Domain—Enter the name of the domain that the guest endpoint must join or log in.

¡ Terminal MAC Address—Enter a list of MAC addresses for the endpoints from which the guest can access the network.

¡ Terminal IPv6 Address—Enter a list of IPv6 addresses for the endpoints from which the guest can access the network. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ IMEI—Enter the IMEI of the endpoint to be bound to the guest.

8. Click OK or OK & Print.

¡ If you click OK, UAM adds the guest.

¡ If you click OK & Print, UAM adds the guest and displays the guest details page.

¡ On the guest details page, click Print at the upper right corner to display the print preview window. The window supports custom settings, such as the page size, title, and fields. For more information, see "Customizing and printing guest information." To print guest information, click Print at the top of the print preview page.

Batch generating guests

A guest manager can generate guests in batches in the Self-Service Center. The generated guests can directly trigger authentication for network access without experiencing a separate registration process. To inform guests of the accounts and passwords, configure a phone number or email address for each guest, or print guest information for distribution.

To generate guests in batches:

1. Access the guest list page.

2. Click Batch Generate.

3. Configure the user access information:

¡ Guest Number—Enter the number of guests to be generated.

¡ Account Name Prefix—Enter a string of 4 to 8 characters as the account name prefix. The prefix cannot include Tab or any of the following characters:

# + / ? % & = * @ \ " [ ] ( ) < > '

¡ User Group—Click the Select User Group icon , select a group, and click OK.

¡ Max. Concurrent Logins—Enter the maximum number of online users who can use the guest account at the same time.

¡ Validity Time—Enter the date and time when the guests become valid. Leave this field empty if you want the guests to become valid immediately after being created.

¡ Expiration Time—Enter the date and time when the guests expire and become invalid.

¡ Visited Department—Enter the name of the department that the guests visit.

¡ Receptionist—Enter the name of the receptionist for the guests. Typically, the receptionist is the guest manager of the guests.

¡ Comments—Enter comments for the guests to be generated in batches for easy maintenance.

4. Apply for a service for the guests. A guest can apply for only one service.

The Guest Service List contains the following parameters:

¡ Service Name—Name of the service.

¡ Description—Description of the service for easy maintenance.

¡ Service Suffix—Identifies the name of the domain to be used for identity authentication of guests.

¡ Status—Whether guests can apply for the service. A guest can apply for services in Available state only.

¡ Default Security Policy—Default security policy contained in the service. This parameter is displayed only when the EAD component is deployed.

5. Click OK.

UAM starts to generate the guest accounts. Each guest account contains the specified prefix and an 8-character suffix that is randomly generated by UAM.

The operation result page displays the number of successfully generated guests and the number of failures. If failures occur, click Download to check the failure reason.

Importing guests in batches

You can manage registered guests in the self-service center. For more information about the self-service center, see "Using the user self-service."

In http://ip:port/selfservice, ip is the IP address of the server with the self-service component installed and port is the HTTP or HTTPS service port number provided by the self-service component.

To import accounts in batches:

1. From the navigation tree, select Guest Management > All Guests.

2. Click Batch Import.

3. For the Import File box, click Browse to select the text file that saves the account information.

UAM supports importing only text files in ANSI format.

4. Select the column separator from the list. Options are Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($).

5. Select whether to send an SMS message to guests.

If Send Password by SMS is selected, UAM sends an SMS message to notify imported guests of the account name and password. To use the SMS function, enable IMC to send SMS messages and make sure the import file contains a telephone number or account name for each guest in the required format. For information about configuring SMS system parameters, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. For information about configuring the SMS message content, see "Delivering messages."

6. Select whether to send an email to guests.

If Send Password by Email is selected, UAM sends an email to notify imported users of the account name and password. To use the email function, first configure the mail server settings. For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. Make sure the email address configured for each guest is valid.

7. Click Next to display the batch import page.

UAM automatically analyzes the number of columns available in the text file, and display the result in the list of each parameter.

Make sure the parameters in the text file comply with the specified format and value range. For example, an account name can contain only spaces, case-sensitive letters, numbers, hyphens (-), underscores (_), and dots (.). Any account name that contains other characters results in an import failure.

Basic Information

¡ Guest Name—Name of the guests. This parameter must be read from the imported file. Select the specified column number in the file as the guest name.

¡ Identity Number—Identity number of the guests. This parameter must be read from the imported file. Select the specified column number in the file as the identity number.

¡ Contact Address—Contact address of the guests. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the contact address, or select Not Imported and enter a contact address. The contact address you entered applies to all imported guests.

¡ Telephone—Telephone number of the guests. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the telephone number, or select Not Imported and enter a telephone number. The telephone number you entered applies to all imported guests.

¡ Email—Email address of the guests. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the email address, or select Not Imported and enter an email address. The email address you entered applies to all imported guests.

¡ User Group—User group to which the guests belong. This parameter must be manually configured. Click the Select User Group icon . In the Select User Group window, select the user group for the guests, and then click OK.

User Access Information

¡ Account Name—Account name of the guests. This parameter must be read from the imported file. Select the specified column number in the file as the account name.

¡ Validity Time—Date and time when the guests become valid. This parameter can be either imported from the file or manually specified. To import the time, select a column number in the file. To manually specify the time, select Not Imported, and then enter a time string in YYYY-MM-DD hh:mm format or click the Calendar icon to set the time. Manually specified time applies to all imported guests. If this field is empty, guests become valid immediately after being imported.

¡ Expiration Time—Date and time when the guests expire and become invalid. This parameter can be either imported from the file or manually specified. To import the time, select a column number in the file. To manually specify the time, select Not Imported, and then enter a time string in YYYY-MM-DD hh:mm format or click the Calendar icon to set the time. Manually specified time applies to all imported guests. If this field is empty, imported guests never expire.

¡ Password—Password of the guests. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the password, or select Not Imported and enter a password. The password you enter applies to all imported guests.

¡ Receptionist—Name of the person who the guest visits. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the receptionist, or select Not Imported and enter a receptionist. The password you enter applies to all receptionists.

¡ Visited Department—Name of the department that the guest visits. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the visited department, or select Not Imported and enter a visited department. The password you enter applies to all visited departments.

¡ Max. Concurrent Logins—Maximum number of concurrent online users who can use the same guest account. You can select a column number, or select Not Imported and enter a value. The value you enter applies to all imported guests.

Guest Access Service

Access services can only be selected from the access service list. You can select multiple services with different suffixes. The access services you specify apply to all imported access guests.

¡ Service Name—Name of the service.

¡ Description—Description of the service for easy maintenance.

¡ Service Suffix—Identifies the name of the domain to be used for guest authentication.

¡ Status—Whether guests can apply for the service. A guest can apply for services in Available state only.

Access Device Binding Information

To pass authentication, the guests must meet all requirements of the access device bindings and terminal bindings.

¡ Device IP—IP address of the access device bound to the guests. To pass authentication, a guest must connect to the access device that uses this IP address. If an access device has multiple IP addresses, the one that the access device used when it was added to UAM is adopted as the device IP. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the device IP, or select Not Imported and enter a device IP. The device IP you enter applies to all imported guests. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ Device IPv6 Address—IPv6 address of the access device bound to the guests. To pass authentication, a guest must connect to the access device that uses this IPv6 address. If an access device has multiple IPv6 addresses, the one that the access device used when it was added to UAM is adopted as the device IPv6 address. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the device IPv6 address, or select Not Imported and enter a device IPv6 address. The device IPv6 address you enter applies to all imported guests. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ Port—Port to which the guests are bound. To pass authentication, a guest must connect to the specified port on a device. In UAM, each guest is bound to only the last portion of an interface number. For example, if a guest is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the port number, or select Not Imported and enter a port number. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted. The port number you enter applies to all imported guests.

¡ Device SN—Sequence number of the access device bound to each guest. Select the column that contains the device sequence number in the file, or select Not Import from File and then manually set the same sequence number for all guests to be imported or keep the field empty. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ VLAN ID/Inner VLAN ID—VLAN ID or inner VLAN ID bound to the guests. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the VLAN ID/inner VLAN ID, or select Not Imported and enter a VLAN ID/inner VLAN ID. The VLAN ID/inner VLAN ID you enter applies to all imported guests. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ Outer VLAN ID—Outer VLAN ID bound to the guests. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the outer VLAN ID, or select Not Imported and enter an outer VLAN ID. The outer VLAN ID you enter applies to all imported guests. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ User SSID—SSID used by the guests for wireless access. To pass authentication, a guest must use the specified SSID. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the SSID, or select Not Imported and enter an SSID. The SSID you enter applies to all imported guests. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

Terminal Binding Information

To pass authentication, the guests must meet all requirements of the access device bindings and terminal bindings.

¡ Computer Name—Computer name bound to guests. To pass authentication, a guest must access from the specified computer. This parameter must be read from the imported file, because guests are not bound to the same computer name. Select the specified column number in the file as the computer name. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ Bound Domain—Domain name bound to the guests. To pass authentication, a guest must join or log in to the specified domain. This parameter does not require the computer to log on to the domain. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the domain name, or select Not Imported and enter a domain name. The domain name you enter applies to all imported guests. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ Terminal IP Address—List of IPv4 addresses or IPv4 address ranges bound to the guests. To pass authentication, a guest must access from the computer that uses a bound IPv4 address or an IPv4 address in the bound IPv4 address ranges. This parameter must be read from the imported file, because guests are not bound to the same IPv4 address. Select the specified column number in the file as the bound IPv4 addresses or IPv4 address ranges. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ Terminal IPv6 Address—List of IPv6 addresses bound to the guests. To pass authentication, a guest must access from the computer that uses an IPv6 address on the list. This parameter must be read from the imported file, because guests are not bound to the same IPv6 address. Select the specified column number in the file as the bound IPv6 addresses. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ Terminal MAC Address—List of MAC addresses bound to the guests. To pass authentication, a guest must access from the computer that uses a MAC address on the list. This parameter must be read from the imported file, because guests are not bound to the same MAC address. Select the specified column number in the file as the bound MAC addresses. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ IMSI—IMSI bound to the guests. To pass authentication, a guest endpoint must use the specified IMSI. This parameter must be read from the imported file, because guests are not bound to the same IMSI. Select the specified column number in the file as the IMSI. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

¡ IMEI—IMEI bound to the guests. To pass authentication, a guest endpoint must use the specified IMEI. This parameter must be read from the imported file because guests are not bound to the same IMEI. Select the specified column number in the file as the IMEI. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

8. Click Preview to launch the Preview Import Result window, showing the first ten imported entries. Check whether the import result is as expected.

9. Click Cancel to return to the import page.

10. Click OK to start importing the accounts in batches.

After the import is completed, the operation result page opens, showing the number of import successes and failures. If import failures occur, click Download to check the failure reason.

The Operation Failure Logs list provides the last 20 import logs.

11. Click the link in the Operation Result column to view the operation result.

Modifying the password of a single guest

1. Access the guest list page.

2. Click Modify Password for the guest for which you want to modify the password.

The Modify Password page opens.

3. Enter the password in the Password and Confirm Password fields.

4. Click OK.

Modifying detailed information about a single guest

1. Access the guest list page.

2. Click the Modify icon for the guest for which you want to modify the detailed information.

3. Modify parameters for the guest. The guest name, identity number, guest group, and account name cannot be modified. For more information, see "Adding a guest."

4. Click OK.

Changing the service for a guest

1. Access the guest list page.

2. Click the Change Service icon for the guest for which you want to change the service.

3. Change the service for the guest.

A guest can apply for only one service. The Guest Service List contains the following parameters:

¡ Service Name—Name of the service.

¡ Description—Description of the service for easy maintenance.

¡ Service Suffix —Identifies the name of the domain to be used for guest authentication.

¡ Status—Whether guests can apply for the service. A guest can apply for services in Available state only.

¡ Default Security Policy—Default security policy contained in the service. This parameter is displayed only when the EAD component is deployed.

4. Click OK.

Sending SMS messages to a single guest

1. Access the guest list page.

2. Click Send SMS for the guest to which you want to send an SMS message.

3. In the window that opens, enter a message and click OK.

For information about configuring SMS system parameters, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. For information about configuring the SMS message content, see "Delivering messages."

Scheduling SMS messages for guests

1. Access the guest list page.

2. Select one or more guest names.

3. Click Set Message Time.

4. Select Schedule Send.

5. Click the Calendar icon next to Message Sending Time to select the date and time, or enter the date and time in YYYY-MM-DD hh:00 format.

6. Click OK.

Bulk modifying the expiration time for guests

This task is available only when the guest manager is not configured with the parameter Guest Maximum Validity Time. If the parameter is configured, the Set Expiration button does not appear on the guest list page in the self-service center.

To bulk modify the expiration time for guests:

1. Access the guest list page.

2. Select one or more guests for which you want to modify the expiration time.

3. Click Set Expiration.

The Set Expiration page opens.

4. Click the Calendar icon to select the expiration time, or enter the expiration time in YYYY-MM-DD hh:mm format.

The expiration time must be later than the current time.

5. Click OK.

Bulk changing the guest manager for guests

Only a super guest manager can change the guest manager for guests. If you are a guest manager, the Set Manager button does not appear.

To bulk change the guest manager for guests:

1. Access the guest list page.

2. Select one or more guests for which you want to modify the guest manager.

3. Click Set Manager.

The Set Manager page opens.

4. Select a guest manager from the list.

5. Click OK.

Bulk resetting the passwords for guests

1. Access the guest list page.

2. Select one or more guests for which you want to change the passwords.

3. Click Reset Password.

UAM automatically sends the new passwords to the email of the selected guests.

Printing single guest information

Click Print or OK & Print on the page when you view, add, or register a guest. For more information, see "Viewing guest details," "Adding a guest," and "Registering a single preregistered guest."

Bulk printing guest information

You can bulk print information for up to 50 guests at a time.

To bulk print guest information:

1. Access the guest list page.

2. Select one or more guests for which you want to print information.

3. Click Print.

A print preview window opens.

4. Click Print.

The print preview window supports custom settings, such as the page size, title, and fields. For more information, see "Customizing and printing guest information."

Deleting guests

1. Access the guest list page.

2. Select one or more guests you want to delete.

3. Click Delete.

4. Click OK.

Preregistering a guest on the Guest Center login page

The Guest Center login page provides a link for account preregistration.

To enable guest preregistration, complete the following tasks:

· Specify at least one access user as a guest manager in guest management. For more information, see "Adding a guest manager."

· Specify at least one service as a guest service in guest management. For more information, see "Adding guest services."

· Custom a self-service login page that includes the Guest Preregister link. For more information, see "Customizing and applying self-service pages."

To preregister a guest:

1. In the Web browser, enter http://ip:port/guest in the address bar to open the Guest Center login page.

In http://ip:port/guest, ip is the IP address of the server with the User Selfservice Management component installed and port is the HTTP service port number provided by the User Selfservice Management component.

2. Click the Preregister Guest link.

3. Configure the following basic information:

¡ Guest Name—Real name of the guest.

¡ Identity Number—Number of the guest's identity certificate, for example, ID card or passport.

¡ Organization—Organization of the guest.

¡ Telephone—Telephone number of the guest.

¡ Email—Email address of the guest.

4. Configure the user access information:

¡ Account Name—Account name that the guest uses to access the network. The account name must be unique in UAM.

¡ Guest Manager—Guest manager who is responsible for managing the guest's account. Select a guest manager from the list.

¡ Password/Confirm Password—Password of the guest for network access.

¡ Visited Department—Department that the guest visits.

¡ Receptionist—Name of the receptionist for the guest. Typically, the receptionist is the guest manager.

¡ Max. Concurrent Logins—Maximum number of online users who can use the guest account at the same time.

¡ Verification Code—Letters and numbers that appear in the image next to the field.

5. Click OK.

6. Click Reset to restore all information to the default.

The approval process for a preregistered guest varies depending on whether or not guest auto-registration is enabled.

· When guest auto-registration is disabled, UAM displays the registration results page after a guest account is preregistered. The guest manager uses either of the following methods to approve the guest registration:

¡ Scans the QR code on the registration results page to access the page for approving the registration of the guest.

¡ Logs in to the self-service center to approve the guest registration.

For more information about configuring guest auto-registration, see "Managing guest policies."

To use the email function, configure the mail server settings and make sure the email address configured for the guest is valid. For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide.

Managing preregistered guests in the Guest Center

Guest managers can manage preregistered guests in the Guest Center.

In the Web browser, enter http://ip:port/guest in the address bar to open the self-service center login page. Then, enter the account name, password, and verification code, and click Login to log in to the Guest Center.

In http://ip:port/guest, ip is the IP address of the server with the self-service component installed and port is the HTTP service port number provided by the self-service component.

After logging in to the Guest Center, a guest manager can view information about preregistered guests, or query, register, and delete preregistered guests. Preregistered guest management in the Guest Center is similar to that in the Self-Service Center. For more information, see "Managing preregistered guests in the self-service center (by a guest manager)."

Managing registered guests in the Guest Center

In the Guest Center, a guest manager can perform the following tasks to manage the registered guests:

· View the registered guest list and key information about registered guests.

· Perform a basic or an advanced query of registered guests.

· View the registered guest details.

· Add guests, who can directly trigger authentication for network access without experiencing a separate registration process.

· Import guests in batches. The imported guests can directly trigger authentication for network access without experiencing a separate registration process.

· Modify the password for a guest.

· Modify detailed information about a guest.

· Change the service used by a guest.

· Send SMS messages to a guest.

· Schedule delivery of SMS messages to guests.

· Bulk modify the expiration time for guests.

· Bulk change the guest manager for guests.

· Bulk reset the passwords for guests.

· Print guest information.

· Delete guests.

Registered guest management in the Guest Center is similar to that in the Self-Service Center. For more information, see "Managing registered guests in the self-service center (by a guest manager)."

IMC administrator managing guests in UAM

The IMC administrator can manage the guests in UAM. UAM displays all guests who have been registered from preregistered guests by the guest managers and the guests who are added by guest managers.

Accessing the guest list page

1. Click the User tab.

2. From the navigation tree, select Guest > All Guests.

The list includes all guests.

Guest list contents

¡ Account Name—Account name of the guest. The guest uses this account name for authentication.

¡ Guest Name—Real name of the guest.

¡ Organization—Organization to which the guest belongs.

¡ Expiration Time—Date and time when the guest expires and becomes invalid.

¡ Guest Group—User group to which the guest belongs.

¡ Manager—Guest manager of the guest. Click the name to view the access user information for the guest manager. This field does not display super guest managers.

¡ Guest Manager Group—User group to which the guest manager belongs.

¡ Creation Date—Date when the guest was registered.

Performing a basic query for guests

1. Access the guest list page.

2. Click the Basic Query link on the upper right side of the Query Guests area to use the basic query.

You can perform a basic query if you see Advanced Query on the upper right side of the Query Guests area.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of a guest. For example, if you enter x, all account names that contain x are matched.

¡ Guest Name—Enter a partial or complete real name of a guest. For example, if you enter y, all guest names that contain y are matched.

¡ Guest Group—Click the Select User Group icon to select a group in the Select User Group window.

¡ Guest Service—Select a guest service from the list.

The query ignores empty fields.

4. Click Query. The list includes all guests that match the query criteria.

5. Click Reset to clear the query criteria. The list includes all guests in UAM.

Performing an advanced query for guests

1. Access the guest list page.

2. Click the Advanced Query link on the upper right side of the page.

You can perform an advanced query if you see Basic Query on the upper right side of the page.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of a guest. For example, if you enter x, all account names that contain x are matched.

¡ Guest Name—Enter a partial or complete real name of a guest. For example, if you enter y, all guest names that contain y are matched.

¡ Guest Group—Click the Select User Group icon to select a group in the Select User Group window.

¡ Guest Service—Select a guest service from the list.

¡ Status—Select an account state from the list. Options include Normal and Cancelled. The normal state indicates that the guest can be normally used. The cancelled state indicates that the guest has been cancelled.

¡ Manager—Enter a partial or complete manager of a guest. For example, if you enter x, all manager names that contain x are matched.

¡ Receptionist—Enter a partial or complete name of the person who a guest visits. For example, if you enter x, all receptionist names that contain x are matched.

¡ Visited Department—Enter a partial or complete name of the department that a guest visits. For example, if you enter y, all department names that contain y are matched.

¡ Organization—Enter a partial or complete organization of a guest. For example, if you enter x, all organization names that contain x are matched.

¡ Identity Number—Enter a partial or complete number of a guest's identity certificate, for example, ID card or passport. For example, if you enter y, all identity numbers that contain y are matched.

¡ Expiration From/To—Click the Calendar icon to select the time range when the account was created, or enter the time range in YYYY-MM-DD HH:MM format.

¡ Creation Date From/To—Click the Calendar icon to select the time range when the account was created, or enter the time range in YYYY-MM-DD format.

¡ E-mail—Enter a partial or complete email address of a guest. For example, if you enter z, all email addresses that contain z are matched.

¡ Authentication Activity—Select Normal to match guests that have come online since the account creation, or select None to match guests that have never come online since the account creation.

The query ignores empty fields.

4. Click Query. The list includes all guests that match the query criteria.

5. Click Reset to clear the query criteria. The list includes all guests in UAM.

View guest details

1. Access the guest list page.

2. Click the account name of the guest whose detailed information you want to view.

The Guest Details page opens.

Basic Information area

¡ Guest Name—Name of the guest.

¡ Identity Number—Number of the guest's identity certificate, for example, ID card or passport.

¡ Organization—Organization of the guest.

¡ Telephone—Telephone number of the guest.

¡ E-mail—Email address of the guest.

¡ User Group—User group to which the guest belongs.

User Access Information area

¡ Account Name—Account name that the guest uses to access the network.

¡ Guest Password Expiration Time—Time when the guest password expires.

¡ Visited Department—Name of the department that the guest visits.

¡ Start Time—Date and time when the guest becomes valid.

¡ End Time—Date and time when the guest expires and becomes invalid.

¡ Receptionist—Name of the person who the guest visits. Generally, the receptionist is the enterprise staff corresponding to the guest manager.

¡ Max. Concurrent Logins—Maximum number of concurrent online users who can use the guest account.

Guest Service area

This area displays the guest service that the guest uses. A guest can apply for only one service.

¡ Service Name—Name of the service.

¡ Service Suffix—Identifies the name of the domain to be used for guest authentication.

Transparent Authentication MAC Address Binding area

The Transparent Authentication MAC Address Binding area displays all endpoint MAC addresses that are bound to the guest account for transparent authentication.

¡ Service Name—Service name bound to the account for transparent portal authentication.

¡ MAC Address—MAC address of the bound endpoint.

¡ Transparent Authentication—Whether the MAC address is allowed to use the guest account and service for transparent portal authentication. The value can be Enabled or Disabled.

¡ Enabled/Disabled Time—Last time when one of the following events occurred:

- The endpoint is successfully correlated with an access user.

- Transparent authentication is enabled for the endpoint.

- Transparent authentication is disabled for the endpoint.

Access Device Binding Information area

To pass authentication, the guest must meet all requirements of the access device bindings and terminal bindings. The query ignores empty fields.

¡ Device SN—Requires the guest to connect to the access device that has the specified sequence number.

¡ Port—Requires the guest to be connected through the specified port of the access device. The value is the last portion of an interface number. For example, if a guest is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

¡ Outer VLAN ID—Requires the guest's packets to carry the specified outer VLAN ID.

¡ VLAN ID/Inner VLAN ID—Requires the guest's packets to carry any of the specified VLAN IDs or inner VLAN IDs.

¡ User SSID—Requires the guest to connect to the network that uses any of the specified SSIDs.

¡ Device IP—Requires the guest to connect to the access device that uses any of the specified IPv4 addresses. Each entry on the list represents the IPv4 address of an access device bound to the guest. If a device has multiple IP addresses, use the IPv4 address of the corresponding access device in UAM.

¡ Device IPv6 Address—Requires the guest to connect to the access device that uses any of the specified IPv6 addresses. Each entry on the list represents the IPv6 address of an access device bound to the guest. If a device has multiple IPv6 addresses, use the IPv6 address of the corresponding access device in UAM. This field is displayed only when IPv6 is enabled in the UAM system settings.

Terminal Binding Information area

To pass authentication, the guest must meet all requirements of the access device bindings and terminal bindings. The query ignores empty fields.

¡ Computer Name—Requires the guest connect from the specified computer.

¡ IMSI—Requires the guest endpoint to use the specified IMSI.

¡ Windows Domain—Requires the guest endpoint to join or log in to the specified domain.

¡ Terminal IP Address—Requires the guest endpoint to use any of the specified IPv4 addresses or an IPv4 address in the specified IPv4 address ranges.

¡ Terminal MAC Address—Requires the guest endpoint to use any of the specified MAC addresses.

¡ Terminal IPv6 Address—Requires the guest endpoint to use any of the specified IPv6 addresses. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ IMEI—Requires the guest endpoint to use the specified IMEI.

Action menu

The Action menu is located to the right of the Access Account Info pane, and offers the following actions:

¡ Refresh—Click the link to refresh the Guest Details page.

¡ Delete—Click Delete. A confirmation dialog box opens. Click OK to delete the guest.

¡ Send Password via SMS—Click the link to send an SMS message that contains the password of the guest account, so the guest can retrieve the password. To use this function, first configure the SMS settings in the IMC platform. For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. For information about configuring the SMS message content, see "Delivering messages."

¡ Add to Blacklist—This link is displayed only when the guest is not blacklisted. Click the Add to Blacklist link. A confirmation dialog box opens. Click OK to add the guest to the blacklist.

¡ Release from Blacklist—This field is displayed only when the guest is blacklisted. Click the Release from Blacklist link. A confirmation dialog box opens. Click OK to release the guest from the blacklist.

¡ Authentication Failure Log—Click the link to view the list of authentication failure logs for the guest. For more information about the authentication failure logs, see "Managing authentication failure logs."

¡ Access Details—Click the link to view the list of access details for the guest. For more information, see "Managing access detail records."

¡ Basic User Info—Click the link to view detailed information about the guest.

3. Click Back to return to the guest list page.

Deleting guests

1. Access the guest list page.

2. Select one or more guests you want to delete.

3. Click Delete.

A confirmation dialog box opens.

4. Click OK.

Regrouping guests

1. Access the guest list page.

2. Select one or more guests you want to regroup.

3. Click Regroup.

4. Select the user group to which you want to assign the selected guests.

5. Click OK.

When you release a guest from the blacklist, the guest can pass authentication for network access. For more information about the blacklist, see "Managing blacklisted users."

To release guests from the blacklist on the blacklisted user list page:

1. Click the User tab.

2. From the navigation tree, select Access User > Blacklisted User.

The list includes all blacklisted users.

3. Select one or more guests you want to release from the blacklist.

4. Click Unblacklist.

The list includes all blacklisted users matching the query criteria.

5. Click OK.

Managing blacklisted users

You can add users to the blacklist to prohibit them from accessing the network.

UAM supports the following types of blacklisting:

· Malicious Login Attempt—When an access user enters more than the maximum incorrect passwords, UAM considers it a malicious login attempt, and automatically adds the user to the blacklist. The maximum is set with the Max. Authentication Attempts in the UAM system parameters. For more information about the system parameters, see "Configuring global system settings."

When automatically blacklisted by UAM, the user:

¡ Is only blocked from the computer where the login attempts are performed.

¡ Can access the network from other computers.

¡ Is automatically released from the blacklist after a specified time period or at 03:30 the next day.

· Locked by Operator—Administrators can manually add users to the blacklist.

When manually blacklisted by an administrator, the user:

¡ Cannot access the network, regardless of the computers they use.

¡ Is not automatically released from the blacklist.

¡ Must be manually released by an administrator.

· Invalid Client—UAM automatically adds users to the blacklist if they use invalid clients. A client is considered invalid if it does not meet the lowest version required by UAM, or if its version is not uploaded to UAM. To enable UAM to add users that use invalid clients to the blacklist, you must enable Add Invalid Client to Blacklist in UAM system parameter configuration. These users can be manually released from the blacklist by an administrator or automatically released by UAM.

· Security Check Failure—UAM adds an access user to the blacklist if the user fails the security check and the Blacklist and Kick Out action is configured for the security check failures.

This function requires deployment of EAD Security Policy.

Accessing the blacklisted user list page

1. Click the User tab.

2. From the navigation tree, select Access User > Blacklisted User.

The list includes all blacklisted users.

Blacklisted user list contents

¡ Account Name—Name of the blacklisted user. Click the name of a blacklisted user to view its details. For more information about the user details, see "Viewing ordinary access user details."

¡ Blacklisted Cause—Reason why the user is blacklisted, including Locked by Operator, Malicious Login Attempt, Invalid Client, and Security Check Failure. The security check requires deployment of EAD Security Policy.

¡ Blacklisted at—Time when the user was added to the blacklist.

¡ User IP Address—IP address of the user performing malicious login attempts.

¡ User MAC Address—MAC address of the user performing malicious access attempts.

¡ Details—Click the Details icon to view the blacklist information about the user.

Querying blacklisted users

UAM provides basic query and advanced query.

· Basic query criteria include several key parameters for quick search.

· Advanced query offers various query criteria for precise match.

Basic query

1. Access the blacklisted user list page.

2. Click the Basic Query link on the upper right side of the query area.

You can perform a basic query if you see Advanced Query on the upper right side of the query area.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of a blacklisted user. For example, if you enter x, all blacklisted user names that contain x are matched.

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window.

¡ Blacklisted Cause—Select from the list the reason why the user is blacklisted. Valid options include Locked by Operator, Malicious Login Attempt, Invalid Client, and Security Check Failure. The Security Check Failure option is displayed only when EAD Security Policy is deployed.

The query ignores empty fields.

4. Click Query.

The list includes all blacklisted users matching the query criteria.

5. To clear the query criteria, click Reset.

The list includes all blacklisted users in UAM.

Advanced query

1. Access the blacklisted user list page.

2. Click the Advanced Query link on the upper right side of the query area.

You can perform an advanced query if you see Basic Query on the upper right side of the query area.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of a blacklisted user. For example, if you enter x, all blacklisted user names that contain x are matched.

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window.

¡ Add Time From/To—Click the Calendar icon to select the time range when the user was blacklisted, or enter the time range in YYYY-MM-DD format.

¡ User IP Address Range From/To—Enter the range of the IP addresses used by the blacklisted users. You must enter complete IPv4 addresses.

¡ User MAC Address —Enter the MAC address of a blacklisted user. You can enter a complete MAC address in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX, or enter a partial MAC address in the format of XXXX-XXXX, XX-XX, or XX:XX.

The query ignores empty fields.

4. Click Query.

5. To clear the query criteria, click Reset.

The list includes all blacklisted users in UAM.

Viewing blacklist information

1. Access the blacklisted user list page.

2. Click the Details icon for the user whose blacklist information you want to view.

The Blacklist Details page opens.

Releasing an ordinary access, mute terminal, or LDAP user from the blacklist on the access user details page

1. Click the User tab.

2. From the navigation tree, select Access User > All Access Users.

The list includes all access users.

3. Click the account name of the target user.

4. Click Release from Blacklist in the Action menu on the right.

A confirmation dialog box opens.

5. Click OK.

Releasing a guest from the blacklist on the guest details page

1. Click the User tab.

2. From the navigation tree, select Guest > All Guests.

The list includes all guests.

3. Click the account name of the target guest.

4. Click Release from Blacklist in the Action menu on the right.

A confirmation dialog box opens.

5. Click OK.

Releasing ordinary access, mute terminal, LDAP users, or guests from the blacklist on the blacklisted user list page

1. Click the User tab.

2. From the navigation tree, select Access User > Blacklisted User.

The list includes all blacklisted users.

3. Select one or more account names.

4. Click Unblacklist.

13. Click OK to start importing the accounts in batches.

5. Click OK.

Automatically releasing users from the blacklist

UAM releases users from the blacklist after a time period specified by the Blacklist Period option, except manually added blacklisted users and users with an overdue payment.

To configure UAM to automatically release blacklisted users:

· Enable the Blacklist Period option in system parameter configuration and specify the time period. For more information, see "Configuring system parameters."

· If the Blacklist Period option is not enabled, users in the blacklist will be automatically released at 03:30 the next day.

Batch operations

UAM batch operations apply only to ordinary access users, mute terminal users, and LDAP users.

To facilitate maintenance of access users and relevant data, UAM provides the following batch operations:

· Import Accounts in Batches—Lets you import access users saved in a text file to UAM.

· Maintain Accounts in a File—Lets you perform the following actions to access users based on the information saved in a text file: modifying/canceling accounts, applying for services, and canceling a service.

· Query and Maintain Accounts in Batches—Lets you perform the following actions on access users saved in UAM: modifying/canceling account, applying for/canceling service, and adding accounts to the blacklist.

· Export Accounts in Batches—Lets you export the access users in UAM in a .txt or .csv file.

· Export Access Details in Batches—Lets you export the detailed online access user information saved in UAM in a .txt or .csv file.

· Batch Cancel Unbound Platform Users—Lets you cancel platform users that are not bound with access users.

Importing accounts in batches

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

All supported batch operations are displayed.

3. Select Import Accounts in Batches, and then click Next.

4. For the Import File box, click Browse to select a .txt or .csv file that saves the account information.

UAM supports importing only a .txt or .csv file.

5. Select the column separator from the list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). A .csv file must use the comma (,) as the column separator.

6. Select a state for the imported user accounts. Options include Normal and Trial.

To facilitate user management, operators can bulk import trial accounts in advance, and then approve or delete the trial accounts according to the actual user requirements. Trial account users cannot pass authentication.

7. Select Import Platform Users as needed.

¡ If you select the Import Platform Users box, the platform users and accounts are imported. Before you perform the operation, determine if the platform users corresponding to the accounts exist. If platform users exist, the operation imports only the accounts and associates the accounts with the platform users. If platform users do not exist, both the platform users and accounts are imported.

¡ If you do not select the Import Platform Users box, only the accounts are imported. Before you perform the operation, check if the platform users corresponding to the accounts exist: If yes, the accounts are imported; if not, the accounts are not imported.

8. Select Header Line Filtering as needed. If you select Header Line Filtering, the first line in the file will not be imported. Select this option if the file to be imported contains headers in the first line.

9. Select SMS Message, Send Password Email Notifications, or both as needed. With SMS Message selected, UAM sends an SMS message to notify imported users of the user name and password. With Send Password Email Notifications selected, UAM sends an email to notify imported users of the user name and password.

10. Click Next to display the batch import page.

UAM automatically analyzes the number of columns available in the text file, and display the result in the list of each parameter.

Basic Information

Basic information varies depending on whether Import Platform Users was selected in the preceding step.

¡ If Import Platform Users was not selected, then basic information includes only user name and identity number.

¡ If Import Platform Users was selected, then basic information includes user name, identity number, contact address, telephone, email, and user group.

The user name and identity number uniquely identify a platform user. If the user name and identity number of a platform user to be imported already exist in IMC, the platform user is considered present; otherwise, the platform user does not exist.

¡ User Name—Name of the platform users. This parameter must be read from the imported file. Select the specified column number in the file as the user name.

¡ Identity Number—Identity number of the platform users. This parameter must be read from the imported file. Select the specified column number in the file as the identity number.

¡ Contact Address—Contact address of the platform users. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the contact address, or select Not Imported and enter a contact address. The contact address you entered applies to all imported platform users.

¡ Telephone—Telephone number of the platform users. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the telephone number, or select Not Imported and enter a telephone number. The telephone number you entered applies to all imported platform users.

¡ Email—Email address of the platform users. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the email address, or select Not Imported and enter an email address. The email address you entered applies to all imported platform users.

¡ User Group—User group of the platform users. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the user group, or select Not Imported and click the Select User Group icon to select a user group on the window that opens.

Access Information

¡ Account Name—Account name of the access users. This parameter must be read from the imported file. Select the specified column number in the file as the account name.

¡ Start Time—Date and time when the access users become valid. This parameter can be either imported from the file or manually specified. To import the time, select a column number in the file. To manually specify the time, select Not Imported, and then enter a time string in YYYY-MM-DD hh:mm format or click the Calendar icon to set the time. Manually specified time applies to all imported access users. If this field is empty, the access users become valid immediately after being imported.

¡ End Time —Date and time when the access users expire and become invalid. This parameter can be either imported from the file or manually specified. To import the time, select a column number in the file. To manually specify the time, select Not Imported, and then enter a time string in YYYY-MM-DD hh:mm format or click the Calendar icon to set the time. Manually specified time applies to all imported access users. If this field is empty, the imported access users never expire.

¡ Password—Password of the access users. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the password, or select Not Imported and enter a password. The password you enter applies to all imported access users.

¡ Allow User to Change Password—Enables the access users to change the password in the self-service center or iNode client. This parameter can only be specified manually.

¡ Max. Idle Time (Minutes)—Maximum idle time permitted for online access users. When the time expires, the users are forcibly logged off. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the maximum idle time, or select Not Imported and enter a maximum idle time. The maximum idle time you enter applies to all imported access users. If this field is empty, the imported access users can always stay online.

¡ Max. Concurrent Logins—Maximum number of concurrent online users of the same account. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the maximum concurrent logins value, or select Not Imported and enter a maximum concurrent logins value. The value you enter applies to all imported access users. If this field is empty, the number of concurrent online users of the same account is unlimited.

¡ Login Message—Message to be displayed on user endpoints when users pass authentication. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the login message, or select Not Imported and enter a login message. The login message you enter applies to all imported access users.

¡ WLAN Cell Phone Number—Phone number that can be bound to the access user. This parameter is displayed only when Third-Party Authentication System is enabled in UAM system settings. This parameter must be read from the imported file. Select the specified column number in the file as the phone number. If Not Imported is selected, phone number is not bound to the access user. When this function is enabled, UAM sends the phone number and password for second authentication by the third-party system authentication system. For information about third-party system authentication, see "Configuring the third-party authentication system." For information about phone number configuration restrictions, see "Configuring the cell phone number ranges."

¡ WLAN Password—Password of the WLAN cell phone number. This parameter is displayed only when the specified column number is selected. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the WLAN password, or select Not Imported and enter a password. The WLAN password you enter applies to all imported access users.

Access Service

Access services can only be selected from the access service list. You can select multiple services with different suffixes. The access services you specify apply to all imported access users.

¡ Service Name—Name of the service.

¡ Service Suffix —Identifies the name of the domain to be used for terminal user authentication.

¡ Default Security Policy—Name of the security policy that is applied to users who do not match any predefined access scenario. This parameter is displayed only when the EAD component is installed.

¡ Allocate IP—IP address that the service assigns to the access users. If you select the service with Allocate IP enabled, a list is available in the Allocate IP column. Select the specified column number in the file as the IP address assigned to the access users.

Access Device Binding Information

If you select a binding option for a service but do not specify a value for the parameter in the access device binding information, UAM automatically acquires the binding information for the service when each user first passes authentication.

To pass authentication, the user must meet all requirements of the access device bindings and terminal bindings.

¡ Device IP—IP address of the access device bound to the access users. To pass authentication, an access user must connect to the access device that uses this IP address. If an access device has multiple IP addresses, the one that the access device used when it was added to UAM is adopted as the device IP. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the device IP, or select Not Imported and enter a device IP. The device IP you enter applies to all imported access users.

¡ Device IPv6 Address—IPv6 address of the access device bound to the access users. To pass authentication, an access user must connect to the access device that uses this IPv6 address. If an access device has multiple IPv6 addresses, the one that the access device used when it was added to UAM is adopted as the device IPv6 address. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the device IPv6 address, or select Not Imported and enter a device IPv6 address. The device IPv6 address you enter applies to all imported access users. This field is displayed only when IPv6 is enabled in the UAM system settings.

¡ Port—Port to which the access users are bound. To pass authentication, an access user must connect to the specified port on a device. In UAM, each access user is bound to only the last portion of an interface number. For example, if an access user is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the port number, or select Not Imported and enter a port number. The port number you entered applies to all imported access users.

¡ Device SN—Sequence number of the access device bound to each access user account. Select a column in the file, or select Not Import from File and manually set the same sequence number for all accounts to be imported or keep the field empty. If you keep this field empty, UAM binds an access user account to the sequence number of the access device used by the user for the first login.

¡ VLAN ID/Inner VLAN ID—VLAN ID or inner VLAN ID bound to the access users. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the VLAN ID/inner VLAN ID, or select Not Imported and enter a VLAN ID/inner VLAN ID. The VLAN ID/inner VLAN ID you enter applies to all imported access users.

¡ Outer VLAN ID—Outer VLAN ID bound to the access users. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the outer VLAN ID, or select Not Imported and enter an outer VLAN ID. The outer VLAN ID you enter applies to all imported access users.

¡ User SSID—SSID used by the access users for wireless access. To pass authentication, an access user must use the specified SSID. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the SSID, or select Not Imported and enter an SSID. The SSID you enter applies to all imported access users.

Terminal Binding Information

To pass authentication, the user must meet all requirements of the access device bindings and terminal bindings.

¡ Computer Name—Computer name bound to the access users. To pass authentication, an access user must access from the specified computer. This parameter must be read from the imported file, because access users are not bound to the same computer name. Select the specified column number in the file as the computer name.

¡ Windows Domain—Domain name bound to the access users. To pass authentication, an access user must join or log in the specified domain. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the domain name, or select Not Imported and enter a domain name. The domain name you enter applies to all imported access users.

¡ Terminal IP Address—List of IPv4 addresses or IPv4 address ranges bound to the access users. To pass authentication, an access user must use a bound IPv4 address or an IPv4 address in the bound IPv4 address ranges. This parameter must be read from the imported file, because access users are not bound to the same IPv4 address. Select the specified column number in the file as the bound IPv4 addresses or bound IPv4 address ranges.

¡ Terminal IPv6 Address—List of IPv6 addresses bound to the access users. To pass authentication, an access user must use an IPv6 address on the list. This parameter must be read from the imported file, because access users are not bound to the same IPv6 address. Select the specified column number in the file as the bound IPv6 addresses.

¡ Terminal MAC Address—List of MAC addresses bound to the access users. To pass authentication, an access user must use a MAC address on the list. This parameter must be read from the imported file, because access users are not bound to the same MAC address. Select the specified column number in the file as the bound MAC addresses.

¡ IMSI—IMSI bound to the access users. To pass authentication, a user endpoint must use the specified IMSI. This parameter must be read from the imported file, because access users are not bound to the same IMSI. Select the specified column number in the file as the IMSI.

¡ IMEI—IMEI bound to the access users. To pass authentication, a user endpoint must use the specified IMEI. This parameter must be read from the imported file, because access users are not bound to the same IMEI. Select the specified column number in the file as the IMEI. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

11. Click Preview to launch the Preview Import Result window, showing the first ten imported entries. Check whether the import result is as expected.

12. Click Close to return to the import page.

After the import is completed, the operation result page opens, showing the number of import successes and failures. If import failures occur, click Download to check the failure reason.

The Operation Failure Logs list provides the last 20 import logs.

14. Click the link in the Operation Result column to view the operation result.

Maintaining accounts in a file

This operation includes the following actions: Modify Accounts, Cancel Accounts, Apply for Services, and Cancel a Service.

Modifying accounts

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

All supported batch operations are displayed.

3. Select Maintain Accounts in a File, and then click Next.

4. For the Import File box, click Browse to select a .txt or .csv file that saves the account information. UAM supports importing only a .txt or .csv file.

5. Select the column separator from the list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). A .csv file must use the comma (,) as the column separator.

6. Select Modify Accounts for Action, and then click Next to display the operation page.

7. Modify the parameters in each area on the page.

Make sure the parameters in the text file comply with the specified format and value range. For example, the access device IP addresses must be in the standard IPv4 address format. Otherwise, an import failure occurs.

¡ Access Information area

- Account Name—Account name of the access users. This parameter must be read from the imported file. Select the specified column number in the file as the account name.

- Start Time—Date and time when the access users become valid. This parameter can be either imported from the file or manually specified. To import the time, select a column number in the file. To manually specify the time, select Not Imported, and then enter a time string in YYYY-MM-DD hh:mm format or click the Calendar icon to set the time. Manually specified time applies to all imported access users. If this field is empty, access users become valid immediately after being imported.

- End Time—Date and time when the access users expire and become invalid. This parameter has the following options: Unchanged, Not Imported, and the column number in the file. Select Unchanged to keep the parameter unchanged. Select a column number in the file as the expiration time. Select Not Imported, and then enter a time string in YYYY-MM-DD hh:mm format or click the Calendar icon to set the time. Manually specified time applies to all imported access users. If this field is empty, imported access users never expire.

- Password—Password of the access users. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the password, or select Not Imported and enter a password for the access users.

- Allow User to Change Password—This parameter provides the following options: Unchanged, Yes, and No. Select Unchanged to keep the parameter unchanged, select Yes to allow access users to modify the password in the self-service center or iNode client, or select No to not allow access users to modify the password.

- Enable Password Strategy—This parameter provides the following options: Unchanged, Yes, and No. Select Unchanged to keep the parameter unchanged, select Yes to enable the password control strategy, or select No to disable the password control strategy. The strategy requires that the access user must meet certain requirements when the user tries to change the password through the iNode client. An IMC administrator can change the password of any access user regardless of whether a password strategy is used. When the access user changes the login password as required, this field changes to No. This option is available only when you select Yes for Allow User to Change Password.

- Modify Password at Next Login—This parameter provides the following options: Unchanged, Yes, and No. Select Unchanged to keep the parameter unchanged. Select Yes to require access users to change the password the next time the user passes authentication. Select No to not require access users to change the password the next time the user passes authentication. This option is available only when you select Yes for Enable Password Strategy.

- Max. Idle Time (Minutes)—Maximum idle time permitted for online access users. When the time expires, the users are forcibly logged off. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the maximum idle time, or select Not Imported and enter a maximum idle time for the access users. If this field is empty, the imported access users can always stay online.

- Max. Concurrent Logins—Maximum number of concurrent online users of the same account. This parameter can be either read from the imported file or manually specified. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged. Select the specified column number in the file as the maximum concurrent logins value. Select Not Imported, and then enter a maximum concurrent logins value for the access users. If this field is empty, the number of concurrent online users of the same account is not limited.

- Login Message—Message to be displayed on user endpoints when users pass authentication. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the login message, or select Not Imported and enter a login message for the access users.

- WLAN Cell Phone Number—Phone number that can be bound to the access user. This parameter is displayed only when Third-Party Authentication System is enabled in UAM system settings. This parameter must be read from the imported file. Select the specified column number in the file as the phone number. If Not Imported is selected, phone number is not bound to the access user. When this function is enabled, UAM sends the phone number and password for second authentication by the third-party system authentication system. For information about third-party system authentication, see "Configuring the third-party authentication system." For information about phone number configuration restrictions, see "Configuring the cell phone number ranges."

- WLAN Password—Password of the WLAN cell phone number. This parameter is displayed only when the specified column number is selected. This parameter can be either read from the imported file or manually specified. You can select the specified column number in the file as the WLAN password, or select Not Imported and enter a password. The WLAN password you enter applies to all imported access users.

¡ Access Device Binding Information area

To pass authentication, the user must meet all requirements of the access device bindings and terminal bindings.

- Device IP—IP address of the access device bound to the access users. To pass authentication, an access user must connect to the access device that uses this IP address. If an access device has multiple IP addresses, the one that the access device used when it was added to UAM is adopted as the device IP. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the device IP, or select Not Imported and enter a device IP for the access users.

- Device IPv6 Address—IPv6 address of the access device bound to the access users. To pass authentication, an access user must connect to the access device that uses this IPv6 address. If an access device has multiple IPv6 addresses, the one that the access device used when it was added to UAM is adopted as the device IPv6 address. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the device IPv6 address, or select Not Imported and enter a device IPv6 address for the access users.

- Port—Port to which the access users are bound. To pass authentication, an access user must connect to the specified port on a device. In UAM, each access user is bound to only the last portion of an interface number. For example, if an access user is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the port number, or select Not Imported and enter a port number for the access users.

- Device SN—Sequence number of the access device bound to each access user. To pass authentication, an access user must connect to the access device that uses this sequence number. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the device sequence number, or select Not Imported and enter a device sequence number for the access users.

- VLAN ID/Inner VLAN ID—VLAN ID or inner VLAN ID bound to the access users. This parameter has the following options: Unchanged, Not Imported, Clear, and the specified column number in the file. Select Unchanged to keep the parameter unchanged. Select Not Imported, and then enter an VLAN ID/inner VLAN ID for the access users. Select the specified column number in the file as the VLAN ID/inner VLAN ID. Select Clear to clear the VLAN ID/inner VLAN ID bound to the access users.

- Outer VLAN ID—Outer VLAN ID bound to the access users. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the outer VLAN ID, or select Not Imported and enter an outer VLAN ID for the access users.

- User SSID—SSID used by the access users for wireless access. To pass authentication, an access user must use the specified SSID. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the SSID, or select Not Imported and enter an SSID for the access users.

¡ Terminal Binding Information area

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings.

- Computer Name—Computer name bound to the access users. To pass authentication, an access user must access from the specified computer. This parameter has the following options: Unchanged and the specified column number in the file. Select Unchanged to keep the parameter unchanged, or select the specified column number in the file as the computer name. This parameter must be read from the imported file, because access users are not bound to the same computer name. Select the specified column number in the file as the computer name.

- Windows Domain—Domain name bound to the access users. To pass authentication, an access user must join or log in to the specified domain. This parameter has the following options: Unchanged, Not Imported, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the domain name, or select Not Imported and enter a domain name for the access users. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

- Terminal IP Address—List of IPv4 addresses or IPv4 address ranges bound to the access users. To pass authentication, an access user must access from the computer that uses a bound IPv4 address or an IPv4 address in the bound IPv4 address ranges. This parameter must be read from the imported file, because access users are not bound to the same IPv4 address. Select the specified column number in the file as the bound IPv4 addresses or bound IPv4 address ranges.

- Terminal IPv6 Address—List of IPv6 addresses bound to the access users. To pass authentication, an access user must access from the computer that uses an IPv6 address on the list. This parameter must be read from the imported file, because access users are not bound to the same IPv6 address. Select the specified column number in the file as the bound IPv6 addresses.

- Terminal MAC Address—List of MAC address bound to the access users. To pass authentication, an access user must access from the computer that uses a MAC address on the list. This parameter has the following options: Unchanged, Clear, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the bound MAC addresses, or select Clear to clear the MAC addresses bound to the access users.

- IMSI—IMSI bound to the access users. To pass authentication, a user endpoint must use the specified IMSI. This parameter has the following options: Unchanged, Clear, and the specified column number in the file. Select Unchanged to keep the parameter unchanged, select the specified column number in the file as the bound IMSI, or select Clear to clear the IMSI bound to the access users.

- IMEI—IMEI bound to the access users. To pass authentication, a user endpoint must use the specified IMEI. This parameter must be read from the imported file because access users are not bound to the same IMEI. Select the specified column number in the file as the IMEI. If this field is empty, the binding parameter is automatically learned and the parameter used for the first successful authentication is adopted.

8. Click Preview to launch the Preview Import Result window, showing the first ten imported entries.

9. Verify whether the modification result is as expected.

10. Click Close to return to the modification page.

11. Click OK to start modifying the accounts in batches.

After the modification is completed, the operation result page opens, showing the number of modification successes and failures. If modification failures occur, click Download to view the log for the reason for failure.

Deleting accounts

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

All supported batch operations are displayed.

3. Select Maintain Accounts in a File, and then click Next.

4. For the Import File box, click Browse to select a .txt or .csv file that saves the account information.

UAM supports importing only a .txt or .csv file.

5. Select the column separator from the list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). A .csv file must use the comma (,) as the column separator.

6. Select Cancel Accounts for Action, and then click Next to display the operation page.

7. Select the specified column number in the file as the account name.

The system matches the access user accounts in UAM against those in the file, and deletes only the matching entries.

8. Select whether to delete platform users:

¡ Do not select Delete Platform Users to delete only access users.

¡ Select Delete Platform Users to delete only the access users if the associated platform users correspond to multiple access user accounts, or delete both the access users and the associated platform users (in one-to-one correspondence).

9. Click OK to start deleting the accounts in batches.

After the deletion is completed, the operation result page shows the number of deletion successes and failures. If deletion failures occur, click Download to view the log and the reason for failure.

Applying for services for accounts

When Apply for Service by User Group is enabled, operators cannot manually apply for services for access users in batches. For information about configuring Apply for Service by User Group, see "Configuring global system settings."

To apply for services for accounts in batches:

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

The page displays all supported batch operations.

3. Select Maintain Accounts in a File, and then click Next.

4. For the Import File box, click Browse to select a .txt or .csv file that saves the account information.

UAM supports importing only a .txt or .csv file.

5. Select the column separator from the list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). A .csv file must use the comma (,) as the column separator.

6. Select Apply for Services for Action, and then click Next to display the operation page.

7. In the Access Information area, select the specified column number in the file as the account name. The system matches the access user accounts in UAM against those in the file, and applies for services for only the matching entries.

8. Select services from the access service list.

Access services can only be selected from the access service list. You can select multiple services with different suffixes.

¡ Service Name—Name of the service to be applied for.

¡ Service Suffix —Identifies the name of the domain to be used for endpoint authentication.

9. Click OK.

After UAM completes applying for services, the operation result page shows the number of operation successes and failures. If failures occur, click Download to view the log for the reason for failure.

Canceling a service for accounts

When Apply for Service by User Group is enabled, operators cannot cancel services for access users in batches. For information about configuring Apply for Service by User Group, see "Configuring global system settings."

To cancel a service for accounts in batches:

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

The page displays all supported batch operations.

3. Select Maintain Accounts in a File, and then click Next.

4. For the Import File box, click Browse to select a .txt or .csv file that saves the account information.

UAM supports importing only a .txt or .csv file.

5. Select the column separator from the list.

6. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). A .csv file must use the comma (,) as the column separator.

7. Select Cancel Services for Action, and then click Next to display the operation page.

8. In the Access Information area, select the specified column number in the file as the account name.

The system matches the access user accounts in UAM against those in the file, and deletes the service for only the matching entries.

9. Select a service from the access service list. Access services cannot be read from a file and must be selected from the access service list. You can select only one service from the list.

¡ Service Name—Name of the service to be cancelled.

¡ Service Suffix—Identifies the name of the domain to be used for endpoint authentication.

10. Click OK.

After service deletion is completed, the operation result page shows the number of operation successes and failures. If failures occur, click Download to view the log and the reason for failure.

Querying and maintaining accounts in batches

Use these features to select access users matching specified query criteria and perform the following maintenance actions: modify/cancel account, apply for/cancel service, and add accounts to the blacklist.

Querying access users

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

All supported batch operations are displayed.

3. Select Query and Maintain Accounts in Batches, and then click Next.

4. Specify the query criteria in the Basic Information area.

¡ Account Name—Enter a partial or complete account name. The access account name is for authentication. For example, if you enter x, all account names that contain x are matched.

¡ User Name—Enter a partial or complete platform user name. For example, if you enter y, all user names that contain y are matched.

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window. You can select only one user group for query.

¡ Service Name—Select Unapplied or an existing service from the list.

¡ Account Status—Select the account state from the list. Options include Normal, Trial, Temporarily Cancelled, Unactivated, Cancelled, and Non-Cancelled. Except the normal state, accounts in any other state cannot be authenticated.

- Trial indicates a trial account that is not counted in the user accounts managed by a license.

- Temporarily Cancelled indicates an invalid account that is temporarily deleted.

- Unactivated indicates a preregistered account is registered but is not activated. For more information about preregistering accounts, see "Preregistering access users." For more information about formal registration, see "Managing preregistered users." To activate an approved account, go to system parameter configuration. For more information, see "Configuring global system settings."

- Cancelled indicates an invalid account that is permanently deleted.

To filter out cancelled accounts, select Non-Cancelled from the list. Normal, trial, temporarily cancelled, and unactivated users are all categorized as non-cancelled users.

¡ Identity Number—Enter a partial or complete identity number of the platform user to which the access user is attached. For example, if you enter z, all identity numbers that contain z are matched.

¡ Contact Address—Enter a partial or complete contact address of the platform user to which the access user is attached. For example, if you enter a, all contact addresses that contain a are matched.

¡ Creation Date From/To—Click the Calendar icon to select the time range when the account was created, or enter the time range in YYYY-MM-DD format.

¡ Last Logoff From/To—Click the Calendar icon to select the time range when the access user last logged off, or enter the time range in YYYY-MM-DD format.

¡ Start Time From/To—Click the Calendar icon to select the time range when the account become valid, or enter the time range in YYYY-MM-DD hh:mm format.

¡ End Time From/To—Click the Calendar icon to select the time range when the account expires, or enter the time range in YYYY-MM-DD hh:mm format.

¡ Email—Enter a partial or complete email address of the platform user to which the access user is attached. For example, if you enter com, all email addresses that contain com are matched.

¡ Port—Enter the last portion of the port to which the access user is bound. In UAM, each access user is bound to only the last portion of an interface number. For example, if an access user is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port. UAM supports only an exact match for this field.

¡ Max. Concurrent Logins—Enter the upper limit of concurrent logins that the access user is allowed. UAM supports only an exact match for this field.

¡ Max. Idle Time (Minutes)—Enter the maximum idle time that the access user is allowed. UAM supports only an exact match for this field.

¡ Device IP Address Range From/To—Enter an IP address range for the access device to which the access user is bound. You must enter a complete IPv4 address in each field.

¡ User IP Address Range From/To—Enter the IP address range of computers bound to the access users. You must enter a complete IPv4 address in each field.

¡ User MAC Address—Enter the MAC address of computers bound to the access users. The format can be XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX. UAM supports only an exact match for this field. For example, if you enter AA-BB, all MAC addresses that contain AA-BB are matched.

¡ User SSID—Enter a partial or complete SSID of the wireless network that the access user can access. For example, if you enter a, all SSIDs that contain a are matched.

¡ VLAN ID/Inner VLAN ID—Enter a VLAN ID or inner VLAN ID to which the access user is bound. UAM supports only exact an match for this field.

¡ Outer VLAN ID—Enter the outer VLAN ID to which the access user is bound. UAM supports only an exact match for this field.

¡ LDAP User Status—Select the LDAP user state from the list. Options include Unknown, Existent, and Nonexistent. The Unknown option indicates that an LDAP user has not synchronized information from the LDAP server. The Existent option indicates that the LDAP server contains an LDAP user that is associated with the access user. The Nonexistent option indicates that the LDAP server does not contain an LDAP user that is associated with the access user. This query criterion is effective on LDAP users only. For more information about the LDAP users, see "Managing LDAP users."

¡ Windows Domain—Enter a partial or complete name of the domain to which the computer of the access user is bound. For example, if you enter a, all Windows domain names that contain a are matched.

¡ IMSI—Enter a partial or complete IMSI to which the access user is bound. For example, if you enter EF, all IMSIs that contain EF are matched.

¡ Computer Name—Enter a partial or complete name of the computer to which the access user is bound. For example, if you enter a, all computer names that contain a are matched.

¡ Device SN—Enter a partial or complete device sequence number bound to the access user. For example, if you enter EF, all device sequence numbers that contain EF are matched.

¡ Smart Device MAC Address—Enter the device MAC address bound to the access user account. You can enter a complete MAC address in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX, or enter a partial MAC address in the format of XXXX-XXXX, XX-XX, or XX:XX. For example, if you enter 00-ef, all MAC addresses that contain 00-ef are matched.

¡ Max. Smart Device Bindings for Portal—Select the maximum number of device MAC addresses that can be bound to the access user account for transparent portal authentication only, or select Not Supported from the list.

Not Supported indicates the account does not support transparent portal authentication.

¡ Creator—Enter a partial or complete name of the operator that created the access user.

¡ IMEI—Enter a partial or complete IMEI to which the access user is bound. For example, if you enter EF, all IMEI numbers that contain EF are matched.

The query ignores empty fields.

5. Click Preview to view the query result in the access user list area.

6. Click Reset to clear the query criteria. The list includes all access users in UAM.

Modifying accounts

7. Query access users.

For more information, see "Querying access users."

8. Click Modify Account in the access user list area to display the Modify Account page.

9. Select and modify the value for one or more of the following access information parameters:

¡ Password—Enter the password of the access users.

¡ Allow User to Change Password—Select Yes to allow access users to modify the password in the self-service center, or select No to prohibit access users from modifying the password in the self-service center. For more information about the self-service center, see "Using the user self-service."

¡ Enable Password Strategy—Select Yes to require that the access users must modify the password based on the password control strategy through the iNode client, or select No to allow the access users to enter any password. An IMC administrator can change the password of any access user regardless of whether a password strategy is used. After the access user changes the login password as required, this field changes to No. This option is available only when you select Yes for Allow User to Change Password. For more information about password control strategy, see "Configuring the password strategy."

¡ Modify Password at Next Login—Select Yes to require access users to change the password the next time users pass authentication. Select No to not require access users to change the password the next time users pass authentication. This option is available only when you select Yes for Enable Password Strategy.

¡ Start Time—Time when the access users become valid. Click the Calendar icon to select the validity time, or enter a time string in YYYY-MM-DD hh:mm format. If this field is empty, the access users become valid immediately after being modified.

¡ End Time—Time when the access users expire and become invalid. Click the Calendar icon to select the expiration time, or enter a time string in YYYY-MM-DD hh:mm format. If this field is empty, the access users never expire.

¡ Max. Idle Time (Minutes)—Specify the maximum idle time permitted for online access users. When the time expires, the users are forcibly logged off. If this field is empty, the access users can always stay online.

¡ Max. Concurrent Logins—Maximum number of concurrent online users of the same account. If this field is empty, the number of concurrent online users of the same account is not limited.

Not Supported indicates the account does not support transparent portal authentication.

¡ Clear Bound WLAN Cell Phone Number—Select this option to clear all phone numbers bound to the access devices. This parameter is displayed only when Third-Party Authentication System is enabled in UAM system settings. For information about third-party authentication, see "Configuring the third-party authentication system."

¡ WLAN Password—Enter the password bound to the cell phone number. The parameter becomes invalid when Clear Bound WLAN Cell Phone Number is selected.

¡ Login Message—Message to be displayed on user endpoints when users pass authentication.

10. Modify the access device binding information.

To pass authentication, the access user must meet all requirements of the access device bindings and terminal bindings.

¡ Clear Bound Device IP Addresses—Select this option to clear all IPv4 addresses bound to the access devices to which the access users are connected and let UAM automatically rebind IPv4 addresses to the access devices.

¡ Clear Bound Device IPv6 Addresses—Select this option to clear all IPv6 addresses bound to the access devices to which the access users are connected and let UAM automatically rebind IPv6 addresses to the access devices.

¡ Port—Enter the port to which the access users are bound. To pass authentication, an access user must connect to the specified port on a device. In UAM, each access user is bound to only the last portion of an interface number. For example, if an access user is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

¡ Device SN—Enter the sequence number of the access device to be bound to the access users. To pass authentication, the access users must connect to the access device that uses the specified sequence number.

¡ Clear Bound VLAN IDs—Select this option to clear all VLAN IDs/inner VLAN IDs bound to the access users and let UAM automatically rebind VLAN ID or inner VLAN IDs to them.

¡ Outer VLAN ID—Enter the outer VLAN tag to be bound to the access users.

¡ Clear Bound User SSID—Select this option to clear all SSIDs bound to the access users and let UAM automatically rebind SSIDs to them.

11. Modify the terminal binding information:

¡ Clear Bound IP Entries—Select this option to clear all endpoint IPv4 addresses bound to the access users and let UAM automatically rebind endpoint IPv4 addresses to them.

¡ Clear Bound IPv6 Entries—Select this option to clear all endpoint IPv6 addresses bound to the access users and let UAM automatically rebind endpoint IPv6 addresses to them.

¡ Clear Bound MAC Entries—Select this option to clear all endpoint MAC addresses bound to the access users and let UAM automatically rebind endpoint MAC addresses to them.

¡ Clear Bound IMSI—Select this option to clear all endpoint IMSIs bound to the access users and let UAM automatically rebind endpoint IMSIs to them.

12. Click OK.

For fast-authentication users and host name users in batch modification, the Password, Allow User to Change Password, Enable Password Strategy, and Modify Password at Next Login settings do not take effect.

Deleting accounts

1. Query access users.

For more information, see "Querying access users."

2. Click Cancel Account in the access user list area to display the Cancel Accounts page.

3. Select whether to delete platform user accounts:

¡ Do not select Delete Platform Users to delete only access user accounts.

¡ Select Delete Platform Users to delete only the access user accounts if the associated platform user accounts correspond to multiple access user accounts, or delete both the access user accounts and the associated platform user accounts (in one-to-one correspondence).

4. Click OK to start deleting the accounts in batches.

After the deletion is completed, the operation result page shows the number of deletion successes and failures. If failures occur, click Download to view the log and the reason for failure.

Applying for services for accounts

When Apply for Service by User Group is enabled, the Apply for Service button does not appear in the access user list area, and operators cannot manually apply for services for access users in batches. For information about configuring Apply for Service by User Group, see "Configuring global system settings."

To apply for services for access accounts in batches:

1. Query access users.

For more information, see "Querying access users."

2. Click Apply for Service in the access user list area to display the Service List page.

3. Select services from the access service list.

You can select multiple services with different suffixes. The services you select cannot be the same as the existing services.

¡ Service Name—Name of the service to be applied for.

¡ Service Suffix—Identifies the name of the domain to be used for endpoint user authentication.

4. If you select Yes for Allocate IP for a service, the service cannot be selected and its box is unavailable.

5. Click OK.

Canceling services for accounts

When Apply for Service by User Group is enabled, the Cancel Service button does not appear in the access user list area, and operators cannot manually cancel services for access users in batches. For information about configuring Apply for Service by User Group, see "Configuring global system settings."

To cancel services in batches:

1. Query access users.

For more information, see "Querying access users." To query access users, you must select an existing service from the Service Name list.

2. Click Cancel Service in the access user list area.

A confirmation dialog box opens.

3. Click OK.

This operation lets you export the access users in UAM in a .txt or .csv file.

To export accounts in batches:

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

The page displays all supported batch operations.

3. Select Export Accounts in Batches, and then click Next.

4. Specify the query criteria in the Basic Information area.

¡ Account Name—Enter a partial or complete account name of an access user. The access user uses the account name for authentication. For example, if you enter x, all account names that contain x are matched.

¡ User Name—Enter a partial or complete platform user name. For example, if you enter y, all user names that contain y are matched.

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window. You can select only one user group for query.

¡ Service Name—Select Unapplied or an existing service from the list.

¡ Account Status—Select an account state from the list. Options include Normal, Trial, Temporarily Cancelled, Unactivated, Cancelled, and Non-Cancelled. Except the normal state, accounts in any other state cannot be authenticated.

Trial indicates a trial account that is not counted in the user accounts managed by a license.

Temporarily Cancelled indicates an invalid account that is temporarily deleted.

Unactivated indicates a preregistered account is registered but is not activated. For more information about preregistering accounts, see "Preregistering access users." For more information about formal registration, see "Managing preregistered users." To activate an approved account, go to system parameter configuration. For more information, see "Configuring global system settings."

Cancelled indicates an invalid account that is permanently deleted.

To filter out cancelled accounts, select Non-Cancelled from the list. Normal, trial, temporarily cancelled, and unactivated users are all categorized as non-cancelled users.

¡ Identity Number—Enter a partial or complete identity number of a platform user. For example, if you enter z, all identity numbers that contain z are matched.

¡ Contact Address—Enter a partial or complete contact address of a platform user. For example, if you enter a, all contact addresses that contain a are matched.

¡ Creation Date From/To—Click the Calendar icon to select the time range when the account was created, or enter the time range in YYYY-MM-DD format.

¡ Last Logoff From/To—Click the Calendar icon to select the time range when the access user last logged off, or enter the time range in YYYY-MM-DD format.

¡ Email—Enter a partial or complete email address of a platform user. For example, if you enter com, all email addresses that contain com are matched.

¡ Port—Enter the last portion of the port to which an access user is bound. In UAM, each access user is bound to only the last portion of an interface number. For example, if an access user is bound to port 3, both interface number 1/0/3 and interface number 2/0/3 match the port. UAM supports only an exact match for this field.

¡ Max. Concurrent Logins—Enter the upper limit of concurrent logins that an access user is allowed. UAM supports only an exact match for this field.

¡ Max. Idle Time (Minutes)—Enter the maximum idle time that an access user is allowed. UAM supports only an exact match for this field.

¡ Device IP Address Range From/To—Enter an IP address range for the access device to which an access user is bound. You must enter a complete IPv4 address in each field.

¡ User IP Address Range From/To—Enter the IP address range of computers bound to the access users. You must enter a complete IPv4 address in each field.

¡ User SSID—Enter a partial or complete SSID used by an access user for wireless access. For example, if you enter a, all SSIDs that contain a are matched.

¡ VLAN ID/Inner VLAN ID—Enter a VLAN ID or inner VLAN ID to which an access user is bound. UAM supports only an exact match for this field.

¡ Outer VLAN ID—Enter the outer VLAN ID to which an access user is bound. UAM supports only an exact match for this field.

¡ LDAP Synchronization Policy—Select the LDAP synchronization policy that is associated with an access user. This query criterion is effective on LDAP users only. For more information about the LDAP users, see "Managing LDAP users."

¡ LDAP User Status—Select the LDAP user status from the list. Options include Unknown, Existent, and Nonexistent. The Unknown option indicates that an LDAP user has not synchronized information from the LDAP server. The Existent option indicates that the LDAP server contains an LDAP user that is associated with the access user. The Nonexistent option indicates that the LDAP server does not contain an LDAP user that is associated with the access user. This query criterion is effective on LDAP users only. For more information about the LDAP users, see "Managing LDAP users."

¡ Windows Domain—Enter a partial or complete name of the domain to which the computer of an access user is bound. For example, if you enter a, all Windows domain names that contain a are matched.

¡ IMSI—Enter a partial or complete IMSI of the user endpoint. For example, if you enter act, all IMSIs that contain act are matched.

¡ Computer Name—Enter a partial or complete name of the computer to which an access user is bound. For example, if you enter a, all computer names that contain a are matched.

¡ Device SN—Enter a partial or complete device sequence number bound to the access user. For example, if you enter EF, all device sequence numbers that contain EF are matched.

¡ WLAN Cell Phone Number—Enter a partial or complete phone number to which the access user is bound. For example, if you enter 138, all phone numbers that contain 138 are matched. This parameter is available only when a third-party authentication system is configured in the UAM system settings.

The query ignores empty fields.

5. Click Preview to view the query result in the access user list area.

6. Click Reset to clear all the query criteria. The list includes all access users.

7. Click Export Accounts.

The Export File Format page opens.

8. Select a file format: TXT or CSV. You can open a .csv file in Microsoft Excel.

9. Select the column separator from the list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). This parameter is available when you select TXT for File Format.

10. Select whether to export the passwords in plain text. Select Yes to export the passwords in plain text, or select No to export the passwords in cipher text.

11. Select the account parameters you want to export.

By default, the exported user account information includes Account Name, User Name, User Group, and Expiration Time. UAM also provides you with the ability to export one or more of the following parameters:

¡ Password

¡ Identity Number

¡ Telephone

¡ Contact Address

¡ E-mail

¡ Account Status

¡ Creation Time

¡ Access Device IP

¡ Access Device IPv6 Address (Available only when IPv6 is enabled in system parameter settings)

¡ Port

¡ VLAN ID/Inner VLAN ID

¡ Outer VLAN ID

¡ User SSID

¡ User IP

¡ User IPv6

¡ User MAC

¡ Max. Concurrent Logins

¡ Max. Idle Time (Minutes)

¡ Access Service List

¡ Computer Name

¡ Windows Domain

¡ Login Message

¡ Device SN

¡ IMSI

¡ IMEI

¡ Last Logoff

¡ WLAN Cell Phone Number/WLAN Password (Available only when the third-party authentication system is enabled in UAM system settings)

All parameters on the Output List will be exported to the file. You can perform the following operations:

¡ Select a parameter on the Option List and click the Copy icon to move it to the Output List.

¡ Click the Copy all icon to move all parameters from the Option List to the Output List.

¡ Select an undesired parameter on the Output List and click the Remove icon to move it back to the Option List.

¡ Click the Remove all icon to move all parameters from the Output List to the Option List.

You can sort the Output List by performing the following operations:

¡ Click the Top icon to move a selected parameter to the top of the Output List.

¡ Click the Up icon to move up a selected parameter in the Output List.

¡ Click the Down icon to move down a selected parameter in the Output List.

¡ Click the Bottom icon to move a selected parameter to the bottom of the Output List.

12. Click OK.

UAM exports information about the selected access user accounts and displays the export results.

13. Click Download to view the exported file or save it to another place.

By default, the export file is stored at the tmp directory in the IMC installation path on the IMC master server and is named in the format of exportAccountexport-time.

Exporting access details in batches

This operation lets you export the detailed online access user information saved in UAM in a .txt or .csv file.

To export access details in batches:

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

The page displays all supported batch operations.

3. Select Export Access Details in Batches, and then click Next.

4. Specify the query criteria in the Query Access Details area.

¡ Account Name—Enter a partial or complete account name of an access user. The access user uses the account name for authentication. For example, if you enter x, all access user names that contain x are matched.

¡ User Group—Click the Select User Group icon to select a group in the Select User Group window. You can select only one user group for query.

¡ Device IP Address Range From/To—Enter an IP address range for the access device to which an access user is bound. You must enter a complete IPv4 address in each field.

¡ User IP Address Range From/To—Enter the IP address range of computers bound to the access users. You must enter a complete IPv4 address in each field.

¡ Service Name—Select a service from the list.

¡ Access Start Time From/To—Click the Calendar icon to specify the access start time range.

¡ Access End Time From/To—Click the Calendar icon to specify the access end time range.

¡ Offline Cause—Select a reason why the access users go offline.

¡ Client Version—Enter a partial or complete client version used by the access user. For example, to query the clients of version iNode PC 5.0, you can enter 5.0.

¡ Device SN—Enter a partial or complete device sequence number bound to the access user. For example, if you enter EF, all device sequence numbers that contain EF are matched.

¡ IMSI—Enter a partial or complete endpoint IMSI bound to the access user. For example, if you enter EF, all IMSIs that contain EF are matched.

¡ Endpoint Type—Enter a partial or complete type of the user's endpoint. For example, if you enter iphone, all endpoint types that contain iphone are matched.

¡ Endpoint Vendor—Enter a partial or complete vendor of the user's endpoint. For example, if you enter apple, all endpoint vendor names that contain apple are matched.

¡ Endpoint OS—Enter a partial or complete OS of the user's endpoint. For example, if you enter android, all endpoint OS names that contain android are matched.

The query ignores empty fields.

5. Click Preview to view the query result in the Access Details List area.

6. Click Reset to clear all the query criteria. The list includes all access details entries.

7. Click Export Details to display the Export File Format page.

8. Select a file format: TXT or CSV.

A .csv file can be opened in Microsoft Excel.

9. Select the column separator from the list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). This parameter is available when you select TXT for File Format.

10. Select the information you want to export.

By default, the exported access details information includes the following fields:

¡ Account Name

¡ User Name

¡ Login Name

¡ Service Name

¡ Access At

¡ Access Duration (sec.)

¡ User IP Address

UAM also provides you with the ability to export one or more of the following parameters:

¡ Device IP

¡ Port

¡ VLAN ID/Inner VLAN ID

¡ Outer VLAN ID

¡ End At

¡ Outgoing Bytes

¡ Incoming Bytes

¡ Offline Cause

¡ User MAC Address

¡ Slot

¡ Sub-slot

¡ User SSID

¡ Windows Domain

¡ Client Version

¡ Device NAT IP Address

¡ RADIUS Accounting

¡ Device SN

¡ Endpoint Type

¡ Endpoint Vendor

¡ Endpoint OS

¡ IMSI

¡ IMEI

Select an entry on the Option List and click the Copy icon to move the entry to the Output List.

Select an entry on the Output List and click the Remove icon to remove the entry.

Click the Copy all icon to move all entries on the Option List to the Output List.

Click the Remove all icon to remove all entries from the Output List.

11. Click OK to start exporting the access details in batches. After the export is completed, the operation result page opens.

12. Click Download to view the exported file or save it to another place.

By default, the export file is stored at the tmp directory in the IMC installation path on the IMC master server and is named in the format of exportAccountexport-time.

Batch canceling unbound platform users

This operation lets you cancel platform users that are not bound with access users.

To cancel unbound platform users in batches:

1. Click the User tab.

2. From the navigation tree, select Access User > Batch Operations.

The page displays all supported batch operations.

3. Select Batch Cancel Unbound Platform Users, and then click Next.

4. Cancel unbound platform users using one of the following methods:

¡ Cancel selected users—Select the target users on the list, and click Cancel Selected Users.

¡ Cancel list users—Enter User Name and Identity Number in the Query Unbound Platform Users area, and click Query. Click Cancel List Users to cancel the users listed in the query result.

5. On the confirmation dialog box that opens, click OK.

Managing endpoint devices

User endpoint management provides the following functions:

· Endpoint Management—Allows you to manage endpoint device information, user information, and transparent authentication.

· Endpoint Configuration Management—It is also called BYOD quick deployment, and allows you to send endpoint configurations to endpoints and to make the configurations effective on endpoints. Endpoint configuration contains BYOD authentication auxiliary configuration and security configuration.

· Endpoint Identification—Allows you to identify the vendor, type, and operating system of an endpoint. For more information, see "Managing endpoint identification."

Managing endpoint devices

The Endpoint Management module maintains an endpoint list that shows the correlations between endpoint information and access user accounts. The entries are automatically learned by UAM, but they cannot be manually added to the endpoint list.

UAM uses the following entry learning process:

· When an endpoint user passes authentication for the first time, UAM automatically learns the correlation between the endpoint's MAC address and the account name, and generates an entry on the endpoint list. This entry is not updated even when the user account successfully passes authentication from another endpoint.

· When an endpoint user manually adds correlations between endpoint MAC addresses and access user accounts in the self-service center, UAM automatically adds these entries to the endpoint list. An access user account can be correlated with multiple endpoints.

· An operator bulk imports correlations between endpoint MAC addresses and access user accounts to UAM. An access user account can be correlated with multiple endpoints.

· With endpoint identification, UAM obtains endpoint information, correlates the information with the endpoint MAC address, and generates an entry on the endpoint list. Operators can modify the entry. When the endpoint is used for authentication, UAM compares the endpoint information with the entry. If the information does not match, UAM generates an endpoint conflict audit log. For more information about endpoint identification, see "Managing endpoint identification."

The Endpoint Management module also enables you to configure transparent authentication for endpoints. This function requires transparent MAC authentication to be enabled in UAM service parameter settings.

In addition, an operator can associate specific users with an endpoint device to prevent other users from using the endpoint device for network access.

Viewing the endpoint list

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Management.

The list includes all endpoints that are uniquely identified by MAC addresses.

Endpoint list contents

¡ MAC Address—Endpoint MAC address.

¡ Account Name—Account name of the access user with which the endpoint is correlated. Click the account name to view its details. For more information, see "Managing access users."

¡ User Name—Name of the platform user to which the access user is attached.

¡ Vendor—Vendor of the endpoint.

¡ Endpoint Type—Type of the endpoint.

¡ OS—Operating system of the endpoint.

¡ Transparent Authentication—Status of transparent authentication: Enabled or Disabled. To perform transparent authentication for endpoints, make sure transparent authentication is enabled in UAM service parameter settings and access service settings. For transparent portal authentication, you also need to enable transparent authentication in port group settings.

¡ Enabled/Disabled Time—Last time when one of the following events occurred:

- The endpoint is successfully correlated with an access user.

- Transparent authentication is enabled for the endpoint.

- Transparent authentication is disabled for the endpoint.

¡ Control Access User—Click the Control Access User icon to associate users with the endpoint.

¡ Modify—Click the Modify icon for an endpoint to modify the information.

¡ Details—Click the Details icon for an endpoint to view its details.

Querying endpoints

1. Access the endpoint list page.

2. In the Query Endpoints area, specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of the access user with which the endpoint is correlated. For example, if you enter bob, all account names that contain bob are matched.

¡ MAC Address—Enter a partial or complete endpoint MAC address. The MAC address can be in the format XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX. For example, if you enter 00-ef, all MAC addresses that contain 00-ef are matched.

¡ Enabled/Disabled Time From/To—Specify the time range in which the endpoint was correlated with an access user account or transparent authentication was configured for the endpoint. You can click the Calendar icon to select the time, or enter the time in YYYY-MM-DD hh:mm format.

¡ Vendor—Enter a partial or complete vendor name. For example, if you enter Micro, all vendor names that contain Micro are matched.

¡ Endpoint Type—Enter a partial or complete endpoint type. For example, if you enter PC, all endpoint types that contain PC are matched.

¡ OS—Enter a partial or complete operating system name. For example, if you enter Windows, all operating system names that contain Windows are matched.

¡ Transparent Authentication—Select Enabled or Disabled from the list.

¡ Service Name—Select a service name that the endpoint is correlated with.

The query ignores empty fields.

3. Click Query.

All matching endpoints are displayed in the endpoint list.

Click Reset to clear the query criteria and display all endpoints in the endpoint list.

Viewing endpoint details

1. Access the endpoint list page.

2. In the endpoint list area, click the Details icon for the endpoint you want to view.

The Endpoint MAC Address Details page opens, including the following parameters:

¡ MAC Address—Endpoint MAC address.

¡ Account Name—Account name of the access user with which the endpoint is correlated.

¡ User Name—Name of the platform user to which the access user is attached.

¡ Vendor—Vendor of the endpoint.

¡ Vendor Obtaining Method—The vendor obtaining methods are MAC Address, iNode, DHCP Character, and HTTP User Agent in descending order of priority. If different vendors are obtained for the same endpoint through multiple methods, the endpoint information obtained through the method with the highest priority is used.

¡ Endpoint Type—Type of the endpoint. The string might not be easily understood or remembered, for example, N7100.

¡ Display Name of Endpoint Type—Type of the endpoint. The string can include detailed information and can be easily understood or remembered, for example, GALAXY NoteII(N7100).

¡ Endpoint Type Obtaining Method—The endpoint type obtaining methods are iNode, DHCP Character, HTTP User Agent, and MAC Address in descending order of priority. If different endpoint types are obtained for the same endpoint through multiple methods, the endpoint information obtained through the method with the highest priority is used.

¡ OS—Operating system of the endpoint.

¡ OS Obtaining Method—The operating system obtaining methods are Client, DHCP Character, HTTP User Agent, and MAC Address in descending order of priority. If different operating systems are obtained for the same endpoint through multiple methods, the endpoint information obtained through the method with the highest priority is used.

¡ Service Name—Name of the access service used by the access user on the endpoint for transparent portal authentication for the first time. The endpoint is bound with the access user and the access service. No user name and password are required when the endpoint accesses the network next time. UAM performs authentication and authorization for the access user on the endpoint by using the bound access service.

¡ Transparent Authentication—Status of transparent authentication: Enabled or Disabled. To perform transparent authentication for endpoints, make sure transparent MAC authentication is enabled in UAM service parameter settings and access service settings. For transparent portal authentication, you also need to enable transparent authentication in port group settings.

¡ Enabled/Disabled Time—Last time when one of the following events occurred:

- The endpoint is successfully correlated with an access user.

- Transparent authentication is enabled for the endpoint.

- Transparent authentication is disabled for the endpoint.

¡ Endpoint Info Conflict Time—Last time when the endpoint conflict was detected.

An endpoint conflict occurs when the endpoint information that UAM obtains for transparent authentication do not match the entry on the endpoint list. UAM generates a conflict log for the endpoint information and refreshes the endpoint list. Whether or not the endpoint can pass transparent authentication depends on the user endpoint settings. For more information, see "Configuring global system settings."

¡ DHCP Option 55—Original DHCP Option 55 information obtained by UAM. Information about the vendor, endpoint type, and OS obtained through DHCP option 55 and displayed on the Endpoint MAC Address Details page is consistent with endpoint information carried in DHCP Option 55. This field is empty if the DHCP Option 55 information is not obtained. To add this DHCP character to the system profile, click Add to Endpoint Profiling. For more information, see "Managing DHCP characters."

¡ HTTP User Agent—Original HTTP user agent information obtained by UAM. Information about the vendor, endpoint type, and OS obtained through HTTP User Agent and displayed on the Endpoint MAC Address Details page is consistent with endpoint information carried in HTTP User Agent. This field is empty if the HTTP User Agent information is not obtained. To add this HTTP user agent character to the system profile, click Add to Endpoint Profiling. For more information, see "Managing HTTP user agents."

¡ Bind Access Scenario—Access scenario the endpoint matches in an access service. If no match is found, this field displays Default Access Scenario for Access Service plus the service name. This occurs when the access service does not have any access scenarios or the endpoint does not match any access scenario in the assigned service.

¡ Endpoint State—State of the endpoint: Normal or Lost.

Importing endpoint information

Endpoint information is mappings between endpoint MAC addresses and access user accounts. Import endpoint information to perform transparent authentication for endpoint users. For more information about transparent authentication, see "Transparent portal authentication" and "Transparent MAC authentication."

To import endpoint information:

1. On the endpoint list, click Batch Import. The Batch Import page opens.

2. Click Browse next to Import File to select a .txt or.csv file that stores the endpoint information.

3. Select a column separator from the list. Options include Tab, comma (,), pound sign (#), and dollar sign ($). A .csv file must use comma (,) as the column separator.

4. Click Next. UAM analyzes the file and displays the number of columns in the list of each parameter.

5. Configure the following parameters:

¡ MAC Address—Endpoint MAC addresses. Select a column number from the list. This parameter cannot be manually specified.

¡ Account Name—Account names of access users. To import account names from the file, select a column number from the list. To specify the same account name for all endpoints, select Not Imported from the list and enter an account name. The account names must already exist in UAM. Otherwise, the import will fail. For information about adding an access user account, see "Managing ordinary access users."

¡ Endpoint Vendor—Endpoint vendors. To import endpoint vendors from the file, select a column number from the list. To specify the same vendor for all endpoints, select Not Imported from the list and enter an endpoint vendor. The endpoint vendors must already exist in UAM. Otherwise, the import will fail. For information about adding an endpoint vendor, see "Managing endpoint vendors."

¡ Endpoint Type—Endpoint types. To import endpoint types from the file, select a column number from the list. To specify the same type for all endpoints, select Not Imported from the list and enter an endpoint type. The endpoint types must already exist in UAM. Otherwise, the import will fail. For information about adding an endpoint type, see "Managing endpoint types."

¡ Endpoint OS—Endpoint OSs. To import endpoint OSs from the file, select a column number from the list. To specify the same OS for all endpoints, select Not Imported from the list and enter an endpoint OS. The endpoint OSs must already exist in UAM. Otherwise, the import will fail. For information about adding an endpoint OS, see "Managing endpoint OSs."

¡ Transparent Authentication—Status of transparent authentication for endpoints. To import status from the file, select a column number from the list. To specify the same transparent authentication status for all endpoints, select Not Imported from the list and select Enabled or Disabled.

6. Click Preview to view the expected import result. The page displays the first 10 records in the file.

7. Click OK. UAM starts to import endpoint information from the file.

8. View the import result. The operation result page displays the number of imported endpoint records and number of import failures.

If errors exists, click Download to obtain the error log about the endpoint records failed to be imported and failure reasons.

9. Click Back to return to the endpoint list.

Modifying endpoint information

Operators can modify endpoint information as needed after it is automatically generated in UAM.

To modify endpoint information:

1. On the endpoint list, click the Modify icon for an endpoint.

2. Modify the following parameters except the MAC address:

¡ Vendor—Select a vendor from the list, or enter a partial or complete vendor name. For example, enter su to shorten the list with vendors that contain su.

¡ Endpoint Type—Select a type from the list, or enter a partial or complete type. For example, enter S4 to shorten the list with types that contain S4.

¡ OS—Select an OS from the list, or enter a partial or complete OS. For example, enter And to shorten the list with OSs that contain And.

¡ Endpoint state—Select a state for the endpoint. Options are Normal and Lost. The system marks endpoints as normal after network authentication or a batch import of endpoints. When an endpoint is lost, the administrator can mark it as lost to prohibit network access from the endpoint.

3. Click OK.

Configuring transparent authentication for endpoints

You can manually enable or disable transparent authentication for specific endpoints. In user endpoint settings, you can also configure UAM to automatically disable transparent authentication for aged endpoint MAC addresses (see "Configuring global system settings").

To manually configure transparent authentication for endpoints:

1. Access the endpoint list page.

2. In the endpoint list, select one or more endpoints.

3. Click Enable Transparent Authentication or Disable Transparent Authentication.

A confirmation dialog box opens.

4. Click OK.

Associating users with an endpoint device

1. Access the endpoint list page.

2. Click the Control Access User icon for the target endpoint device. The Selected Access Users window opens.

3. Click Select. The Select Access User window opens.

4. Use the query function to search for the desired access users. The query criteria include Account Name, User Name, and User Group. You can enter a partial or complete account name or user name.

5. Select the access users to be associated with the endpoint device.

6. Click OK to return to the Selected Access Users window. The selected access users appear on the selected access users list.

7. To remove one or more selected users, select the users and click Batch Delete.

8. Click OK.

Endpoint Configuration Management provides the quick configuration deployment functions for BYOD. With this function, UAM deploys configurations to endpoints and activates the endpoint configurations. The BYOD quick deployment process varies with endpoint operating systems.

BYOD quick deployment process for iOS/OS X endpoints

1. The operator creates configuration templates for iOS/OS X endpoints in UAM.

2. The operator creates a configuration distribution policy in UAM to associate the configuration templates with user groups.

3. The iOS/OS X endpoint user opens the BYOD deployment page (http://ip:port/byod/deploy.jsf) in Safari, and then clicks Configure My iOS/OS X Device to display the authentication page.

4. The endpoint user enters the correct account name and password on the authentication page.

5. UAM verifies the credentials, locates the configuration distribution policy based on the user group, and deploys the configuration templates to the iOS/OS X endpoint.

6. The endpoint user manually installs the applicable configuration templates on iOS/OS X.

When the installation is completed, Safari automatically displays an available SSID on a BYOD deployment result page.

7. The endpoint user selects the SSID for automatic authentication and network access.

BYOD quick deployment process for Android endpoints

1. The operator creates configuration templates for Android endpoints in UAM.

2. The operator creates a configuration distribution policy in UAM to associate the configuration templates with user groups.

3. The Android endpoint user opens the BYOD deployment page (http://ip:port/byod/deploy.jsf) in the browser, and then clicks Configure My Android Device to download and install a system-defined configuration tool for Android.

UAM does not support user-defined configuration tool.

4. The endpoint user launches the configuration tool and enters the correct account name and password.

5. UAM verifies the credentials, locates the configuration distribution policy based on the user group, and deploys the configuration templates to the configuration tool.

6. The configuration tool automatically installs the applicable configuration templates on Android.

If an SCEP template is included, the endpoint user must manually confirm the installation. When the installation is completed, the browser automatically displays the BYOD deployment result page.

7. The configuration tool automatically selects an SSID for automatic authentication and network access.

BYOD quick deployment process for Windows PC endpoints

1. The operator creates configuration templates for Windows PC endpoints in UAM.

2. The operator creates a configuration distribution policy in UAM to associate the configuration templates with user groups.

3. The Windows PC endpoint user opens the BYOD deployment page (http://ip:port/byod/deploy.jsf) in the browser, and then clicks Configure My Windows Device to download and install a system-defined configuration tool for Windows PC.

UAM does not support user-defined configuration tool.

4. The endpoint user launches the configuration tool and enters the correct account name and password.

5. UAM verifies the credentials, locates the configuration distribution policy based on the user group, and deploys the configuration templates to the configuration tool.

6. The configuration tool automatically installs the applicable SCEP configuration templates on Windows PC. The endpoint user must manually confirm the installation.

7. When the installation is completed, the endpoint user performs user authentication by using the installed certificate for network access.

Configuring endpoint configuration templates

Configuration templates include configurations to be deployed to endpoints. Table 27 describes the configuration templates supported by each endpoint OS and configuration templates required for configuration distribution policies.

Table 27 Configuration template description

OS	Supported templates	Required templates
iOS/OS X	· SCEP template—Use this template to apply for a certificate for the iOS/OS X endpoint to partially encrypt the configuration templates. If Certificate Type is set to TLS for the Wi-Fi template, the SCEP template also applies for another certificate for TLS certificate authentication. · General configuration template—Use this template to provide the framework of the new description file created by UAM on the iOS/OS X endpoint. The framework includes the Wi-Fi template, password policy template, mail configuration template, and VPN configuration template. · Wi-Fi template—Use this template to configure the wireless functions on the iOS/OS X endpoint. · Password policy template—Use this template to configure the screen lock function on the iOS/OS X endpoint. · Mail configuration template—Use this template to configure a local mailbox on the iOS/OS X endpoint. Make sure the configurations in the template are the same as those on the incoming and outgoing mail servers. · VPN configuration template—Use this template to configure the VPN function on the iOS/OS X endpoint.	To configure an iOS/OS X-specific configuration distribution policy, you must select an SCEP template, a general configuration template, and at least one of the following templates: · Wi-Fi. · Password policy. · Mail configuration. · VPN configuration.
Android	· SCEP template—Use this template to apply for a certificate for TLS certificate authentication if the Certificate Type is set to TLS for the Wi-Fi template. · General configuration template—Use this template to display the license agreement during installing the configuration tool for Android. · Wi-Fi template—Use this template to configure the wireless functions on the Android endpoint. · Password policy template—Use this template to configure the screen lock function on the Android endpoint.	To configure an Android-specific configuration distribution policy, you must select the Wi-Fi template. If Certificate Type is set to TLS for the Wi-Fi template, the SCEP template is also required.
Windows PC	SCEP template—Use this template to apply for a certificate for Windows PC.	To configure a Windows PC-specific configuration distribution policy, you must select the SCEP template.

Viewing the configuration template list

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Configuration Templates.

The list includes all configuration templates.

Configuration template list contents

¡ Template Name—Name of the configuration template.

¡ Type—Type of configuration template, including the following:

- SCEP template

- General configuration template

- Wi-Fi template

- Password policy template

- Mail configuration template

- VPN configuration template

¡ iOS/OS X—Identifies whether the configuration template is supported by iOS/OS X. The template is supported if the field displays a Support icon .

¡ Android—Identifies whether the configuration template is supported by Android. The template is supported if the field displays a Support icon .

¡ Windows—Identifies whether the configuration template is supported by Windows PC. The template is supported if the field displays a Support icon .

¡ Template Description—Descriptive information about the configuration template.

¡ Modify—Click the Modify icon to modify the configuration template.

¡ Delete—Click the Delete icon to delete the configuration template.

Querying configuration templates

1. Access the configuration template list page.

2. In the Query Endpoint Configuration Templates area, specify one or more of the following query criteria:

¡ Template Name—Enter a partial or complete template name. For example, if you enter test, all template names that contain test are matched.

¡ Type—Select a template type from the list.

The query ignores empty fields.

3. Click Query.

All matching configuration templates are displayed in the configuration template list.

Click Reset to clear the query criteria and display all configuration templates in the configuration template list.

Viewing configuration template details

1. Access the configuration template list page.

2. In the configuration template list, click the name of the configuration template you want to view.

The details page contains the following parameters:

¡ Basic Information

- Template Name—Name of the configuration template.

- Template Description—Descriptive information about the configuration template.

¡ SCEP Configuration

This area is displayed only in an SCEP template.

- URL—URL of the SCEP server.

- Retry Interval (sec)—Interval between two consecutive certificate applications that are initiated by the endpoint, in seconds.

- Retry Times—Maximum number of times that the endpoint resends the certificate application if the server does not respond.

- Key Length—Length of the key used for the certificate application initiated by the endpoint, which can be 1024 bits or 2048 bits. This parameter has a lower priority than the certificate server key length. For example, if the certificate server key length is 1024 bits, the key length for the certificate application initiated by the endpoint is 1024 bits, regardless of the settings of this parameter.

¡ General Configuration Template

This area is displayed only in a general configuration template.

General Configuration Template on the iOS/OS X tab:

- Enable—Identifies whether the general configuration template is enabled in iOS/OS X. The template takes effect when Enable is selected.

- Description File Name—Name of the description file on the iOS/OS X endpoint.

- Description—Descriptive information about the description file on the iOS/OS X endpoint.

- Organization—Name of the organization to which the description file belongs. This parameter helps the endpoint user recognize the source of the description file.

- Manually Remove Description File—Identifies whether the endpoint user is allowed to manually remove the description file. This field displays Permitted if the endpoint user can manually remove the description file without providing any password. This field displays Password Authentication if the endpoint user can manually remove the description file after the user provides the correct password. This field displays Forbidden if the endpoint user cannot manually remove the description file, but the old description file can be replaced by a new one.

- Automatically Remove Description File—Identifies whether the description file can be automatically removed from the endpoint. This field displays Never if the description file cannot be automatically removed from the endpoint. This field displays User-Defined Date if the endpoint automatically removes the description file on the date specified by the Removal Date parameter. This field displays After if the endpoint will automatically remove the description file after a time period specified by the Interval parameter.

- Removal Date—Date when the endpoint automatically removes the description file. This parameter is displayed only when User-Defined Date is selected for the Automatically Remove Description File field.

- Interval—Time period after which the endpoint will automatically remove the description file. This parameter is displayed only when After is selected for the Automatically Remove Description File field.

- License Agreement—License agreement information to be confirmed by the endpoint user for installation of the description file.

General Configuration Template on the Android tab:

- Enable—Identifies whether the general configuration template takes effect. The template takes effect when Enable is selected.

- License Agreement—License agreement information to be confirmed by the endpoint user for installation of the configuration tool for Android.

¡ Wi-Fi Configuration

This area is displayed only in a Wi-Fi template.

Wi-Fi Configuration on the iOS/OS X tab:

- Enable—Identifies whether Wi-Fi is enabled in iOS/OS X. Other parameters take effect only when this parameter is selected.

- SSID—SSID to which the endpoint connects.

- Auto Join—Identifies whether the endpoint automatically connects to this SSID for future wireless connections. This parameter takes effect on the SSID that is first selected by the endpoint user from the deployed Wi-Fi template.

- Hide Network—Identifies whether the endpoint can access a hidden network whose SSID broadcasting is disabled or that has no signals.

- Security—Encryption type used for wireless network access. Options are None, WEP, WPA/WPA2, Any (Personal), and WPA/WPA2 (Enterprise). If the Any (Personal) option is selected, the endpoint automatically attempts WEP, WPA, and WPA2 for network access.

- Mode—Certificate type used for wireless network access. Options are TLS, TTLS, and PEAP. This parameter is displayed only when WPA/WPA2 (Enterprise) is selected for the Security field.

- HTTP Proxy—HTTP proxy status: None, Manual, or Auto. This field displays None when HTTP proxy is disabled. This field displays Manual if the endpoint user must configure parameters for the proxy server in the Wi-Fi template. This field displays Auto if the endpoint user needs to configure only the URL for the proxy server in the Wi-Fi template.

- Proxy Server's URL—URL of the proxy server. This parameter is displayed only when Auto is selected for the HTTP Proxy field.

- Username—User name used when the endpoint user accesses the proxy server. This parameter is displayed only when Manual is selected for the HTTP Proxy field.

- Proxy Server's IP—IP address of the proxy server. This parameter is displayed only when Manual is selected for the HTTP Proxy field.

- Proxy Server's Port—Port number of the proxy server. This parameter is displayed only when Manual is selected for the HTTP Proxy field.

Wi-Fi Configuration on the Android tab:

- Enable—Identifies whether Wi-Fi is enabled in Android. Other parameters take effect only when this parameter is selected.

- SSID—SSID to which the endpoint connects.

- Hide Network—Identifies whether the endpoint can access a hidden network whose SSID broadcasting is disabled or that has no signals.

- Security—Encryption type used for wireless network access. Options are None, WEP, WPA/WPA2 PSK, and 802.1X EAP.

- EAP Method—Certificate type used for wireless network access. Options are TLS, TTLS, and PEAP. This parameter is displayed only when 802.1X EAP is selected for the Security field.

- Phase 2 Authentication—Options are MS-CHAPv2 and GTC. This parameter is displayed only when TTLS or PEAP is selected for the EAP Method field.

- Deploy Root Certificate—Indicates whether or not to deploy the root certificate to Android endpoints. Options are Yes and No. This parameter is displayed only when 802.1X EAP is selected for the Security field and TLS or TTLS is selected for the EAP Method field.

¡ Password Policy

This area is displayed only in a password policy template.

Password Policy on the iOS/OS X tab:

- Set Screen Lock Password—Identifies whether the screen lock password is set. Other parameters take effect only when this parameter is selected.

- Allow Simple Value—Identifies whether the password can include characters in alphabetical order (for example, DEFG) and duplicate characters (for example, 3333).

- Contain Letters and Numbers—Identifies whether the password must include at least one letter and one digit.

- Minimum Length—Minimum number of characters that the password must contain.

- Minimum Special Characters—Minimum number of special characters that the password must contain. Special characters include non-digit and non-letter characters, for example, the dollar sign ($), ampersand (&), or exclamation point (!).

- Expiration Date—Lifetime of the password. The password can be changed only before the expiration date.

- Max. Password Record—Number of most recent passwords that cannot be used again.

- Screen Lock Timeout—Maximum idle time before the endpoint locks the screen, in minutes.

- Unlock Without Password—Interval in which screen unlock does not require a password.

- Max. Unlock Attempts—Maximum number of consecutive failed attempts to unlock the screen. When the maximum number is reached, the endpoint wipes all data and settings.

Password Policy on the Android tab:

- Set Screen Lock Password—Identifies whether a password policy is enabled in Android. Other parameters take effect only when this parameter is selected.

- Contain Letters and Numbers—Identifies whether the password must include at least one letter and one digit.

- Minimum Length—Minimum number of characters that the password must contain.

- Expiration Date—Lifetime of the password. The password can be changed only before the expiration date.

- Max. Password Record—Number of most recent passwords that cannot be used again.

- Screen Lock Timeout—Maximum idle time before the endpoint locks the screen, in minutes.

- Max. Unlock Attempts—Maximum number of consecutive failed attempts to unlock the screen. When the maximum number is reached, the endpoint wipes all data and settings.

¡ Mail Configuration

This area is displayed only in a mail configuration template.

General Information

- Account Description—Account description displayed on the iOS/OS X endpoint.

- Account Type—Type of the mail account: IMAP or POP.

- Support Mail Migration—Whether or not to allow mails of this account to be migrated, forwarded, or sent in reply to other accounts.

- IMAP Path Prefix—Path where the IMAP folder synchronized from Apple PCs are stored on the iOS/OS X endpoint.

- Account Name—Account name displayed on the iOS/OS X endpoint.

- Email Address—Complete email address.

Incoming Mail Server

- Mail Server Address—Domain name or IP address of the incoming mail server.

- Port—Port used by the incoming mail server to receive mails.

- Username—User name used by the iOS/OS X endpoint to access the incoming mail server.

- Authentication Type—User authentication method used by the incoming mail server. The value can be None, Password, MD5 Password Response, NTML, or HTTP MD5 Digest.

- SSL Authentication—Whether or not SSL is used to secure communication between the iOS/OS X endpoint and the incoming mail server.

Outgoing Mail Server

- Mail Server Address—Domain name or IP address of the outgoing mail server.

- Port—Port used by the outgoing mail server to send mails.

- Username—User name used by the iOS/OS X endpoint to access the outgoing mail server.

- Authentication Type—User authentication method used by the outgoing mail server. The value can be None, Password, MD5 Password Response, NTML, or HTTP MD5 Digest.

- Use the same password to send and receive mails—Whether or not to use the same password for receiving and sending mails.

- Synchronize Most Recent Addresses—Whether or not to use iCloud to synchronize and share the most recent addresses with other devices.

- Send by Email Only—Whether or not to allow mails of this account to be sent only by using the iOS/OS X Mail app.

- SSL Authentication—Whether or not SSL is used to secure communication between the iOS/OS X endpoint and the outgoing mail server.

¡ VPN Configuration

- Connection Name—Connection name to be displayed on the iOS/OS X endpoint.

- Connection Type—Connection type of the VPN. The value can be L2TP, PPTP, or IPSec (Cisco).

- Server Domain Name or IP—Domain name or IP address of the VPN server.

- Account Name—Account name used for VPN authentication.

- Account Authentication Method—Method used to authenticate the account: Password or RSA SecureID. This parameter does not appear if the VPN connection type is IPSec (Cisco).

- Send All Traffic—Whether or not to send all traffic of the iOS/OS X endpoint through the VPN connection. This parameter does not appear if the VPN connection type is IPSec (Cisco).

- Encryption Level—Encryption level of the VPN connection. The value can be None, Automatic, or Maximum (128 Bits). This parameter is displayed only when the VPN connection type is PPTP.

- Group Name—Group name of the VPN connection. This parameter is displayed only when the VPN connection type is IPSec (Cisco).

- Use Hybrid Authentication—Whether or not to use hybrid authentication for the VPN connection. Hybrid authentication involves various factors, including the shared key, group name, and certificate. This parameter is displayed only when the VPN connection type is IPSec (Cisco).

- Password Prompt on Endpoint—Whether or not to prompt the user to enter the password on the endpoint. This parameter is displayed only when the VPN connection type is IPSec (Cisco).

- Use Proxy—Whether or not to use proxy settings. The value can be No Proxy, Manual, or Automatic.

- Proxy Server's URL—URL of the proxy server. This parameter is displayed only when the Use Proxy field is set to Automatic.

- Proxy Server—IP address of the proxy server. This parameter is displayed only when the Use Proxy field is set to Manual.

- Proxy Server Port—Port used by the proxy server. This parameter is displayed only when the Use Proxy field is set to Manual.

- Proxy User—User name used to access to the proxy server. This parameter is displayed only when the Use Proxy field is set to Manual.

3. Click OK to return to the configuration template list.

Adding an SCEP template

The SCEP template is used by an endpoint to apply for a certificate.

To add an SCEP template:

1. Access the configuration template list page.

2. Click Add SCEP Template.

The Add SCEP Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template to aid maintenance.

4. In the SCEP Configuration area, configure the following parameters:

¡ URL—Enter the URL of the SCEP server.

¡ Retry Interval (sec)—Enter the interval between two consecutive certificate applications that are initiated by the endpoint, in seconds.

¡ Retry Times—Enter the maximum number of times that the endpoint resends the certificate application if the server does not respond.

¡ Key Length—Select the length of the key used for the certificate application initiated by the endpoint, which can be 1024 bits or 2048 bits. This parameter has a lower priority than the certificate server key length. For example, if the certificate server key length is 1024 bits, the key length for the certificate application initiated by the endpoint is 1024 bits, regardless of the settings of this parameter.

5. Click OK.

Adding a general configuration template for iOS/OS X

1. Access the configuration template list page.

2. Click Add General Configuration Template.

The Add General Configuration Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template to aid maintenance.

4. Click the iOS/OS X tab.

5. In the General Configuration Template area, select Enable, and then configure the following parameters:

¡ Name—Enter the name of the description file on the iOS/OS X endpoint.

¡ Description—Enter a description for the description file on the iOS/OS X endpoint.

¡ Organization—Enter the name of the organization to which the description file belongs. This parameter helps the endpoint user recognize the source of the description file.

¡ Manually Remove Description File—Select an option from the list to specify whether the endpoint user is allowed to manually remove the description file. Options are Permitted, Password Authentication, and Forbidden.

- Permitted—Permits the endpoint user to manually remove the description file without providing any password.

- Password Authentication—Permits the endpoint user to manually remove the description file after the user provides the correct password.

- Forbidden—Forbids the endpoint user from manually removing the description file. This option allows the description file to be replaced by a new one.

¡ Password/Confirm Password—Enter and confirm the password for removing the description file. This parameter is displayed only when Password Authentication is selected for the Manually Remove Description File field.

¡ Automatically Remove Description File—Select an option from the list to specify whether the endpoint is allowed to automatically remove the description file. Options are Never, User-Defined Date, and After.

- This field displays Never if the description file cannot be automatically removed from the endpoint.

- This field displays User-Defined Date if the endpoint automatically removes the description file on the date specified by the Removal Date parameter.

- This field displays After if the endpoint will automatically remove the description file after a time period specified by the Interval parameter.

¡ Removal Date—Select a date when the endpoint automatically removes the description file. This parameter is displayed only when User-Defined Date is selected for the Automatically Remove Description File field.

¡ Interval—Enter a time period after which the endpoint will automatically remove the description file. This parameter is displayed only when After is selected for the Automatically Remove Description File field.

¡ License Agreement—Enter the license agreement information to be confirmed by the endpoint user for installation of the description file.

6. Click OK.

Adding a general configuration template for Android

1. Access the configuration template list page.

2. Click Add General Configuration Template.

The Add General Configuration Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template to aid maintenance.

4. Click the Android tab.

5. In the General Configuration Template area, configure the following parameters:

¡ Enable—Select this option to make the general configuration template take effect. Other parameters take effect only when this parameter is selected.

¡ License Agreement—Enter the license agreement information to be confirmed by the endpoint user for installation of the configuration tool for Android.

6. Click OK.

Adding a Wi-Fi template for iOS/OS X

1. Access the configuration template list page.

2. Click Add Wi-Fi Template.

The Add Wi-Fi Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template to aid maintenance.

4. Click the iOS/OS X tab.

5. In the Wi-Fi Configuration area, select Enable and configure the following parameters:

¡ SSID—Enter an SSID.

¡ Auto Join—Select this option to enable the endpoint to automatically connect to an SSID for future wireless connections. This parameter takes effect on the SSID that is first selected by the endpoint user from the deployed Wi-Fi template.

¡ Hide Network—Select this option to enable the endpoint to access a hidden network whose SSID broadcasting is disabled or that has no signals.

¡ Security—Select an encryption type from the list. Options are None, WEP, WPA/WPA2, Any (Personal), and WPA/WPA2 (Enterprise). If the Any (Personal) option is selected, the endpoint automatically attempts WEP, WPA, and WPA2 for network access.

¡ Password/Confirm Password—Enter and confirm the password used for wireless network authentication. This parameter is displayed only when WEP, WPA/WPA2, or Any (Personal) is selected for the Security field.

¡ Mode—Select a certificate type used for wireless network access from the list. Options are TLS, TTLS, and PEAP. This parameter is displayed only when WPA/WPA2 (Enterprise) is selected for the Security field.

¡ HTTP Proxy—Select an HTTP proxy state from the list. Options are None, Manual, and Auto.

- This field displays None when HTTP proxy is disabled.

- This field displays Manual if the endpoint user must configure parameters for the proxy server in the Wi-Fi template.

- This field displays Auto if the endpoint user needs to configure only the URL for the proxy server in the Wi-Fi template.

¡ Proxy Server's URL—Enter a URL of the proxy server. This parameter is displayed only when Auto is selected for the HTTP Proxy field.

¡ Username—Enter the user name used when the endpoint user accesses the proxy server. This parameter is displayed only when Manual is selected for the HTTP Proxy field.

¡ Proxy Server's IP—Enter an IP address of the proxy server. This parameter is displayed only when Manual is selected for the HTTP Proxy field.

¡ Proxy Server's Port—Enter a port number of the proxy server. This parameter is displayed only when Manual is selected for the HTTP Proxy field.

¡ Password/Confirm Password—Enter the password used when the endpoint user accesses the proxy server. This parameter is displayed when Manual is selected for the HTTP Proxy field.

6. Click OK.

Adding a Wi-Fi template for Android

1. Access the configuration template list page.

2. Click Add Wi-Fi Template.

The Add Wi-Fi Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template to aid maintenance.

4. Click the Android tab.

5. In the Wi-Fi Configuration area, select Enable and configure the following parameters:

¡ SSID—Enter an SSID.

¡ Hide Network—Select this option to enable the endpoint to access a hidden network whose SSID broadcasting is disabled or that has no signals.

¡ Security—Select an encryption type from the list. Options are None, WEP, WPA/WPA2 PSK, and 802.1X EAP.

¡ Password/Confirm Password—Enter the password used for wireless network authentication. This parameter is displayed only when WEP or WPA/WPA2 PSK is selected for the Security field.

¡ EAP Method—Select a certificate type used for wireless network access from the list. Options are TLS, TTLS, and PEAP. This parameter is displayed only when 802.1X EAP is selected for the Security field.

¡ Phase 2 Authentication—Select an authentication type from the list. Options are MS-CHAPv2 and GTC. This parameter is displayed only when TTLS or PEAP is selected for the EAP Method field.

6. Click OK.

Adding a password policy template for iOS/OS X

1. Access the configuration template list page.

2. Click Add Password Policy Template.

The Add Password Policy Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template to aid maintenance.

4. Click the iOS/OS X tab.

5. In the Password Policy area, select Set Screen Lock Password and configure the following parameters:

¡ Allow Simple Value—Select Allow Simple Value if you allow the password to include characters in alphabetical order.

¡ Contain Letters and Numbers—Select Contain Letters and Numbers if you want the password to include at least one letter and one digit.

¡ Minimum Length—Enter the minimum number of characters that the password must contain.

¡ Minimum Special Characters—Select the minimum number of special characters that the password must contain from the list. Special characters include non-digit and non-letter characters, for example, the dollar sign ($), ampersand (&), or exclamation point (!).

¡ Expiration Date—Enter the lifetime of the password. The password can be changed only before the expiration date.

¡ Max. Password Record—Enter the number of most recent passwords that cannot be used again.

¡ Screen Lock Timeout—Enter the maximum idle time before the endpoint locks the screen, in minutes.

¡ Unlock Without Password—Select the interval in which screen unlock does not require a password.

¡ Max. Unlock Attempts—Select the maximum number of consecutive failed attempts to unlock the screen. When the maximum number is reached, the endpoint wipes all data and settings. After six consecutive failed attempts, the endpoint adds a delay before the next attempt. The delay grows longer after each failed attempt. When the last unlock attempt fails, the endpoint wipes all data and settings.

6. Click OK.

Adding a password policy template for Android

1. Access the configuration template list page.

2. Click Add Password Policy Template.

The Add Password Policy Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template to aid maintenance.

4. Click the Android tab.

5. In the Password Policy area, select Set Screen Lock Password and configure the following parameters:

¡ Contain Letters and Numbers—Select this option if you want the password to include at least one letter and one digit.

¡ Minimum Length—Enter the minimum number of characters that the password must contain.

¡ Expiration Date—Enter the lifetime of the password. The password can be changed only before the expiration date.

¡ Max. Password Record—Enter the number of most recent passwords that cannot be used again.

¡ Screen Lock Timeout—Enter the maximum idle time before the endpoint locks the screen.

6. Click OK.

Adding a mail configuration template

1. Access the configuration template list page.

2. Click Add Mail Configuration Template.

The Add Mail Configuration Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template.

4. In the General Information area, configure the following parameters:

¡ Account Description—Enter the account description to be displayed on the iOS/OS X endpoint.

¡ Account Type—Select the mail account type. Options are IMAP and POP.

¡ Support Mail Migration—Select this option to allow mails of this account to be migrated, forwarded, or sent in reply to other accounts.

¡ IMAP Path Prefix—To synchronize the IMAP email account configurations from Apple PCs to the iOS/OS X endpoint device, enter INBOX (upper case letters) in this field. The INBOX string is the path where the IMAP folder is stored on the iOS/OS X endpoint.

¡ Account Name—Enter the account name to be displayed on the iOS/OS X endpoint.

¡ Email Address—Enter the complete email address.

5. In the Incoming Mail Server area, configure the following parameters:

¡ Mail Server Address—Enter the domain name or IP address of the incoming mail server.

¡ Port—Enter the port number used by the incoming mail server.

¡ Username—Enter the user name used to access the incoming mail server.

¡ Authentication Type—Select the user authentication method used by the incoming mail server. Options are:

- None

- Password

- MD5 Password Response

- NTML

- HTTP MD5 Digest

¡ Password/Confirm Password—Enter and confirm the user password. These fields are invalid if None is selected for Authentication Type.

¡ SSL Authentication—Select this option to use SSL to secure communication between the iOS/OS X endpoint and the incoming mail server.

6. Configure the Outgoing Mail Server area:

¡ Mail Server Address—Enter the domain name or IP address of the outgoing mail server.

¡ Port—Enter the port number used by the outgoing mail server.

¡ Username—Enter the user name used to access the outgoing mail server.

¡ Authentication Type—Select the user authentication method used by the outgoing mail server. Options are:

- None

- Password

- MD5 Password Response

- NTML

- HTTP MD5 Digest

¡ Password/Confirm Password—Enter and confirm the user password. These fields are invalid if None is selected for Authentication Type.

¡ Use the same password to send and receive mails—Select this option if the same password is used for receiving and sending mails. This field is invalid if None is selected for Authentication Type.

¡ Synchronize Most Recent Address—Select this option to use iCloud to synchronize and share the most recent addresses with other devices.

¡ Send by Email Only—Select this option to allow mails of this account to be sent only by using the iOS/OS X Mail app.

¡ SSL Authentication—Select this option to use SSL to secure communication between the iOS/OS X endpoint and the outgoing mail server.

7. Click OK.

Adding a VPN configuration template

1. Access the configuration template list page.

2. Click Add VPN Configuration Template.

The Add VPN Configuration Template page opens.

3. In the Basic Information area, configure the following parameters:

¡ Template Name—Enter a name to uniquely identify the template.

¡ Template Description—Enter a description for the template.

4. Configure the following VPN parameters:

¡ Connection Name—Enter the connection name to be displayed on the iOS/OS X endpoint.

¡ Connection Type—Select the connection type. Options are L2TP, PPTP and IPSec(Cisco).

¡ Server Domain Name or IP—Enter the domain name of IP address of the VPN server.

¡ Send All Traffic—Select this option to send all traffic of the iOS/OS X endpoint through the VPN connection. This parameter does not appear if the VPN connection type is IPSec (Cisco).

¡ Account Name—Enter the account name used for VPN authentication.

¡ Account Authentication Method—Select the authentication method for the account. Options are Password and RSA SecureID. This parameter does not appear if the VPN connection type is IPSec (Cisco).

¡ Encryption Level—Encryption level of the VPN connection. Options are None, Automatic, and Maximum (128 Bits). This parameter is displayed only when the VPN connection type is PPTP.

¡ Group Name—Enter the group name of the VPN connection. This parameter is displayed only when the VPN connection type is IPSec (Cisco).

¡ Use Hybrid Authentication—Select this option to use hybrid authentication for the VPN connection. Hybrid authentication involves various factors, including the shared key, group name, and certificate. This option is displayed only when the VPN connection type is IPSec (Cisco).

¡ Password Prompt on Endpoint—Select this option to prompt the user to enter the password on the endpoint. This option is displayed only when the VPN connection type is IPSec (Cisco).

¡ Use Proxy—Select whether or not to use proxy settings. Options are No Proxy, Manual, and Automatic.

¡ Proxy Server's URL—Enter URL of the proxy server. This parameter is displayed only when the Use Proxy field is set to Automatic.

¡ Proxy Server—Enter the IP address of the proxy server. This parameter is displayed only when the Use Proxy field is set to Manual.

¡ Proxy Server Port—Enter the port used by the proxy server. This parameter is displayed only when the Use Proxy field is set to Manual.

¡ Proxy User—Enter the user name used to access to the proxy server. This parameter is displayed only when the Use Proxy field is set to Manual.

5. Click OK.

Modifying a configuration template

1. Access the configuration template list page.

2. Click the Modify icon for the template you want to modify.

The page for modifying the template opens.

3. Modify the template parameters. All parameters can be modified.

For more information about the parameters, see the following:

¡ "Adding an SCEP template"

¡ "Adding a general configuration template for iOS/OS X"

¡ "Adding a general configuration template for Android"

¡ "Adding a Wi-Fi template for iOS/OS X"

¡ "Adding a Wi-Fi template for Android"

¡ "Adding a password policy template for iOS/OS X"

¡ "Adding a password policy template for Android"

¡ "Adding a mail configuration template"

¡ "Adding a VPN configuration template"

4. Click OK.

Deleting a configuration template

You cannot delete configuration templates that are referenced by configuration distribution policies.

To delete a configuration template:

1. Access the configuration template list page.

2. Click the Delete icon for a template you want to delete.

A confirmation dialog box opens.

3. Click OK.

Configuring endpoint configuration distribution policies

A configuration distribution policy associates configuration templates with user groups. All users in the group can use the configuration templates for BYOD authentication.

A configuration distribution policy requires different configuration templates to be configured for the endpoint OS (see Table 27).

Viewing the configuration distribution policy list

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Configuration Distribution Policy.

The list includes all configuration distribution policies.

Configuration distribution policy list contents

¡ Policy Name—Name of the configuration distribution policy.

¡ Description—Descriptive information about the configuration distribution policy.

¡ Modify—Click the Modify icon to modify the configuration distribution policy.

¡ Delete—Click the Delete icon to delete the configuration distribution policy.

Querying configuration distribution policies

1. Access the configuration distribution policy list page.

2. In the Query Endpoint Configuration Distribution Policies area, specify one or more of the following query criteria:

¡ Policy Name—Enter a partial or complete configuration distribution policy name. For example, if you enter test, all policy names that contain test are matched.

¡ Access User—Enter a partial or complete account name. For example, if you enter jack, all access user names that contain jack are matched.

¡ User Group—Click the Select User Group icon . The Select User Group window opens. Select a user group, and then click OK.

The query ignores empty fields.

3. Click Query.

All matching configuration distribution policies are displayed in the configuration distribution policy list.

Click Reset to clear the query criteria and display all configuration distribution policies in the configuration distribution policy list.

Viewing configuration distribution policy details

1. Access the configuration distribution policy list.

2. Click the name of the configuration distribution policy you want to view.

The details page includes the following areas:

¡ Basic Information—This area displays the name and description of the configuration distribution policy.

¡ Select Endpoint Configuration Template—This area displays all configuration templates to be deployed to endpoints for BYOD authentication. For the parameter description in the area, see "Viewing the configuration template list."

¡ User Group List—The selected user groups in this area are associated with the configuration templates in the configuration distribution policy. Endpoint users in the user group can use these configuration templates for BYOD authentication.

¡ Access User List—The selected access users in this area are associated with the configuration templates in the configuration distribution policy. These users can use the configuration templates for BYOD authentication.

Adding a configuration distribution policy

1. Access the configuration distribution policy list.

2. Click Add.

The Add Endpoint Configuration Distribution Policy page opens.

3. In the Basic Information area, configure the following parameters:

¡ Policy Name—Enter the policy name, which must be unique.

¡ Description—Enter a description for the configuration distribution policy to aid maintenance.

4. In the Select Endpoint Configuration Template area, select one or more configuration templates for the configuration distribution policy.

a. In the Select Endpoint Configuration Template area, click Add.

The Select Configuration Template page opens.

b. Select one of the following tabs:

- SCEP

- General Configuration

- Wi-Fi

- Password Policy

- Mail Configuration

- VPN Configuration

The list includes all the configuration templates of the selected type.

c. Enter a partial or complete template name in the Template Name field, and then click Query.

All matching templates are displayed in the template list.

d. Click the Add icon for a template to add it to the configuration distribution policy. The Add icon is not displayed after you add the configuration template to the distribution policy.

e. Click OK.

f. Click the Delete icon to remove undesired configuration templates.

5. In the User Group List area, select user groups to be associated with configuration templates.

You can select any user groups that are not selected by other configuration distribution policies.

To make the configuration distribution policy effective on all subgroups of the selected user groups, select The father and child groups are automatically selected when you select a user group.

6. In the Access User List area, select the access users to use the configuration templates. You can select any access users who are not configured to use the configuration templates in other configuration distribution policies.

a. Click Select. The Select Access User window opens.

b. Use the query function to search for the desired access users.

c. Select one or more access users in the access user list.

d. Click OK.

IMPORTANT:

If an access user and the user group it belongs to are assigned to different configuration templates, the configuration template assigned to the access user takes effect.

7. Click OK.

Modifying a configuration distribution policy

1. Access the configuration distribution policy list page.

2. Click the Modify icon for the configuration distribution policy you want to modify.

The page for modifying the configuration distribution policy opens.

3. Modify parameters as needed. For more information, see "Adding a configuration distribution policy."

4. Click OK.

Deleting a configuration distribution policy

1. Access the configuration distribution policy list page.

2. Click the Delete icon for the configuration distribution policy you want to delete.

A confirmation dialog box opens.

3. Click OK.

Managing endpoint configuration tools

UAM provides configuration tools for BYOD authentication on Android and Windows PC endpoints. Endpoint users can download configuration tools from the BYOD authentication page.

With configuration tools, endpoints automatically obtain the configuration templates for BYOD authentication, which are associated with the user groups of the access users.

Configuration tools cannot be modified or deleted. UAM does not support user-defined configuration tools.

Managing the endpoint configuration history

UAM stores history records for endpoint configuration deployment.

Viewing the configuration history list

1. Click the User tab.

2. From the navigation tree, select User Endpoint > Endpoint Configuration History.

The list includes all configuration history records.

Endpoint Configuration History List contents

¡ Account Name—Account name of the access user for endpoint authentication. After the authentication, the endpoint user gets configuration templates from UAM and then uses the configuration templates.

¡ Login Name—User name included in the RADIUS authentication request sent by the access device for authentication.

¡ Endpoint Type—Type of the endpoint, including iOS/OS X, Android, and Windows PC.

¡ Assigned At—Time when UAM deployed configuration templates.

¡ Details—Click the Details icon to view configuration history details.

Querying configuration history records

1. Access the Endpoint Configuration History page.

2. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name. For example, if you enter acc, all account names that contain acc are matched.

¡ Time Range From/To—Specify the time range in which UAM deployed configuration templates. You can click the Calendar icon to select the time, or enter the time in YYYY-MM-DD hh:mm format.

The query ignores empty fields.

3. Click Query.

All matching configuration history records are displayed in the configuration history list.

Click Reset to clear the query criteria and display all configuration history records in the configuration history list.

Viewing configuration history details

1. Access the Endpoint Configuration History page.

2. In the Endpoint Configuration History List area, click the Details icon for the history record you want to view.

The details page includes the following parameters:

¡ Account Name—Account name of the access user used for endpoint authentication. After the authentication, the endpoint user gets configuration templates from UAM and then uses the configuration templates.

¡ Login Name—User name included in the RADIUS authentication request sent by the access device for authentication.

¡ Endpoint Type—Type of the endpoint: iOS/OS X, Android, or Windows PC.

¡ Assigned At—Time when UAM deployed configuration templates to the endpoint.

¡ Description—Deployed contents and result.

Configuring access devices

An access device provides Internet access for users. When users try to access the Internet, the access device controls user network behaviors.

Access device configuration tasks

1. Adding and configuring access devices.

Administrators add access devices to UAM so that they can cooperate with UAM for user authentication. UAM supports deploying authentication settings, including AAA configuration, authentication port configuration, and commands to access devices.

2. Configuring access device types.

Administrators define access device vendors, types, and proprietary RADIUS attributes in UAM. With the configuration, UAM can better control access users who connect to access devices of different vendors.

3. Configuring proprietary attribute assignment policies.

Administrators can define when to assign proprietary attributes and their attribute values.

A proprietary attribute assignment policy works in the following way:

a. The administrator defines proprietary attribute assignment policies in UAM.

b. The administrator assigns the proprietary attribute assignment policies to different access scenarios in a service.

c. When authenticating an access user, UAM determines the access scenario for the user, and sends the proprietary attributes and values contained in the matching proprietary attribute assignment policy to the access device at proper time.

d. The access device uses the proprietary attributes and values to control user access.

Configuring access devices

Access devices cooperate with UAM to authenticate and authorize users. Add IPv4 and IPv6 devices to UAM as access devices to exchange RADIUS packets with UAM.

The two types of access devices are:

· Standard—Standard access devices can use all UAM functions, because they support both standard RADIUS attributes and HP-extended RADIUS attributes.

· Special—Special access devices support partial UAM functions. They may support some of the standard RADIUS attributes, and may not support the HP-extended RADIUS attributes. However, special access devices support other vendor-specific proprietary RADIUS attributes.

Most Cisco devices are special access devices.

To enable special access devices to use more UAM functions, add vendor-specific proprietary attributes to UAM. For more information, see "Configuring access device types."

Accessing the access device list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Device Management > Access Device.

The list includes all access devices.

Access device list contents

¡ Device Name—Device label, which links to the device details page. If the IMC platform manages the access device, this field is the same as the Device Label parameter on the IMC platform. If the access device is manually added to UAM without being managed by the IMC platform, this field is empty.

¡ Device IP—IPv4 or IPv6 address of the device. If the IMC platform manages the access device, this field displays the management IP address of the device. If the access device is manually added to UAM without being managed by the IMC platform, this field displays the IP address manually entered.

¡ Device Model—Device vendor and model. If the IMC platform manages the access device, this field is the same as the Device Model parameter on the IMC platform. If the access device is manually added to UAM without being managed by the IMC platform, this field is empty.

¡ Configuration Type—This field is automatically populated with the type of device configuration that can be deployed to the access device: H3C Wired, H3C Wireless, or HP Wired. An empty field indicates that UAM cannot deploy any configuration to the device. IMC read this parameter of the access device when it was added to the IMC platform.

¡ Access Location Group—An access condition that is used to classify endpoint users. For more information about access location groups, see "Configuring access location groups"

¡ Remarks—Remarks of the access device for easy identification.

¡ Deploy Result—Last deploy result on the access device. This field is valid only for devices of the H3C wired, H3C wireless, and HP wired configuration types. This field displays Not Deployed when UAM has not deployed any configuration to the device. This field displays Deploying AAA/Port/Command Configuration when UAM is deploying configurations to the device.

¡ Port Synchronization Result—Last port configuration synchronization result on the access device. You must synchronize the port configuration of an access device to UAM before deploying port configurations to the device. This field is valid only for devices of the H3C wired, H3C wireless, and HP wired configuration types. If the device is not a switch, UAM does not deploy port configurations to the device and displays No Sync Needed in this field.

¡ Details—Click the Details icon to view detailed information about the access device. For more information, see "Viewing access device details."

¡ Operation—Click the Operation icon to display the operation menu. The operation menu provides the User Gateway link and Deploy Configuration link. Click the User Gateway link to display the User Gateway List page. For more information, see "Configuring ARP spoofing attack protection." Click the Deploy Configuration link to display the Deploy Configuration page. For more information, see "Deploying configurations to access devices." The Deploy Configuration link is displayed only for devices of the H3C wired, H3C wireless, and HP wired configuration types.

Querying access devices

UAM provides basic query and advanced query for access devices.

· Basic query criteria include several key parameters for quick search.

· Advanced query offers various query criteria for precise match.

Basic query

1. Access the access device list page.

2. Click Basic Query in the upper-right corner of the page.

If Advanced Query is displayed in the upper-right corner of the page, you are already in basic query mode.

3. In the Query Access Devices area, specify one or more of the following query criteria:

¡ Device IP Address Range From/To—Enter an IPv4 address range in which the access device is located. Enter complete IPv4 addresses.

¡ Device Name—Enter a partial or complete name of the access device. For example, if you enter lab, all access device names that contain lab are matched.

¡ Access Device Type—Select a system-defined or user-defined access device type from the list.

The query ignores empty fields.

4. Click Query. The list shows all access devices that match the query criteria.

5. Click Reset to clear the query criteria. The list shows all access devices in UAM.

Advanced query

1. Access the access device list page.

2. Click Advanced Query in the upper-right corner of the page.

If Basic Query is displayed in the upper-right corner of the page, you are already in advanced query mode.

3. In the Query Access Devices area, specify one or more of the following query criteria:

¡ Device IP Address Range From/To—Enter an IPv4 address range in which the access device is located. Enter complete IPv4 addresses.

¡ Device Name—Enter a partial or complete name of the access device. For example, if you enter lab, all access device names that contain lab are matched.

¡ Access Device Type—Select a system-defined or user-defined access device type from the list.

¡ Service Group—Select a service group to which the access device belongs from the list.

¡ Last Deployed from/to—Enter the time range when UAM last deployed configurations to the access device, or click the Calendar icon to select the time range. The date and time settings must be in YYYY-MM-DD hh:mm format.

¡ Last Synchronized from/to—Enter the time range when UAM last synchronized the port configuration from the access device, or click the Calendar icon to select the time range. The date and time settings must be in YYYY-MM-DD hh:mm format.

¡ Last Deploy Result—Select the last deploy result from the list. Options are Deployed, Deploy Failed, Not Deployed, and Deploying.

¡ Last Synchronization Result—Select the last synchronization result on the access device from the list. Options are Failed, Succeeded, Not Synchronized, Synchronizing, and No Sync Needed.

¡ Configuration Type—Select the type of device configuration that can be deployed to the access device. Options are H3C Wired, H3C Wireless, and HP Wired.

¡ Device IPv6—Enter a complete IPv6 address or an IPv6 address in compressed format.

¡ Remarks—Enter a partial or complete remark for the access device. For example, if you enter lab, all remarks that contain lab are matched.

The query ignores empty fields.

4. Click Query. The list shows all access devices that match the query criteria.

5. Click Reset to clear the query criteria. The list shows all access devices in UAM.

Viewing access device details

You can view detailed information about an access device only after it is added to the IMC platform.

To view detailed information about an access device:

1. Access the access device list page.

Click the name of the access device whose detailed information you want to view.

The Access Device Details page opens.

For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide.

Viewing the access device configuration

1. Access the access device list page.

2. Click the Details icon for the access device whose configuration you want to view.

The Access Device Configuration Details page opens.

Access Device Configuration Details

¡ Device Name—Device label. If the access device is managed by the IMC platform, this field is the same as the Device Label parameter on the IMC platform. If the access device is manually added to UAM without being managed by the IMC platform, this field is empty.

¡ Device IP—IPv4 or IPv6 address of the access device. If the access device is managed by the IMC platform, this field displays the management IP address of the device. If the access device is manually added to UAM without being managed by the IMC platform, this field displays the IP address manually entered.

¡ Access Location Group—Access location group to which the access device belongs. For more information, see "Configuring access location groups."

¡ Authentication Port—Port to which UAM listens for RADIUS authentication packets. The value must be the same as what is configured on the access device in the CLI.

¡ Accounting Port—Port to which UAM listens for RADIUS accounting packets. The value must be the same as what is configured on the access device in the CLI.

¡ Service Type—Type of services supported by the access device. Valid service types can be LAN Access Service, which is used by users for network access, and Device Management Service, which is used by administrators for device management.

¡ Forcible Logout Type—Type that the access device forces users to log out. Valid forcible logout types include Disconnect user and Shut down and bring up port. Disconnect user disconnects user connections through disconnect messages. Shut down and bring up port logs out users by shutting down the port connecting to them, and then brings up the port after the users are logged out.

¡ Access Device Type—Access device vendor and type. Predefined access device types include STANDARD (Standard), H3C (General), 3COM (General), HUAWEI (General), CISCO (General), RG (General), HP (MSM), HP (Comware), HP (ProCurve), MICROSOFT (General), and JUNIPER (General). The administrator can set user-defined types. For more information, see "Configuring access device types."

¡ Shared Key—Shared key used by the access device and UAM to authenticate each other. The value must be the same as what is configured on the access device in the CLI.

¡ Service Group—Service group to which the access device belongs.

¡ Last Deployed at—Time when UAM last attempted to deploy configurations to the access device. This field is empty when UAM has not deployed any configuration to the device.

¡ Deploy Result—Last deploy result on the access device. This field is valid only for devices of the H3C wired, H3C wireless, and HP wired configuration types. This field displays Not Deployed when UAM has not deployed any configuration to the device. This field displays Deploying when UAM is deploying configurations to the device.

¡ Deploy Failure Reason—Reason why the last configuration deploy attempt failed. This field is empty if the last configuration deployment is successful.

¡ Last Synchronized at—Time when UAM last attempted to synchronize port configuration from the access device. This field is empty when UAM has never synchronized port configuration from the device.

¡ Port Synchronization Result—Last port configuration synchronization result on the access device. You must synchronize the port configuration of an access device to UAM before deploying port configurations to the device. This field is valid only for devices of the H3C wired, H3C wireless, and HP wired configuration types. If the access device is not a switch, UAM does not deploy port configurations to the device and displays No Sync Needed.

¡ Synchronization Failure Reason—Reason why the last synchronization attempt failed. This field is empty if the last synchronization operation is successful.

¡ Configuration Type—This field is automatically populated with the type of device configuration that can be deployed to the access device: H3C Wired, H3C Wireless, or HP Wired. An empty field indicates that UAM cannot deploy any configurations to the access device. IMC read this parameter of the access device when it was added to the IMC platform.

3. To return to the access device list page, click Back.

Setting whether to select devices from the IMC platform

Above the access device list, click the Add from iMC Only link to set whether access devices must be selected from the IMC platform for manual adding.

· When Add from iMC Only: Yes is displayed, only the access devices that already exist in the IMC platform can be manually added to the access device list.

· When Add from iMC Only: No is displayed, access devices can be manually added to the list whether they exist in the IMC platform or not.

Adding access devices

Adding an access device

1. Access the access device list page.

2. Click Add.

The Add Access Device page opens.

3. Configure the following common parameters in the Access Configuration area:

¡ Authentication Port—Enter the port to which UAM listens for RADIUS authentication packets. The port must be the same as what is configured on the access device in the CLI.

¡ Accounting Port—Enter the port to which UAM listens for RADIUS accounting packets. The value must be the same as what is configured on the access device in the CLI.

¡ Service Type—Select a service type from the list, which can be Unlimited or Device Management Service. The LAN access service is used for network access. The device management service is used for the administrator to log in to and manage devices. For more information, see "Configuring device management users."

¡ Access Device Type—Select an access device type from the list. The type can be standard, predefined in UAM, or user-defined by the administrator. You can select STANDARD(Standard) for devices that support standard RADIUS protocols. Predefined access device types include H3C (General), 3COM (General), HUAWEI (General), CISCO (General), RG (General), HP (MSM), HP (Comware), HP (ProCurve), MICROSOFT (General), and JUNIPER (General). For more information, see "Configuring access device types."

¡ Forcible Logout Type—Select a type for the access device to forcibly log out users, which can be Disconnect user or Shut down and bring up port. If Disconnect user is selected, the UAM server sends disconnect messages (DMs) to the NAS device to log out users. If Shut down and bring up port is selected, the UAM server sends Change-of-Authorization (CoA) messages to the NAS device to log out users. Upon receiving CoA messages, the NAS device first shuts down the port connecting to the users, and then brings up the port after the users are logged out.

¡ Service Group—Select a service group to which the access device belongs. You can organize access devices into different service groups for distributed management.

¡ Shared Key—Enter a shared key, a string of 1 to 128 characters. The shared key is used for the access device and UAM to authenticate each other. The value must be the same as what is configured on the access device in the CLI.

¡ Confirm Shared Key—Enter the same shared key as the value in the Shared Key field.

¡ Access Location Group—Select the access location group to which you want to add the access device. If you do not want to add the device to any access location group, select two hyphens (--) from the list. For more information, see "Configuring access location groups."

4. Select devices from the IMC platform. You can perform any combination of step 4, step 5, and step 6 as needed.

a. Click Select in the Device List.

The Select Devices page opens.

b. Select devices by view or by advanced query.

Selecting devices by view

Click the By View tab. The view options include IP View, Device View, and Custom View.

Click of one view from which you want to select devices to expand the view, and then click a subview. All the devices in the subview appear in the Devices Found list on the right.

To add one or more devices from the Devices Found list to the Selected Devices list, select the devices and click the Add Selected icon .

To add all the found devices to the Selected Devices list, click the Add all icon .

To remove one or more devices from the Selected Devices list, select the devices and click the Remove Selected icon .

To remove all the devices from the Selected Devices list, click the Remove all icon .

Selecting devices by advanced query

Click the Advanced tab.

Specify one or more of the following query criteria:

¡ Device IP —Enter an IPv4 address. If you select Exact Query, enter a complete IPv4 address. If Exact Query is not selected, enter a portion of an IP address. For example, if you enter 192, all IP addresses that contain 192 are matched.

¡ Device Label—Enter a partial or complete name. For example, if you enter lab, all device labels that contain lab are matched.

¡ Device Status—Select a device status from the list.

¡ Device Category—Select a device category from the list.

¡ Device Series—Select a device series from the list.

¡ Contact—Enter partial or complete contact information by which you want to search. For example, if you enter street, all contacts that contain street are matched.

¡ Location—Enter partial or complete location information by which you want to search. For example, if you enter office, all locations that contain office are matched.

¡ Device Reachability—Select an option from the list: Reachable or Unreachable.

The query ignores empty fields.

Click Query. All the devices matching the query criteria appear in the Devices Found list on the right.

To add one or more devices from the Devices Found list to the Selected Devices list, select the devices and click the Add Selected icon .

To add all the found devices to the Selected Devices list, click the Add all icon .

To remove one or more devices from the Selected Devices list, select the devices and click the Remove Selected icon .

To remove all the devices from the Selected Devices list, click the Remove all icon .

c. Click OK to return to the page for adding access devices. The added devices appear in Device List.

d. Click Clear All in Device List to remove all the devices from the device list. You can click the Delete icon for a single device to delete it.

5. Manually add an IPv4 device. You can perform any combination of step 4, step 5, and step 6 as needed.

Make sure the device to be added already exists in the IMC platform if the Add from iMC Only setting is Yes.

To manually add an IPv4 device:

a. Click Add Manually in the Device List area.

b. Enter a completer IPv4 address of the device.

c. Enter the device name.

d. Enter the device model.

e. Enter the remarks of the access device to facilitate maintenance.

f. Click OK to return to the page for adding access devices. The added device is displayed in the Device List.

g. Click Clear All in the Device List area to remove all the devices from the device list. You can click the Delete icon for a single device to delete it.

6. Manually add IPv6 devices. You can perform any combination of step 4, step 5, and step 6 as needed.

Make sure the devices to be added already exist in the IMC platform if the Add from iMC Only setting is Yes.

To manually add IPv6 devices:

a. Click Add IPv6 Dev in the Device List area.

b. Enter a complete IPv6 address or an IPv6 address in compressed format in the Start IPv6 Address field. The field does not support a partial IPv6 address. The parameter specifies the first IPv6 device to be added to UAM.

c. Enter a value in the IPv6 Address Span field. The parameter specifies the total number of IPv6 devices to be added to UAM. UAM then adds the IPv6 devices in ascending order of their IP addresses with the first device specified by the Start IPv6 Address parameter.

d. Enter a partial or complete remark of the access device to facilitate maintenance.

e. Click OK to return to the page for adding access devices. The added devices are displayed in the Device List.

f. Click Clear All in the Device List area to remove all the devices, or click the Delete icon for a device to delete it.

7. Click OK.

The configuration result page opens. In this page, you can continue to configure ACLs, add access devices, or go back to the access device list. The Configure ACL link displays only after you deploy an ACL management component. Click the Add Access Device link to continue adding access devices. Click the Back to Access Device List link to view the added access devices in the Access Device List. Click the Configure ACL link to configure ACLs for the access devices.

8. Configure ACLs.

a. Click the Configure ACL link. The page displays a list of devices that support ACLs and one that do not support ACLs.

b. Click Next.

The page for selecting ACLs opens.

c. Select one or more ACLs that already exist in the ACL management component in the ACL resource list.

d. Click Next.

e. Deploy ACLs in the ACLs to Deploy list.

ACLs to Deploy list contents

- Duplicate Name—Checks whether or not an ACL with the same name already exists on the device. This parameter helps the administrator determine the deployment strategy to use.

- Device Compatible—Whether or not the access device supports the ACL to be deployed.

- Deploy Strategy—Includes Not Deploy, Add, and Append. Select Not Deploy for an access device that does not support the ACL to be deployed. Select Add for an access device that does not have an ACL of the same name configured and supports the ACL to be deployed. Select Not Deploy or Append for an access device that has an ACL of the same name configured and supports the ACL to be deployed.

f. Click Deploy.

A confirmation dialog box opens.

g. Click OK.

For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide.

Adding an MSM teamed controller

When an MSM teamed controller is added to the IMC platform or WSM, it is identified by the virtual IP address. To add the controller to UAM, you must specify the physical IP address of the controller. Do not add MSM teamed controllers by selecting from the IMC platform.

Make sure the MSM teamed controllers to be manually added already exist in the IMC platform if the Add from iMC Only setting is Yes.

To manually add MSM teamed controllers to UAM:

1. Access the access device list page.

2. Click Add.

The Add Access Device page opens.

3. Configure the following parameters (see "Adding an access device" for parameter descriptions):

¡ Authentication Port and Accounting Port

¡ Service Type

¡ Access Device Type

¡ Access Location Group

¡ Shared Key and Confirm Shared Key

¡ Service Group

4. Click Add Manually, enter a controller IP address (the master or a member MSM teamed controller), and click OK.

5. Repeat step 4 to add all member controllers.

6. On the Add Access Device page, click OK.

Bulk importing access devices

When the Limited to Platform Devices option is enabled for bulk import, make sure the access devices being imported have been added to the IMC platform.

To bulk import access devices:

1. Access the device list page.

2. Click Batch Import.

The Import Access Devices page opens.

3. Click Browse to select a file that stores the access device information.

UAM supports importing only a .txt or .csv file.

4. Select the column separator from the list. Options include Space, TAB, comma (,), colon (:), pound sign (#), and dollar sign ($). A .csv file must use the comma (,) as the column separator.

5. Select IPv4 or IPv6 for Device IP Version.

This parameter is required when you select Yes for Enable IPv6.

6. Click Next.

UAM parses the file and displays the number of columns in the list next to the parameters that support importing values.

7. Configure the following parameters:

¡ Device IP—IP address of the access device. This parameter must be read from the file. Select a column number in the file as the device IP address.

¡ Authentication Port—Port to which UAM listens for RADIUS authentication packets. This parameter can be either read from the file or manually specified. You can select a column number in the file, or select Not Imported and enter a port number for all imported access devices.

¡ Accounting Port—Port to which UAM listens for RADIUS accounting packets. This parameter can be either read from the file or manually specified. You can select a column number in the file, or select Not Imported and enter a port number for all imported access devices.

¡ Shared Key—Shared key used by the access device and UAM to authenticate each other. This parameter can be either read from the file or manually specified. You can select a column number in the file, or select Not Imported and enter a key for all imported access devices.

¡ Service Type—Service type supported by the access device. This parameter cannot be read from the file. Select LAN Access Service, which is used by users for network access, or Device Management Service, which is used by administrators for device management. The parameter setting applies to all imported access devices.

¡ Forcible Logout Type—Type that the access device forces users to log out. This parameter cannot be read from the file. Select Disconnect user, which disconnects user connections through disconnect messages, or select Shut down and bring up port, which logs out users by shutting down the port connecting to them, and then brings up the port after the users are logged out.

¡ Access Device Type—Type of the access device. This parameter cannot be read from the file. Select a type from the list for all imported access devices.

The list includes predefined and user-defined device types. Predefined access device types include STANDARD (Standard), H3C (General), 3COM (General), HUAWEI (General), CISCO (General), RG (General), HP (MSM), HP (Comware), HP (ProCurve), MICROSOFT (General), and JUNIPER (General). For information about configuring user-defined access device types, see "Configuring access device types."

¡ Service Group—Service group to which the access device is assigned for distributed management. This parameter cannot be read from the file. Select a group name from the list for all imported access devices.

¡ Access Location Group—Access location group to which the access device is assigned. This parameter cannot be read from the file. Select a group name from the list for all imported access devices. If you select two consecutive hyphens (--), the imported access devices are not assigned to any access location group. For more information, see "Configuring access location groups."

¡ Device Name—Name of the access device. This parameter can be either read from the imported file or manually specified. You can select a column number in the file, or select Not Imported and enter a device name for all imported access devices.

¡ Device Model—Model of the access device. This parameter can be either read from the imported file or manually specified. You can select a column number in the file, or select Not Imported and enter a device model for all imported access devices.

¡ Comments—Comments of the access device to facilitate maintenance. This parameter can be either read from the imported file or manually specified. You can select a column number in the file, or select Not Imported and enter a value for all imported access devices.

8. Click OK. UAM starts to import the access devices.

After the import is completed, the operation result page opens, showing the number of successfully imported devices and the number of failures. If import failures occur, click Download to check the failure reason.

Modifying access devices

1. Access the access device list page.

2. Select one or more access devices you want to modify.

3. Click Modify.

The Modify Access Device page opens.

4. Modify the Access Configuration settings of the access devices. If one device is selected, you can modify all settings. If multiple devices are selected, you cannot modify Access Location Group and User Group. For more information, see "Adding access devices."

5. On the Device List, modify the remarks of the access devices.

6. Click OK.

Deleting access devices

1. Access the access device list page.

2. Select one or more access devices you want to delete.

3. Click Delete.

A confirmation dialog box opens.

Synchronizing port configurations on access devices

To ensure successful configuration deployment, synchronize existing port states and configurations on access devices before deploying authentication port configuration to devices.

To synchronize existing port configurations on access devices:

1. Access the access device list page.

2. Select one or more devices for which you want to synchronize port states and configurations. Make sure the selected devices are the H3C wired, H3C wireless, or HP wired configuration type. Devices that have an empty Configuration Type column do not support port synchronization.

3. Click Sync Ports.

UAM starts to synchronize port configurations on the selected devices. Wait a few minutes while the port configurations are being synchronized.

4. Click Refresh.

The access device list page refreshes and displays the latest port synchronization results. If an access device has a failed synchronization result, click the Details icon for the access device to view the failure reason.

Deploying configurations to access devices

UAM provides the configuration deployment feature to promptly deliver AAA configuration, authentication port configuration, and commands to the access devices.

As a best practice, use the following deployment procedures:

1. Deploy AAA configurations to most access devices in batches, so the devices have the same RADIUS, domain, and global 802.1X and MAC authentication settings. If some access devices require different AAA configurations, deploy their respective AAA configurations separately.

2. Deploy authentication port configurations to each access device, including 802.1X and MAC authentication settings. Authentication port configurations cannot be deployed in batches, because the number of ports, port numbering, and authentication ports on devices can vary largely.

3. Deploy other commands to access devices in batches or separately.

AAA configuration and command deployment is supported only on devices of the H3C wired, H3C wireless, and HP wired configuration types. The AAA parameters to be deployed vary with the configuration types.

Authentication port configuration deployment is supported only on switches of the H3C and HP wired configuration types. Port parameters to be deployed vary with the configuration types.

Accessing the batch deployment page

To access the page for deploying AAA configurations or commands to access devices in batches:

1. Access the access device list page.

2. Select the devices to which you want to deploy configurations. Make sure all selected devices have the same configuration type: H3C Wired, H3C Wireless, or HP Wired.

3. Click Deploy and select AAA Configuration or Commands.

The AAA Configuration or Commands page opens.

Accessing the individual deployment page

To access the page for deploying configuration to a single access device:

1. Access the access device list page.

2. Click the Operation icon for the target device, and then select Deploy Configuration from the operation menu. The Operation icon is displayed only when the device is the H3C wired, H3C wireless, or HP wired configuration type.

The Deploy Configuration page opens.

3. Click the icon in the Deploy Configuration column for AAA Configuration, Port Authentication Configuration, or Commands.

The AAA Configuration, Port Authentication Configuration, or Commands page opens.

Deploying AAA configuration to H3C wired devices

1. Access the AAA Configuration page.

2. In the Basic Information area, configure the following parameters:

¡ Accounting Update Interval—Enter the interval at which the devices send accounting update packets to the RADIUS server, in minutes. The default setting is 12 minutes. If the number of online users is large, set the interval to 18 minutes as a best practice.

¡ Secondary RADIUS Server—Select this option to configure a secondary RADIUS server for the devices.

¡ Server IP Address—Enter the IP address of the secondary RADIUS server for the devices. This field becomes valid only when the Secondary RADIUS Server option is selected.

3. Configure parameters in the Authentication Information area. This area does not appear on the individual deployment page for a router. In batch deployment, this area is always displayed. However, UAM does not deploy the authentication parameters to any selected routers.

The authentication parameters include:

¡ 802.1X Authentication—Select this option to enable global 802.1X authentication on the devices.

¡ MAC Authentication—Select this option to enable global MAC authentication on the devices. When this option is selected, configure a domain for MAC authentication in the Service Suffix area.

¡ 802.1X Authentication Mode—Select the protocol to use for 802.1X authentication. Options are EAP, PAP, and CHAP. To support all UAM and EAD functions, select EAP.

¡ MAC Authentication Format—Select the format of the user name to use for MAC authentication. Options are Unchanged and Lower-case letters without separators. Select Unchanged if you want the devices to send the user name in the original format. Select Lower-case letters without separators if you want the devices to change the user name to lowercase and remove all separators in it.

¡ URL Redirect—Enter the redirect URL for HTTP access. The Web page specified by the URL is pushed to the user who attempts to access a non-authentication-free network in the browser without passing 802.1X authentication.

¡ Free IP/Mask—Enter the authentication-free network segments and their respective mask length or subnet masks in dotted decimal notation. UAM supports at most four network segments, one per line.

4. Configure domain information:

a. In the Service Suffix area, click Add.

The Service Suffix page opens.

b. Configure the following parameters:

- Domain Name—Enter the name of the domain you want to create on the devices.

- Service Suffix—This field is automatically populated with the domain name. If the domain is used for 802.1X authentication, the domain name is included in the authentication packets.

- No Suffix—Select this option to clear the Service Suffix field. When the domain with this option selected is used for 802.1X authentication, authentication packets do not include any domain information.

- Default Domain—Select this option to set the domain as the default domain on the devices. All users who do not contain domain names in the user names are authenticated in the default domain.

- MAC Authentication Domain —Select this option to use the domain for MAC authentication.

c. Click OK.

The Service Suffix page closes and the domain entry is displayed in the Service Suffix area.

d. Repeat the previous steps to add more domains.

e. To modify a domain, click the Modify icon for that domain.

f. To delete a domain, click the Delete icon for that domain.

5. Click Deploy.

A confirmation dialog box opens.

6. Click OK.

UAM starts to deploy AAA configuration to the devices and displays the deployment progress and results.

Deploying AAA configuration to H3C wireless devices

1. Access the AAA Configuration page.

2. In the Basic Information area, configure the following parameters:

¡ Secondary RADIUS Server—Select this option to configure a secondary RADIUS server for the devices.

¡ Server IP Address—Enter the IP address of the secondary RADIUS server for the devices. This field becomes valid only when the Secondary RADIUS Server option is selected.

¡ Enable Port Security—Select this option to enable the wireless port security function and disable global 802.1X and MAC authentication. By default, the wireless port security function is disabled.

3. Configure domain information:

a. In the Service Suffix area, click Add.

The Service Suffix page opens.

b. Configure the following parameters:

- Domain Name—Enter the name of the domain you want to create on the devices.

- Service Suffix—This field is automatically populated with the domain name. If the domain is used for 802.1X authentication, the domain name is included in the authentication packets.

- Default Domain—Select this option to set the domain as the default domain on the devices. All users who do not contain domain names in the user names are authenticated in the default domain.

- MAC Authentication Domain—Select this option to use the domain for MAC authentication.

c. Click OK.

The Service Suffix page closes and the domain entry is displayed in the Service Suffix area.

d. Repeat the previous steps to add more domains.

e. To modify a domain, click the Modify icon for that domain.

f. To delete a domain, click the Delete icon for that domain.

4. Click Deploy.

A confirmation dialog box opens.

5. Click OK.

UAM starts to deploy AAA configuration to the selected devices and displays the deployment progress and results.

Deploying AAA configuration to HP wired devices

1. Access the AAA Configuration page.

2. Configure the following parameters:

¡ 802.1X Authentication—Select this option to enable global 802.1X authentication on the devices.

¡ 802.1X Authentication Mode—Select the protocol to use for 802.1X authentication. Options are EAP, PAP, and CHAP. To support all UAM and EAD functions, select EAP.

3. Click Deploy.

A confirmation dialog box opens.

4. Click OK.

UAM starts to deploy AAA configuration to the devices and displays the deployment progress and results.

NOTE:

After deploying AAA configuration to the HP wired devices, execute the radius-server host ip-address dyn-authorization command to deploy authorization ACLs and VLANs, and then execute the radius-server host ip-address time-window time-window value command to log off users.

Deploying authentication port configuration to an H3C or HP switch

Complete the following tasks before you configure and deploy authentication settings for the ports on an H3C or HP switch:

· Synchronize port configuration from the switch. For more information, see "Synchronizing port configurations on access devices."

· Check the authentication methods supported on the switch. Some H3C switches do not support both 802.1X and MAC authentication methods enabled on the same interface. Some HP switches do not support two or more authentication methods (802.1X, MAC, and HTML) enabled on the same interface.

To deploy authentication port configuration to the switch:

1. Access the Port Authentication Configuration page.

The page displays port configuration synchronized from the selected switch, including the interface status (Up or Down), alias, description, and authentication information.

2. Select interfaces and configure the following parameters for each interface:

¡ 802.1X Authentication—Select this option to enable 802.1X authentication on the interface.

¡ 802.1X Guest VLAN—Enter the ID of the VLAN that users can access when they have not passed 802.1X authentication. Typically, servers that provide authentication client installation and update services are located in the VLAN. This field does not appear for an HP switch.

¡ Client Protection Against Cracks—Select this option to enable client anti-crack function on the interface. For more information about this function, see "Configuring client anti-crack." This field does not appear for an HP switch.

¡ MAC Authentication—Select this option to enable MAC authentication on the interface.

¡ MAC Guest VLAN—Enter the ID of the VLAN that users can access when they have not passed MAC authentication. This field does not appear for an HP switch.

¡ HTML Authentication—Select this option to enable HTML authentication on the interface. This field does not appear for an H3C switch.

3. Click Deploy.

A confirmation dialog box opens.

4. Click OK.

UAM starts to deploy authentication port configuration to the switch and displays the deployment progress and results.

Deploying commands to access devices

1. Access the Commands page.

2. Enter commands in the Command Lines box, one command per line. The first command for entering system view is optional, because UAM automatically enters system view of the devices to deploy commands.

3. Click Deploy.

A confirmation dialog box opens.

4. Click OK.

UAM starts to deploy authentication port configuration to the devices and displays the deployment progress and results.

Viewing configuration deployment results

You can view configuration deployment results for an access device in any of the following methods:

· To view the batch deployment results, click the AAA Deploy Result or Command Deploy Result link on the upper right of the access device list. The links appear only when UAM has completed successful batch deployment.

· To view the deployment result of an access device, enter the Deploy Configuration page. The page displays time, status, and failure reason for the deployment contents. For information about accessing the page, see "Accessing the individual deployment page."

· The Deploy Configuration page also provides the following functions:

¡ To view the most recent deployment process, click the icon in the View Deploy Process column for AAA Configuration, Port Authentication Configuration, or Commands. UAM displays all CLI command output on the device in the Complete Deploy Process windows.

¡ To view the most recent deployment contents, click the icon in the View Configuration column for AAA Configuration, Port Authentication Configuration, or Commands.

· To view brief deployment result of an access device, enter the device configuration page. For more information, see "Viewing the access device configuration."

Configuring ARP spoofing attack protection

The ARP spoofing attack protection function applies only to IPv4 access devices of the device type H3C(General), 3COM(General), HUAWEI(General), or HP(Comware).

ARP spoofing attack protection on UAM uses the following workflow:

1. The UAM administrator associates the IP-to-MAC address mappings of the main gateways with access devices. Each access device associates with one IP-to-MAC address mapping.

2. UAM sends the appropriate IP-to-MAC address mapping to a user when the user passes authentication through an access device.

3. The user PC adds the IP-to-MAC mapping to the ARP table.

Accessing the User Gateway List page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Device Management > Access Device.

The list includes all access devices.

3. Click the Operation icon for an IPv4 device in the access device list to display the operation menu.

4. Select User Gateway from the operation menu.

The list includes all user gateways.

User Gateway List contents

¡ IP Address—IP address of the gateway.

¡ MAC Address—MAC address of the gateway.

¡ Description—Description of the gateway.

¡ Modify—Click the Modify icon to modify the settings of the user gateway.

Adding user gateway configuration

1. Access the User Gateway List page.

2. Click Add in the User Gateway List area.

The Add User Gateway page opens.

3. Configure the following parameters for the user gateway:

¡ IP Address—Enter the IP address of a gateway. Enter a complete IP address, excluding 255.255.255.255, 0.0.0.0/8, 127.0.0.0/8, and 224.0.0.0 through 239.255.255.255.

¡ MAC Address—Enter the MAC address of a gateway, in the format of XXXX-XXXX-XXXX, XX-XX-XX-XX-XX-XX, or XX:XX:XX:XX:XX:XX, excluding 00-00-00-00-00-00, FF-FF-FF-FF-FF-FF, and 01-XX-XX-XX-XX-XX.

¡ Description—Enter the detailed gateway information for easy maintenance.

4. Click OK.

Modifying user gateway configuration

1. Access the User Gateway List page.

2. Click the Modify icon for the user gateway you want to modify.

The page for modifying the user gateway opens.

3. Modify the settings of the user gateway.

For more information, see "Adding user gateway configuration."

Deleting user gateway configuration

1. Access the User Gateway List page.

2. Select one or more user gateway IP addresses you want to delete.

3. Click Delete in the User Gateway List area.

4. Click OK.

Configuring access device types

UAM supports both predefined and user-defined access device types.

· Predefined access device types—Includes H3C (General), 3COM (General), HUAWEI (General), CISCO (General), RG (General), HP (MSM), HP (Comware), HP (ProCurve), MICROSOFT (General), and JUNIPER (General). Predefined access device types cannot be modified or deleted.

· User-defined access device types—UAM allows you to configure user-defined access device types and configure the RADIUS attributes for every single access device. With proper configuration, access devices that are not included in the predefined types can work with UAM.

Accessing the Access Device Type List page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Device Management > Access Device Type.

The list includes all the access device types.

Access Device Type List contents

¡ Vendor Name—Name of the device vendor.

¡ Short Name—Short name of the device vendor.

¡ Device Type—Type of the device, which differentiates between devices that are of the same vendor but support different RADIUS attributes.

¡ Vendor ID—ID of the device vendor, which is assigned by the Institute of Electrical and Electronics Engineers (IEEE).

¡ Description—Description of the access device.

¡ Priority—Priority of the access device type. Access device types are sorted in descending order of the priority in the Access Device Type List.

¡ Details—Click the Details icon to view detailed information about the device type. This field does not appear for an H3C (General), 3COM (General), or HP (Comware) device type.

¡ Proprietary Attribute—Click the Proprietary Attribute icon for the access device type to configure proprietary attributes. This field does not appear for an H3C (General), 3COM (General), or HP (Comware) device type.

¡ Modify—Click the Modify icon to modify the settings of the device type. A predefined device type does not have this icon.

¡ Delete—Click the Delete icon to delete the device type. A predefined device type does not have this icon.

Viewing access device type details

You can view detailed information about an access device type except the following: H3C (General), 3COM (General), and HP (Comware).

To view access device type details:

1. Access the Access Device Type List page.

2. Click the Details icon for the device type whose detailed information you want to view.

The Access Device Type Details page opens.

The page contains a basic information area and the list of proprietary RADIUS attributes that the administrator defines for the access device type.

Basic Information

¡ Vendor Name—Name of the device vendor.

¡ Short Name—Short name of the device vendor.

¡ Vendor ID—IEEE-assigned device vendor ID.

¡ Device Type—Type of the device, which differentiates between devices that are of the same vendor but support different RADIUS attributes.

¡ Description—Description of the access device type.

Proprietary Attribute List

¡ ID—ID of the proprietary RADIUS attribute.

¡ Name—Name of the proprietary RADIUS attribute.

¡ Type—Type of the proprietary RADIUS attribute. Options are String Type, Unsigned Integer, Time, and IPv4 address.

¡ Description—Description of the proprietary RADIUS attribute.

Adding an access device type

1. Access the Access Device Type List page.

2. Click Add in the Access Device Type List area.

3. Configure the following basic information parameters:

¡ Vendor Name—Enter the name of the device vendor.

¡ Short Name—Enter the short name of the device vendor. The parameter is displayed when you view the access device in UAM.

¡ Vendor ID—Enter the IEEE-assigned device vendor ID.

¡ Device Type—Enter the access device type. You can use the default value General. Configure the devices types only when you want to differentiate access devices that are of the same vendor but support different RADIUS attributes.

¡ Description—Enter a description for the access device type for easy maintenance.

4. Click OK.

Modifying an access device type

You cannot modify a predefined access device type.

To modify an access device type:

1. Access the Access Device Type List page.

2. Click the Modify icon for the device type whose settings you want to modify.

3. Modify the settings of the access device type.

For more information, see "Adding an access device type."

Deleting an access device type

You cannot delete a predefined access device type.

To delete an access device type:

1. Access the Access Device Type List page.

2. Click the Delete icon for the device type you want to delete.

A confirmation dialog box opens.

3. Click OK.

Modifying the priority of an access device type

When you add or modify access devices, the Access Device Type list displays items in the same order as they are organized in the access device type list page.

To modify the priority of an access device type:

1. Access the Access Device Type List page.

2. Modify the priority of an access device type:

¡ To raise the priority of a device type, click the Move up icon .

The device type moves up one position in the list.

¡ To lower the priority, click the Move down icon .

The device type moves down one position in the list.

The device type at the top of the list has the highest priority and the Move up icon of the device type is unavailable. The device type at the bottom of the list has the lowest priority and the Move down icon of the device type is unavailable.

Configuring the Proprietary Attribute List

1. Access the Access Device Type List page.

2. Click the Configure icon in the Proprietary Attribute column of an access device type.

3. Add a proprietary attribute to the Proprietary Attribute List:

a. Click Add in the Proprietary Attribute List area.

The page for adding a proprietary attribute opens.

b. Configure the following parameters:

- Name—Enter the name of the proprietary RADIUS attribute.

- ID—Enter the ID of the proprietary RADIUS attribute. Each access device type has a unique proprietary attribute ID to support a specific function.

- Type—Select a type of the proprietary RADIUS attribute. Options include String Type, Unsigned Integer, Time, and IPv4 address. Each access device type has a unique proprietary attribute type to support a specific function.

- Max. Length—Enter the maximum length of the proprietary RADIUS attribute. This field is available only when the attribute type is String Type.

- Max. Value—Enter the maximum value of the proprietary RADIUS attribute. This field is available only when the attribute type is Unsigned Integer.

- Description—Enter the description of the proprietary RADIUS attribute for easy maintenance.

c. Click OK.

4. To modify a proprietary attribute, click the Modify icon for the proprietary attribute, and then modify the proprietary attribute parameters.

5. To delete a proprietary attribute:

a. Click the Delete icon of the proprietary attribute.

A confirmation dialog box opens.

b. Click OK.

6. Click Back to return to the Access Device Type List page.

You cannot configure the Proprietary Attribute List for the following access device types:

· H3C (General)

· 3 COM (General)

· HP (Comware)

You can modify only the ID and description of a proprietary attribute. Deleting a proprietary attribute also deletes data in the related proprietary attribute assignment policies. For more information, see "Configuring proprietary attribute assignment policies."

Configuring proprietary attribute assignment policies

A proprietary attribute assignment policy defines when to assign certain proprietary attributes and their values.

Proprietary attribute assignment policy workflow

1. The administrator defines proprietary attribute assignment policies in UAM.

2. The administrator assigns the proprietary attribute assignment policies to different access scenarios in a service.

3. When authenticating an access user, UAM checks the access scenario the user matches to find the corresponding attribute assignment policy, and sends the proprietary attributes and values contained in the policy to the access device at a specified time.

4. The access device uses the proprietary attributes and values to control user access.

Accessing the Proprietary Attribute Assignment Policy List page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Access Device Management > Proprietary Attribute.

The list includes all the proprietary attribute assignment policies.

Proprietary Attribute List contents

¡ Policy Name—Unique name of the proprietary attribute assignment policy.

¡ Service Group—Service group to which the proprietary attribute assignment policy belongs.

¡ Description—Description of the proprietary attribute assignment policy.

¡ Modify—Click the Modify iconto modify the settings of the proprietary attribute assignment policy.

¡ Delete—Click the Delete icon to delete the proprietary attribute assignment policy.

Viewing proprietary attribute assignment policy details

1. Access the Proprietary Attribute List page.

2. Click the name of the proprietary attribute assignment policy whose detailed information you want to view.

The Access Policy Details page opens.

Basic information

¡ Policy Name—Unique name of the proprietary attribute assignment policy.

¡ Service Group—Service group to which the proprietary attribute assignment policy belongs.

¡ Description—Description of the proprietary attribute assignment policy.

Attribute List contents

The proprietary attributes are grouped into sub-lists based on the access device types. Each sub-list displays the name of the access device type in the upper right corner.

¡ Attribute Name—Name of the proprietary RADIUS attribute.

¡ Attribute Type—Type of the proprietary RADIUS attribute.

¡ Description—Description of the proprietary RADIUS attribute.

¡ Attribute Value—Packet type and value of the proprietary RADIUS attribute.

Adding a proprietary attribute assignment policy

1. Access the Proprietary Attribute List page.

2. Click Add in the Proprietary Attribute List area.

The Add Policy page opens.

3. Configure the following basic information parameters:

¡ Policy Name—Enter the unique name of the proprietary attribute assignment policy.

¡ Service Group—Select the service group to which the proprietary attribute assignment policy belongs. Options include Ungrouped and other existing service groups in UAM.

¡ Description—Enter a description of the proprietary attribute assignment policy for easy maintenance.

4. Add proprietary attributes:

a. Click Add in the Attribute List area.

b. Specify one or more of the following query criteria in the Select Attribute area:

- Attribute Name—Enter a partial or complete name of a proprietary RADIUS attribute. For example, if you enter lab, all attribute names that contain lab are matched.

- Access Device Type—Select an access device type from the list. The type can be predefined in UAM or user-defined by the administrator.

- Attribute ID—Enter the ID of a proprietary RADIUS attribute. Enter the complete ID of an attribute.

- Description—Enter a partial or complete description of a proprietary RADIUS attribute. For example, if you enter access, all descriptions that contain access are matched.

The query ignores empty fields.

c. Click Query.

The list includes all proprietary attributes matching the query criteria.

To clear the query criteria, click Clear Results. The list includes all the attributes.

d. Select one or more attributes in the Attribute List.

e. Click OK.

You automatically return to the page for adding proprietary attribute assignment policies.

f. Set the time to assign a proprietary attribute and the attribute value to be assigned by using one or more of the following methods:

- To assign the proprietary attribute and its value in the Authentication-Success packet, select the Access-Accept box and set a value in Attribute Value.

- To assign the proprietary attribute and its value in the Authentication-Reject packet, select the Access-Reject box and set a value in Attribute Value.

- To assign the proprietary attribute and its value in the Accounting-Response packet, select the Accounting-Response box and set a value in Attribute Value.

g. If you do not want to assign a proprietary attribute, clear the boxes of Access-Accept, Access-Reject, and Accounting-Response.

h. Click the Delete icon of an undesired proprietary attribute in the Delete column to delete the attribute.

5. Click OK.

Modifying a proprietary attribute assignment policy

1. Access the Proprietary Attribute Assignment Policy List page.

2. Click the Modify icon for the proprietary attribute assignment policy you want to modify.

The Modify Policy page opens.

3. Modify parameters for the proprietary attribute assignment policy except Policy Name and Service Group.

For more information, see "Adding a proprietary attribute assignment policy."

4. Click OK.

Deleting a proprietary attribute assignment policy

Before deleting a proprietary attribute assignment policy that is used by a service, cancel the association of the service with the policy. For more information, see "Configuring access services."

To delete a proprietary attribute assignment policy:

1. Access the Proprietary Attribute Assignment Policy List page.

2. Click the Delete icon for the proprietary attribute assignment policy you want to delete.

A confirmation dialog box opens.

3. Click OK.

Configuring portal authentication

Portal authentication provides authentication and authorization for users based on Web pages. UAM offers extended portal authentication based on a single webpage, iNode DC, and iNode PC client, and displays different login pages according to port groups, SSIDs, and endpoint operating systems.

After you configure portal functions in UAM, portal authentication works without affecting other access control methods, such as 802.1X authentication.

Configuring UAM as the portal server

Configure UAM as the portal server to receive and process portal authentication packets from users.

Configuring the portal server

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Portal Service > Server.

3. Configure the following basic information:

¡ Log Level—Select a log level for UAM to record from the list. Valid log levels include Debugging, Info, Warning, Error, and Fatal, in the ascending order of severity.

- If you select Fatal, UAM records logs of the fatal level only.

- If you select Error, UAM records logs of fatal and error levels.

- If you select Warning, UAM records logs of fatal, error, and warning levels.

- If you select Info, UAM records logs of fatal, error, warning, and information levels.

- If you select Debugging, UAM records logs of all levels, including log output and debugging information. The debugging option would greatly consume system resources, and is not recommended for general use. The default log level is Info.

4. Configure the portal server:

¡ Request Timeout—Enter the timeout time of the request sent by the portal server to a portal device.

¡ Server Heartbeat Interval—Enter the interval at which the portal server sends a server heartbeat packet to the portal device.

- The portal server sends a server heartbeat packet to the portal device at certain intervals (specified by the Server Heartbeat Interval parameter). If receiving no server heartbeat packet within an interval, the portal device considers the portal server failed and changes the authentication mode to the fail-open mode. In the fail-open mode, the portal device allows all users to access the Internet without authentication.

- If the portal device receives a server heartbeat packet in the fail-open mode, the device considers that the portal server recovers and restores to the authentication mode.

This function is effective only when it is enabled on both the portal server and the portal device. To enable server heartbeat on the portal server, select Yes for Support Server Heartbeat on the page for adding or modifying a portal device in UAM and configure server heartbeat at CLI on the portal device. The commands for enabling server heartbeat on a portal device vary with the portal device model.

¡ User Heartbeat Interval—Enter the interval at which the portal server sends a user heartbeat packet to the portal device.

- User heartbeat packets are used for maintaining user status on the portal server and portal device. The portal server sends a user heartbeat packet to the portal device at certain intervals (specified by the User Heartbeat Interval parameter). Users that exist on both the server and the access device can stay online, whereas other users are logged out. This function is effective only when it is enabled on both the portal server and the portal device.

- To enable user heartbeat on the portal server, select Yes for Support User Heartbeat on the page for adding or modifying a portal device in UAM and configure user heartbeat at CLI on the portal device. The commands for enabling user heartbeat on a portal device vary with the portal device model.

5. Configure portal Web parameters:

¡ Request Timeout—Enter the timeout time of the request sent from portal Web to the portal server.

¡ Packet Code—Enter the packet code for packet exchange between portal Web and the portal server. Typically, use the default setting.

¡ Verify Endpoint Requests—Select whether or not to verify the headers of endpoint requests. If this option is selected, UAM discards HTTP requests sent by plug-ins to reduce the pressure of portal Web.

¡ Use Cache—Select whether to use cache to push page information to users. If Use Cache is selected, users can use cached webpages to reduce the pressure of portal Web. The cached webpages might not be the latest. If Use Cache is not selected, users always get the latest pages, but this function adds additional pressure to portal Web.

¡ HTTP Heartbeat Display—Select the page to display HTTP heartbeat:

- New Page—Displays HTTP heartbeat in a new page.

- Original Page—Displays HTTP heartbeat in the portal login page.

¡ HTTPS Heartbeat Display—Select the page to display HTTPS heartbeat:

- New Page—Displays HTTPS heartbeat in a new page.

- Original Page—Displays HTTPS heartbeat in the portal login page.

¡ Portal Page—Displays the paths of portal login pages. Each path corresponds to a portal server. The portal page that an access device uses depends on the portal URL configured in the command lines of the access device.

6. Configure advanced information. Only the service type configuration is available.

TIP:

You must enter a character string of service suffix for portal authentication, which might be difficult to remember. To solve this problem, you can configure a service type to represent the service suffix. The service type is displayed in the service type list on the portal login page or portal Web authentication page.

Configuring a service type

1. Access the Service page.

2. Click Add in the Service Type List area.

3. Enter the service type ID. This parameter must be the same as the service suffix.

4. Enter the service type.

The service type is displayed in the service type list on the portal login page or portal Web authentication page. If you select the service type set in this page from the list, users use the service corresponding to the previously configured service suffix.

5. Select the Default Service Type box to configure the service type as the default service type.

The service type is displayed as the default service type in the service type list box on the portal login page. If you add several service types without setting the default service type, no default service type is displayed on the service type list.

6. Click OK.

7. To delete a service type, click the Delete icon for the service type.

8. Click OK.

Configuring IP address groups

An IP address group together with the port group of a portal device jointly determines the accessible network range for users.

The following workflow applies:

1. The administrator assigns the network-wide users into multiple IP address groups according to the network diagram, user distribution, and portal device configuration (NAT or IP address reallocation for example).

2. The administrator assigns ports to several port groups on the portal device and binds port groups to the IP address groups.

3. When receiving a network access request, UAM checks the IP address group-to-port group bindings, and allows the user to pass authentication only when the IP address of the user belongs to the IP address group that is bound to the port.

Accessing the IP Group List Page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Portal Service > IP Group.

The list includes all IP address groups.

The IP group list contains all IPv4 and IPv6 address groups. An IP group can be an IPv4 address group or an IPv6 address group. For an IPv4 address group, the Start IPv6 address and End IPv6 Address fields in the list are empty. For an IPv6 address group, the Start IP, End IP, Action, After-action Start IP, and After-action End IP fields in the list are empty.

IP group list contents

¡ IP Group Name—Name of an IP address group, which must be unique in UAM.

¡ Service Group—Service group that an IP address group belongs to.

¡ Start IP—Start IPv4 address in an IP address group.

¡ End IP—End IPv4 address in an IP address group.

¡ Action—Type of an IP address group, which can be Normal, NAT, or Reallocate IP.

- The NAT option is applicable to the network that has a NAT gateway between private portal devices and a public portal server.

- The Normal option is applicable to other network scenarios.

¡ After-action Start IP—Does not exist for Normal action. Displays the start IP address of the NATed IP segment for the NAT action, or displays the start IP address of the reallocated IP segment for the Reallocate IP action.

¡ After-action End IP—Does not exist for Normal action. Displays the end IP address on the NATed IP segment for the NAT action, or displays the end IP address of the reallocated IP segment for the Reallocate IP action.

¡ Start IPv6 Address—Start IPv6 address in an IP address group.

¡ End IPv6 Address—End IPv6 address in an IP address group.

¡ Modify—Provides the Modify icon to display the page for modifying an IP address group.

¡ Delete—Provides the Delete icon to delete an IP address group.

Querying IP address groups

1. Access the IP Group List page.

2. In the Query IP Groups area, specify one or more of the following query criteria:

¡ IP Group Name—Enter a partial or complete name of an IP group. For example, if you enter a, all group names that contain a are matched.

¡ Service Group—Select a service group that an IP address group belongs to.

¡ IP Address—Enter a complete IPv4 or IPv6 address. An IP address group is matched if the group contains the IPv4 or IPv6 address.

¡ After-action IP—Enter a NATed or reallocated IPv4 address. An IP address group is matched if the group contains the IPv4 address. You must enter a complete IPv4 address in the field.

The query ignores empty fields.

3. Click Query.

The list includes all IP address groups matching the query criteria.

4. To clear all the query fields, click Reset.

The list includes all IP address groups.

Viewing IP address group details

1. Access the IP Group List page.

2. In the IP Group List area, click the name for the IP address group whose details you want to view.

The IP Group Details page opens.

IP address group parameters

¡ IP Group Name—Name of the IP address group.

¡ Service Group—Service group that the IP address group belongs to.

¡ Start IP—Start IPv4 or IPv6 address in the IP address group.

¡ End IP—End IPv4 or IPv6 address in the IP address group.

¡ Action—Type of the IP address group. It can be Normal, NAT, or Reallocate IP for an IPv4 address group, and it can only be Normal for an IPv6 address group.

- The NAT option is applicable to the network that has a NAT gateway between private portal devices and a public portal server.

- The Normal option is applicable to other network scenarios.

¡ After-action Start IP—Displays the start NATed IP address on an IP segment for the NAT action, or displays the start reallocated IP address on an IP segment for the Reallocate IP action.

¡ After-action End IP—Displays the end NATed IP address on an IP segment for the NAT action, or displays the end reallocated IP address on an IP segment for the Reallocate IP action.

¡ Device Name Using the IP Group—Names of the portal devices that are using the IP address group. If the IP address group is not used by any portal device, this field displays Currently the IP group is not in use.

Adding an IP address group

1. Access the IP Group List page.

2. Click Add in the IP Group List area.

3. Configure the following parameters for an IP address group:

¡ IP Group Name—Enter the name of an IP address group, which must be unique in UAM.

¡ IPv6—Select Yes to configure the IP address group as an IPv6 address group or select No to configure the IP address group as an IPv4 address group. If you select Yes, you only need to configure Start IP, End IP, and Service Group.

¡ Start IP—Enter the start IPv4 or IPv6 address in an IP address group. You must enter a complete IPv4 address. You can enter a complete IPv6 address or an IPv6 address in compressed format.

¡ End IP—Enter the end IPv4 or IPv6 address in an IP address group. You must enter a complete IPv4 address. You can enter a complete IPv6 address or an IPv6 address in compressed format. The start IP address cannot be higher than the end IP address.

¡ Service Group—Select the service group that an IP address group belongs to, which can be Ungrouped or an existing service group in UAM.

¡ Action—Select the type of an IP address group, which can be Normal, NAT, or Reallocate IP. This parameter is displayed only when you select No for the IPv6 parameter.

- The NAT option is applicable to the network that has a NAT gateway between private portal devices and a public portal server.

- The Reallocate IP option is applicable when portal devices are configured with IP address reallocation. IP address reallocation enables a portal device to assign IP addresses from different network segments to the same user in pre- and post-authentication phases. Do not select Reallocate IP as the action if the user portal authentication is performed based on a single webpage only.

- The Normal option is applicable to other network scenarios.

¡ After-action Start IP—Enter the start IP address of a NATed IP segment when the Action is NAT, or enter the start IP address of a reallocated IP segment when the Action is Reallocate IP.

¡ After-action End IP—Enter the end IP address on a NATed IP segment when the Action is NAT, or enter the end reallocated IP address on a reallocated IP segment when the Action is Reallocate IP. The start NATed or reallocated IP address cannot be greater than the end NATed or reallocated IP address.

4. Click OK.

Modifying an IP address group

1. Access the IP Group List page.

2. In the IP Group List area, click the Modify icon for the IP address group you want to modify.

3. Modify the parameters for the IP address group.

The IP Group Name, IPv6, Service Group, and Action parameters cannot be modified. For more information, see "Adding an IP address group."

4. Click OK.

Deleting an IP address group

1. Access the IP Group List page.

2. In the IP Group List area, click the Delete icon for the IP address group you want to delete.

¡ Device Description—Description of the portal device.

3. Click OK.

You cannot delete an IP address group that is being used by portal devices.

Configuring portal devices

Portal devices cooperate with the portal server to perform portal authentication for users. You can add devices that perform portal authentication to UAM as portal devices, so that UAM can work with the portal devices to authenticate users.

UAM allows you to deploy portal authentication configurations to portal devices and to view the deployment process and result.

Accessing the device list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > Portal Service > Device.

The list displays all portal devices.

Device list contents

¡ Device Name—Name of the portal device. Click the name of the device to view its details.

¡ Version—Version of the portal protocol running on the portal device.

¡ Service Group—Service group to which the portal device belongs.

¡ IP Address—IPv4 address of the portal device.

¡ IPv6 Address—IPv6 address of the portal device.

¡ Last Deployed at—Time when configurations were last deployed to the portal device. This field is blank if UAM has never deployed configurations to the portal device.

¡ Deploy Result—Result of the last deployment: Succeeded, Failed, Not Deployed, or Deploying.

¡ Operation—This column contains the following icons:

- Port Group—Click the Port Group icon to view the port group list.

- Deploy Configuration—Click the Deploy Configuration icon to display the deploy configuration page.

- View Deployed Configuration—Click the View Deployed Configuration icon to view the deployed configuration. This icon does not appear if UAM has never deployed configurations to the portal device.

- View Deploy Process—Click the View Deploy Process icon to view the deploy process. This icon does not appear if UAM has never deployed configurations to the portal device.

- Modify—Click the Modify icon to modify settings of the portal device.

- Delete—Click the Delete icon to delete the portal device.

Querying portal devices

1. Access the device list page.

2. In the Query Devices area, specify one or more of the following query criteria:

¡ Device Name—Enter a partial or complete name of a portal device. For example, if you enter a, all portal device names that contain a are matched.

¡ Version—Select a portal protocol version from the list. The portal version can be Portal 2.0 or Portal 3.0.

¡ Deploy Result—Select a result for the last deployment: Succeeded, Failed, Not Deployed, or Deploying.

¡ Service Group—Select a service group that a portal device belongs to, which can be Ungrouped or an existing service group in UAM.

The query ignores empty fields.

3. Click Query.

The device list includes all portal devices matching the query criteria.

4. To clear the query criteria, click Reset.

The device list includes all the portal devices.

Viewing portal device details

1. Access the device list page.

2. Click the name of the device whose details you want to view.

The Device Details page of the portal device opens.

Device details parameters

¡ Device Name—Name of the portal device.

¡ Service Group—Service group to which the portal device belongs.

¡ Version—Version of the portal protocol running on the portal device.

¡ IP Address—IPv4 or IPv6 address of the portal device.

¡ Listening Port—Port number to which UAM listens for portal packets sent from the portal server. The value defaults to 2000.

¡ Local Challenge—Value Yes indicates that the portal device can create local challenge in CHAP authentication. The value No indicates that the portal server sends challenge requests to the portal server in CHAP authentication. UAM does not support local challenge values on portal devices, and the value must be No.

¡ Authentication Retries—Number of authentication requests that the portal server re-sends to the portal device when a request timed out. The portal server considers a request timeout occurs if it cannot receive a reply from the portal device within a specified period of time after the request was sent.

¡ Logout Retries—Number of logout requests that the portal server re-sends to the portal device when a request timed out. The portal server considers a request timeout occurs if it cannot receive a reply from the portal device within a specified period of time after the request was sent.

¡ Support Server Heartbeat—Whether or not UAM enables server heartbeat for the portal device. For more information, see "Configuring UAM as the portal server."

- If the portal device receives a server heartbeat packet in the fail-open mode, the device considers that the portal server recovers and restores to the authentication mode.

This function is effective only when it is enabled on both the portal server and the portal device. To enable server heartbeat on the portal server, select Yes for Support Server Heartbeat on the page for adding or modifying a portal device in UAM and configure server heartbeat at the CLI on the portal device. The commands for enabling server heartbeat on a portal device vary with the portal device model.

¡ Support User Heartbeat—Whether or not UAM enables user heartbeat for the portal device. For more information, see "Configuring UAM as the portal server."

- User heartbeat packets are used for maintaining user status on the portal server and portal device. The portal server sends a user heartbeat packet to the portal device at certain intervals (specified by the User Heartbeat Interval parameter). Users that exist on both the server and the access device can keep online, whereas other users are logged out. This function is effective only when it is enabled on both the portal server and the portal device.

¡ Key—Key used for the portal device and UAM to authenticate each other.

¡ Access Method—Can be Directly Connected, Layer 3, or Reallocate IP. Directly Connected indicates that no Layer 3 devices exist between the portal device and endpoint users. Layer 3 indicates that Layer 3 devices exist between the portal device and endpoint users. Reallocate IP indicates that IP address reallocation is enabled on the portal device.

¡ DHCP Request Retransmit Delay—Available only when the Access Method parameter is Reallocate IP. When a user passes portal authentication and obtains a public IP address, it notifies the portal server of the successful IP address acquisition. The value of this parameter is the time that the portal server waits for the notification after the portal device re-allocates an IP address to the user. The total waiting time equals the product of the DHCP request retransmit delay by the DHCP request retransmit times.

¡ DHCP Request Retransmit Times—Available only when the Access Method parameter is Reallocate IP. If a user who passed portal authentication does not obtain a public IP address, the user retries to obtain an IP address. The value of this parameter is the number of times that the user retries to obtain an IP address.

¡ Last Deployed at—Time when configurations were last deployed to the portal device. This field is empty when UAM has not deployed any configuration to the device.

¡ Deploy Result—Result of the last deployment: Succeeded, Failed, Not Deployed, or Deploying.

¡ Deployment Failure Reason—Displays the cause of a failed deployment. This parameter is left blank for other deployment results.

Adding a portal device

1. Access the device list page.

2. Click Add.

The page for adding a portal device opens.

3. Configure the following parameters:

¡ Device Name—Enter the name of the portal device. The name must be unique in UAM.

¡ Service Group—Select a service group to which the portal device belongs.

¡ Version—Select a portal protocol version from the list. The portal version can be Portal 2.0 or Portal 3.0. Portal 2.0 does not support IPv6. If you enter an IPv6 address in the IP Address field, you must select Portal 3.0.

¡ IP Address—Enter the IP address of the portal device. If the protocol version is Portal 2.0, enter an IPv4 address. If the protocol version is Portal 3.0, enter an IPv6 address. The portal device uses the IP address to communicate with the portal server. For HP Comware devices, the value of the field must be that of the interface that connects the portal device to the user. On the network that has a NAT gateway between private portal devices and a public portal server, the value of the field must be the NATed IP address. You cannot enter the IP address of an existing portal device.

¡ Listening Port—Enter the port number to which UAM listens for portal packets sent from the portal server. The value defaults to 2000 and does not need to be modified.

¡ Local Challenge—Select Yes or No from the list to enable or disable local challenge. Select Yes for the portal device to create local challenge in CHAP authentication or select No for the portal server to send challenge requests to the portal device in CHAP authentication. You can only select No.

¡ Authentication Retries—Enter the number of authentication requests that the portal server re-sends to the portal device when a request timed out. The portal server considers a request timeout occurs if it cannot receive a reply from the portal device within a specified period of time after the request was sent.

¡ Logout Retries—Enter the number of logout requests that the portal server re-sends to the portal device when a request timed out. The portal server considers a request timeout occurs if it cannot receive a reply from the portal device within a specified period of time after the request was sent.

¡ Support Server Heartbeat—Select Yes or No to enable or disable server heartbeat for the portal device. For more information, see "Configuring UAM as the portal server."

¡ Support User Heartbeat—Select Yes or No to enable or disable user heartbeat for the portal device. For more information, see "Configuring UAM as the portal server."

¡ Key—Enter a key, which is used for the portal device and UAM to authenticate each other. The value must be the same as what is configured on the portal device in the CLI.

¡ Confirm Key—Enter the same key as the value in the Key field.

¡ Access Method—Select Directly Connected (if no Layer 3 devices exist between the portal device and endpoint users), Layer 3 (if Layer 3 devices exist between the portal device and endpoint users), or Reallocate IP (to enable IP address reallocation on the portal device). The value must be the same as what is configured on the portal device.

IP address reallocation typically applies to LAN users, such as campus, community, and company network users. The portal device allocates a private IP address to a LAN user for the user to access LAN resources, and performs portal authentication if the user attempts to access the external network. If the user passes authentication, the portal device re-allocates a public IP address to the user.

¡ DHCP Request Retransmit Delay—Enter the time that the portal server waits for a notification of successful IP address acquisition. When a user passes portal authentication and obtains a public IP address, it notifies the portal server of the successful IP address acquisition. The total waiting time equals the product of the DHCP request retransmit delay by the DHCP request retransmit times. This field is displayed only when the value of Access Method is Reallocate IP.

¡ DHCP Request Retransmit Times—Enter the number of times that the user retries to obtain an IP address. If a user who passed portal authentication does not obtain a public IP address, it retries to obtain an IP address. This field is displayed only when the value of Access Method is Reallocate IP.

¡ Device Description—Enter detailed information about a portal device for easy maintenance.

Modifying a portal device

1. Access the device list page.

2. Click the Modify icon for the portal device you want to modify.

3. Modify the parameters for the portal device.

The Device Name, Version, Access Method, and Service Group parameters cannot be modified. For more information, see "Adding a portal device."

4. Click OK.

Deleting a portal device

Before you delete a portal device, log off all online users connected to the device. Otherwise, if the portal device is disabled with or does not support the user heartbeat function, an online user becomes an abnormal user and the following problems can arise:

· Depending on the maximum concurrent login users setting, users may be unable to log in if users on the same accounts are still displayed online.

· If the accounting component is deployed, the abnormal user is still charged as long as it is shown online.

To delete a portal device:

1. Access the device list page.

2. In the Operation column, click the Delete icon for the portal device you want to delete.

3. Click OK.

Configuring port groups

An IP address group works with a portal device's port group to determine the accessible network range for users.

The following workflow applies:

2. The administrator assigns ports to several port groups on the portal device and binds port groups to the IP address groups.

Accessing the port group list page

1. Access the device list page.

2. In the Operation column, click the Port Group icon for a portal device.

The list includes all the port groups.

Port Group List contents

¡ Port Group Name—Name of the port group.

¡ Start Port/End Port—Start and end port numbers.

¡ Protocol—Protocol used for performing portal authentication based on a single webpage. The protocol can be HTTP or HTTPS.

¡ NAT or Not—Whether or not a NAT gateway exists between the private portal device and the public portal server.

¡ Details—Provides the Details icon of a port group to view its details.

¡ Modify—Provides the Modify icon to display the page for modifying a port group.

¡ Delete—Provides the Delete icon to delete a port group.

Querying port groups

1. Access the Port Group List page.

2. In the Query Port Groups area, specify one or more of the following query criteria:

¡ Port Group Name—Enter a partial or complete name of a port group. For example, if you enter a, all group names that contain a are matched.

¡ Start Port >=—Enter the start port number for a port group. The start and end ports jointly determine the query range. All port group ranges that are within the query range are matched.

¡ End Port <=—Enter the end port number for a port group. The start and end ports jointly determine the query range. All port group ranges that are within the query range are matched.

¡ Protocol—Select the protocol that is used to perform portal authentication based on a single webpage. Valid options include HTTP and HTTPS.

¡ NAT or Not—Select Yes or No from the list.

The query ignores empty fields.

3. Click Query.

The list includes all port groups matching the query criteria. To clear the query criteria, click Reset. The list includes all port groups.

Viewing port group details

1. Access the Port Group List page.

2. Click the Details icon for the port group whose details you want to view.

Port group details parameters

¡ Device Name—Name of the portal device that the port group belongs to.

¡ Version—Portal protocol version running on the portal device that the port group belongs to.

¡ Port Group Name—Name of the port group.

¡ Language—Language of the webpage used in webpage authentication or iNode DC authentication for users who access through the port group.

¡ Start Port/End Port—Start and end port numbers.

¡ Protocol—Protocol used for performing webpage authentication or iNode DC authentication. The protocol can be HTTP or HTTPS.

¡ Quick Authentication—Whether or not to perform quick authentication.

- Yes indicates that the portal device does not use the user name or password, but uses the user's accessing port, MAC address, and VLAN ID for portal authentication.

- No indicates that the portal device uses the user name and password for portal authentication.

- Make sure that the portal device supports quick authentication when the value of the parameter is Yes.

¡ NAT or Not—Whether or not a NAT gateway exists between the private portal device and the public portal server.

¡ Error Transparent Transmission—Whether or not the portal server transparently transmits the error message sent from the portal device to users. Make sure that the portal device supports the error transparent transmission feature when the value of the parameter is Yes.

¡ Authentication Type—Type of authentication to be performed for users accessing through the port group, including PAP, CHAP, and EAP.

¡ IP Group—IP address group bound to the port group. Users who access through the port group must have their IP addresses in the IP address group before they can pass portal authentication.

¡ Heartbeat Interval—Interval at which a user sends a heartbeat packet to the portal server. Upon receiving the packet, the portal server sends a heartbeat response to the user. If the heartbeat interval is 0, users do not send heartbeat packets, and the heartbeat timeout must also be 0. The default heartbeat interval is 0.

¡ Heartbeat Timeout—Heartbeat timeout time. If a user cannot receive a heartbeat reply from the portal server within this time, the user considers that the heartbeat request timed out and that the portal server failed. The heartbeat timeout cannot be shorter than twice of the heartbeat interval. If the heartbeat timeout is 0, users do not monitor the heartbeat replies, and the heartbeat interval must also be 0. The default heartbeat timeout time is 0.

¡ User Domain—Default domain name of the users accessing through the port group. The portal server automatically adds the default domain name to a domain-less user name for portal authentication. The value must be the same as what is configured on the portal device for RADIUS authentication.

¡ Port Group Description—Description of the port group.

¡ Page Push Policy—Name of the page push policy for the port group. UAM matches each endpoint user in the port group to the page push policy. If a subpolicy is matched, UAM displays the authentication page specified in the subpolicy. If none of the subpolicies is matched, UAM displays the default authentication page. For more information about page push policies, see "Configuring page push policies."

¡ Client Protection Against Cracks—Indicates whether the client protection against cracks feature is enabled for endpoint access from the port group. For more information about client protection against cracks, see "Configuring client anti-crack."

¡ Transparent Authentication on Smart Devices—Indicates whether to allow transparent portal authentication for device access from the port group. For more information about transparent portal authentication, see "Configuring transparent portal authentication."

¡ Default Authentication Page—URL of the default authentication page for the port group. UAM displays the default authentication page when the page push policy is not specified for the port group or none of the subpolicies in the page push policy is matched.

3. Click Back to return to the Port Group List page.

Adding a port group

1. Access the Port Group List page.

2. Click Add in the Port Group List area.

3. Configure the following parameters on the Add Port Group page:

¡ Port Group Name—Enter the port group name. The name must be unique in UAM.

¡ Language—Select a language from the list for performing single webpage authentication or iNode DC authentication for users who access through the port group. The option is English.

¡ Start Port/End Port—Enter the start and end port numbers. A user can pass portal authentication only when the port that the user connects to is within the specified port range. The start port number defaults to 0 and the end port number defaults to zzzzzz. Use the default values if you have no special requirements. The start/end port format varies with device models. For example, the start/end port number on the MA5200 is in the format of hostname-vlan-slot(slot-number)-vlanid(vlan-id)@vlan. For information about setting the start and end port numbers, see the port number format description in the configuration guide of your device.

To check whether the number of a port connecting to the user belongs to the specified port range, UAM first pads 0s to the end of the start, end, and current port numbers so that all port numbers have the same length. For example, with 0s padded, the start port number 0, end port number zzz, and current port number zzyc change to 0000, zzz0, and zzyc, respectively. Then UAM compares the port numbers from the highest digit to the lowest in ASCII dictionary order:

- If the port numbers have the same highest digit, UAM compares the second highest digit, and thus down to the lowest.

- If the highest digit of the current port number is between those of the start and end port numbers (exclusive), UAM determines that the current port number is within the port range. If the current port number has the same highest digit as the start or end port number, UAM compares the second highest digit. Otherwise, UAM determines that the current port number is outside the port range.

- If the current port number and the start port number have the same highest digit, UAM compares the second highest digit. If the second highest digit of the current port number is greater than that of the start port number, UAM determines that the current port number is within the port range. If the current port number and the start port number have the same second highest digit, UAM compares the third highest digit, and thus down to the lowest. Otherwise, UAM determines that the current port number is outside the port range.

- If the current port number and the end port number have the same highest digit, UAM compares the second highest digit. If the second highest digit of the current port number is smaller than that of the end port number, UAM determines that the current port number is within the port range. If the current port number and the start port number have the same second highest digit, UAM compares the third highest digit, and thus down to the lowest. Otherwise, UAM determines that the current port number is outside the port range.

- If all digits are the same except that the lowest digit of the current port number is between those of the start and end port numbers (inclusive), UAM determines that the current port number is within the port range. Otherwise, UAM determines that the current port number is outside the port range.

¡ Protocol—Select a protocol for the login page. Valid options include HTTP and HTTPS. This parameter is effective only for single webpage authentication and iNode DC authentication.

¡ Quick Authentication—Select Yes or No from the list to enable or disable quick authentication. If you select Yes, the portal device does not use the user name or password, but uses the user's accessing ports, MAC addresses, and VLAN ID for portal authentication. If you select No, the portal device uses the user name and password for portal authentication. Make sure that the portal device supports quick authentication when you select Yes in this field.

¡ NAT or Not—Select Yes or No from the list. Select Yes if a NAT gateway exists between the private portal device and the public portal server. Otherwise, select No. If the portal device uses Portal 3.0, this field is always No.

¡ Error Transparent Transmission—Select Yes or No from the list to enable or disable error transparent transmission. Select Yes if you want the portal server to transparently transmit error messages sent from the portal device to users. Select No if you do not want the portal server to send errors from the portal device to users. Make sure that the portal device supports the error transparent transmission feature when you select Yes for this field.

¡ Authentication Type—Select a type of authentication to be performed by users accessing through the port group from the list. The valid options include PAP, CHAP, and EAP.

¡ IP Group—Select an IP address group bound to the port group. If the IP address of the portal device is an IPv4 address, the list displays only IPv4 address groups. If the IP address of the portal device is an IPv6 address, the list displays only IPv6 address groups. Users who access through the port group must have their IP addresses in the IP address group before they can pass portal authentication. For more information, see "Configuring IP address groups."

¡ Heartbeat Interval—Enter the interval at which a user sends a heartbeat packet to the portal server. Upon receiving the packet, the portal server sends a heartbeat response to the user. If the heartbeat interval is 0, users do not send heartbeat packets, and the heartbeat timeout must also be 0.

¡ Heartbeat Timeout—Enter the heartbeat timeout time. If a user cannot receive a heartbeat reply from the portal server within this time, the user considers that the heartbeat request timed out and considers the portal server failed. The heartbeat timeout time cannot be shorter than twice of the heartbeat interval. If the heartbeat timeout is 0, users do not monitor the heartbeat replies, and the heartbeat interval must also be 0.

¡ User Domain—Enter the default domain name of the users accessing through the port group. The portal server automatically adds the default domain name to a domain-less user name for portal authentication. Set the User Domain the same as the domain name that is configured on the portal device for RADIUS authentication.

¡ Port Group Description—Enter detailed information about a port group for easy maintenance.

¡ Transparent Authentication—Select Supported or Not Supported from the list. Select Supported to allow transparent portal authentication for endpoint access from the port group. Select Not Supported to prohibit transparent portal authentication for endpoint access from the port group. For more information about transparent portal authentication, see "Configuring transparent portal authentication."

¡ Client Protection Against Cracks—Select Yes or No from the list. Select Yes to enable the client protection against cracks feature for terminal access from the port group. Select No to disable this feature for terminal access from the port group. For more information about client protection against cracks, see "Configuring client anti-crack."

¡ Page Push Policy—Select a page push policy from the list. UAM matches each endpoint user in the port group to the page push policy. If a subpolicy is matched, UAM displays the authentication page specified in the subpolicy. If none of the subpolicies is matched, UAM displays the default authentication page. This parameter is effective only on single webpage authentication and iNode DC authentication, but it is ineffective on iNode PC authentication.

¡ Default Authentication Page—Select a URL from the list as the default authentication page for the port group. UAM displays the default authentication page when the page push policy is not specified for the port group or none of the subpolicies in the page push policy is matched. This parameter is effective only on single webpage authentication and iNode DC authentication but is ineffective on iNode PC authentication.

4. Click OK.

Modifying a port group

1. Access the Port Group List page.

2. Click the Modify icon for the port group you want to modify.

3. Modify the parameters for the port group.

All the parameters can be modified. For more information, see "Adding a port group."

Deleting a port group

Before you delete a port group, log off all online users connected to the portal device where the port group is configured. Otherwise, an online user becomes an abnormal user, and the following problems can arise:

· Depending on the maximum concurrent login users setting, users may be unable to log in if users on the same accounts are still displayed online.

· If the accounting component is deployed, the abnormal user is still charged as long as it is shown online.

To delete a port group:

1. Access the Port Group List page.

2. Click the Delete icon for the port group you want to delete.

Table 28 Domain X and service suffix correlation

3. Click OK.

Deploying configurations to a portal device

UAM uses a GUI in replace of a CLI for operators to complete portal authentication configurations.

UAM supports deploying configurations only to some of HP Comware devices and some of H3C devices.

Before deploying configurations to a portal device, make sure you have added the portal device to IMC and configured Telnet parameters correctly. For information about adding a portal device to IMC and configuring Telnet parameters, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide.

To deploy configurations to a portal device:

1. Access the device list page.

2. In the Operation column, click the Deploy Configuration icon for the device to which you want to deploy configurations. If the device is not added to the IMC platform or does not support configuration deployment, the page displays the failure reason.

3. Configure the parameters according to the type of the portal device.

The parameters to be configured vary by portal device type. For more information, see "Parameters for Comware V5 switches and routers," "Parameters for Comware V3 switches and routers," and "Parameters for wireless devices."

4. Click Deploy.

After the deployment is completed, the deployment result is displayed on the top of the page. For a failed deployment, the failure reason is provided, and the deployment process is displayed below the result.

Parameters for Comware V5 switches and routers

The configuration page for Comware V5 switches and routers contains the following areas:

Basic Information

· Portal Server—Select a portal server from the list. If distributed deployment is used for the portal server, you choose one server from multiple portal servers in the list.

· Preauthentication Redirect URL—Enter a URL to which unauthenticated endpoint users are redirected when they access a network by using a browser.

· Postauthentication Redirect URL—Enter a URL to which authenticated endpoint users are redirected when they access a network by using a browser.

Portal-Free Rule

A portal-free rule contains these elements: interface, VLAN ID, source IP address/mask, source MAC address, and destination IP address/mask.

An endpoint user can access the destination IP address range configured in a portal-free rule only when it meets all of the following conditions:

· The interface to which it is connected is the same as that in the portal-free rule.

· The VLAN to which it belongs is the same as that in the portal-free rule.

· Its IP address is in the source IP address range in the portal-free rule.

· Its MAC address is the same as that in the portal-free rule.

To configure a portal-free rule:

1. To add a portal-free rule, click Add in the Portal-Free Rule area to configure the following parameters:

¡ No.—Enter the number of the portal-free rule.

The value range depends on the device mode (see the relevant configuration guide).

¡ Interface—Select Any or an interface on the portal device from the list.

¡ VLAN ID—Enter a VLAN ID. Leaving this field blank indicates any VLAN. If you select an interface, you must enter the VLAN ID to which the interface belongs or leave this field blank. If you select Any for Interface, leave this field blank.

¡ Source IP/Mask—Enter the source IP address and mask, which define a source IP address range. Any means any source IP address.

¡ Source MAC—Enter a MAC address, in the format of XXXX-XXXX-XXXX or XX-XX-XX-XX-XX-XX. Leaving this field blank indicates any MAC address. If both Source IP/Mask and Source MAC need to be configured, the mask must be configured as 255.255.255.255. Otherwise, the source MAC address is invalid. If you use Any for Source IP/Mask, leave this field blank.

¡ Destination IP/Mask—Enter the destination IP address and mask, which define a destination IP address range. Any means any destination IP address.

2. Click OK.

3. Repeat steps 1 and 2 to add more portal-free rules.

4. To delete a portal-free rule, click the Delete icon for it.

Portal Authentication Port

This list contains all Layer 3 interfaces configured with IP addresses. Information includes the port description, IP address, whether portal authentication is enabled, whether transparent portal authentication is enabled, and source authentication network.

To configure a portal authentication port:

1. Select the portal authentication port.

2. Enable or disable portal authentication on this port in the Authentication Status column.

3. In the Source Authentication Network text box, enter the source IP address and mask, which define a source IP address range.

An endpoint user connecting to this port can pass portal authentication only if it belongs to this source IP address range. You can use dotted decimal notation or mask length to indicate the mask. This parameter needs to be configured only when Layer 3 is selected for Access Method. You can configure only one source IP address range in one line and a maximum of 32 source IP address ranges in total.

4. Repeat steps 1 to 3 to configure more portal authentication ports.

Parameters for Comware V3 switches and routers

Differences from Comware V5 devices

· Comware V3 devices do not support postauthentication redirection or portal-free rules, so Postauthentication Redirect URL and Portal-Free Rule are not needed.

· Comware V3 devices support portal-free IP addresses and portal-free user IP addresses, so Portal-Free IP Address and Portal-Free User IP need to be configured.

For the configuration of other parameters, see "Parameters for Comware V5 switches and routers."

Portal-Free IP Address

The IP addresses an unauthenticated endpoint user can access are called portal-free IP addresses.

To configure a portal-free IP address:

1. Access the Deploy Configuration page.

2. To add a portal-free IP address, click Add in the Portal-Free IP Address area.

3. Select an interface from the Interface list, and enter an IP address in the IP Address text box.

This configuration enables a user connecting to the selected interface to access the specified IP address before the user passes portal authentication.

4. Click OK.

5. Repeat steps 2 to 4 to add more portal-free IP addresses.

6. To delete a portal-free IP address, click the Delete icon for it.

Portal-Free User IP

An unauthenticated endpoint user can use some IP addresses to access all networks. These IP addresses are called portal-free user IP addresses.

To configure a portal-free user IP address:

1. Access the Deploy Configuration page.

2. To add a portal-free user IP address, click Add in the Portal-Free User IP area.

3. Select an interface from the Interface list, and enter the VLAN ID, IP address, and MAC address in the VLAN ID, IP Address, and MAC address text boxes, respectively.

This configuration enables the specified VLAN user connecting to the selected interface to access all networks through the specified VLAN by using the specified IP address and MAC address before the user passes portal authentication.

4. Click OK.

5. Repeat steps 2 to 4 to add more portal-free user IP addresses.

6. To delete a portal-free user IP address, click the Delete icon for it.

Parameters for wireless devices

The supported wireless devices include H3C wireless devices and some of HP Comware devices (non-MSM devices).

Differences from Comware V5 devices

Some wireless devices do not support postauthentication redirection, so Postauthentication Redirect URL is not needed for these devices.

To configure portal authentication ports, the Transparent Authentication parameter must be enabled.

The following describes how to configure portal authentication ports. For the configuration of other parameters, see "Parameters for Comware V5 switches and routers."

Portal Authentication Port

To configure a portal authentication port:

1. Select a port.

2. Enable or disable portal authentication on this port in the Authentication Status column.

3. If you enable portal authentication, perform the following configurations:

a. Enable or disable transparent authentication on this port in the Authentication Status column.

This option is displayed only when Directly Connected or Reallocate IP is selected for Access Method. If you enable this option, you need to configure the threshold for triggering transparent portal authentication. The threshold is in format of x bytes/y seconds, which indicates that transparent portal authentication is triggered when the portal device forwards x bytes or more traffic to other networks within y consecutive seconds. Generally, a device generates some traffic when it is idle. The threshold is configured to prevent this traffic from triggering transparent portal authentication.

b. In the Source Authentication Network text box, enter the source IP address and mask, which define a source IP address range.

You can use dotted decimal notation or mask length to indicate the mask. This parameter is required only when Layer 3 is selected for Access Method. You can configure only one source IP address range in one line and a maximum of 32 source IP address ranges in total. The endpoint user connecting to the portal authentication port can pass portal authentication only if it belongs to a configured source IP address range.

4. Repeat steps 1 to 3 to configure more portal authentication ports.

Viewing the configurations last deployed to a portal device

1. Access the device list page.

2. In the Operation column, click the View Deployed Configuration icon for the device you want to view.

The View Deployed Configuration page displays the Access Method, Deployed Last at, Deploy Result, and Deploy Failure Reason parameters (see "Viewing portal device details") in addition to all the contents on the Deploy Configuration page (see "Deploying configurations to a portal device").

3. Click Back to return to the device list page.

Viewing the last deployment

1. Access the device list page.

2. In the Operation column, click the View Deploy Process icon for the device you want to view.

The View Deploy Process page presents the process for the portal device to configure the deployed parameters by using commands.

3. Click Back to return to the device list page.

Configuring PDAs to support portal authentication

To configure a PDA to support portal authentication, perform the following configurations:

1. Configure the portal server. See "Configuring UAM as the portal server."

2. Configure an IP address group. See "Configuring IP address groups."

3. Configure the portal device. See "Configuring portal devices."

4. Configure an endpoint OS group and then add the OS kernel versions of common PDAs to the group, such as Nokia Symbian.

5. Configure a page push policy:

¡ Set the authentication method to Portal.

¡ Configure a subpolicy:

- In the Condition area, select the endpoint OS group configured in step 5 and set other fields to Unlimited.

- In the Strategy area, select PHONE – Default WEB Login(PDA) as the authentication page. Leave other fields empty.

6. Configure a port group:

¡ Set Heartbeat Interval and Heartbeat Timeout to 0.

¡ Select the page push policy to be configured in step 5.

Configuring transparent portal authentication

Transparent portal authentication simplifies the portal authentication process for smart endpoint devices such as smartphones.

The following describes the workflow of transparent portal authentication:

¡ The service assigned to the account is enabled with the Transparent Authentication option.

¡ The port group used by the endpoint device for authentication is configured to support transparent portal authentication.

¡ The HTTP user agent of the endpoint device matches a transparent authentication character.

To implement transparent portal authentication for endpoint devices, complete the following tasks:

· Configure UAM settings and portal devices to support transparent authentication for endpoint devices.

· Maintain the transparent portal user list for endpoint devices in UAM.

Enabling transparent authentication for portal endpoints

To enable transparent portal authentication for endpoint devices, complete the following tasks:

· Configure the following transparent authentication settings in UAM:

¡ Enable Transparent Authentication in all service configurations that are assigned or to be assigned to the endpoint devices. For more information, see "Adding an access service."

¡ Select Supported for the Transparent Authentication parameter for all port groups on each portal device. For more information, see "Adding a port group."

¡ Enable Transparent Authentication in user endpoint settings. For more information, see "Configuring user endpoint settings."

¡ (Optional.) Add the HTTP user agent of the endpoint device as a transparent authentication character. An endpoint device must match a transparent authentication character before UAM can perform transparent portal authentication for it. UAM predefines several HTTP user agents. Operators can also add new HTTP user agents. For more information, see "Managing transparent authentication characters."

¡ (Optional.) Configure transparent authentication parameters for endpoint devices in UAM system settings. The parameters include Endpoint Aging Time and Non-Smart Device Transparent Portal AuthN. Alternatively, you can use the default settings of these parameters. For more information, see "Configuring user endpoint settings."

· Configure portal devices to support transparent authentication for endpoint devices. On an HP Comware device, configure the portal mac-trigger server and portal mac-trigger enable commands. For more information, see the command references for the devices.

Maintaining the transparent portal user list

The transparent portal user list records the bindings among the endpoint MAC address, access user account, and service configuration for endpoint devices. When an endpoint device attempts to access the network, UAM performs transparent authentication for the device by using the access user account and service mapped to the endpoint MAC address.

Managing transparent authentication characters

Transparent authentication character management enables you to define the HTTP characters for endpoint devices that are allowed to perform transparent authentication.

Accessing the HTTP Character Management page

1. Access the Transparent Portal User page.

2. Click Transparent Authentication Character Management.

The list includes all HTTP characters.

HTTP character list contents

¡ HTTP Character—Keyword of the endpoint HTTP character.

¡ Description—Description of the HTTP character.

¡ Modify—Click the Modify icon to modify the HTTP character.

¡ Delete—Click the Delete icon to delete the HTTP character.

Querying HTTP characters

1. Access the Transparent Portal User page.

2. Click Transparent Authentication Character Management.

The list includes all HTTP characters.

3. In the Query HTTP Characters area, enter a partial or complete keyword for HTTP characters. For example, if you enter android, all HTTP characters that contain android are matched.

4. Click Query to display all HTTP characters that match the query criteria.

5. Click Reset to clear the query criteria and display all HTTP characters.

Adding an HTTP character

The UAM-predefined HTTP characters can cover most endpoints in the market. Typically, you do not need to add new HTTP characters.

To add an HTTP character:

1. Access the Transparent Portal User page.

2. Click Transparent Authentication Character Management.

The list includes all HTTP characters.

3. Click Add.

The Add HTTP Character page opens.

4. Configure the following parameters:

¡ HTTP Character—Enter the keyword of the HTTP character, in the format of XXX, XXX||XXX, or XXX&&XXX.

¡ Description—Enter a description for the HTTP character.

5. Click OK.

Modifying an HTTP character

1. Access the Transparent Portal User page.

2. Click Transparent Authentication Character Management.

The list includes all HTTP characters.

3. Click the Modify icon for the HTTP character you want to modify.

4. Modify the following parameters:

¡ HTTP Character—Modify the keyword of the HTTP character, in the format of XXX, XXX||XXX, or XXX&&XXX.

¡ Description—Modify the description of the HTTP character.

5. Click OK.

Deleting an HTTP character

1. Access the Transparent Portal User page.

2. Click Transparent Authentication Character Management.

The list includes all HTTP characters.

3. Click the Delete icon for the HTTP character you want to delete.

A confirmation dialog box opens.

4. Click OK.

Enabling transparent authentication for endpoint devices

You can enable transparent authentication for endpoint devices on which transparent authentication has been disabled manually or automatically.

To enable transparent authentication for endpoint devices:

1. Access the Transparent Portal User page.

2. Select one or more endpoint devices for which you want to enable transparent authentication.

3. Click Enabled.

A confirmation dialog box opens.

4. Click OK.

Disabling transparent authentication for endpoint devices

Use this function to manually disable transparent authentication for endpoint devices. UAM can also automatically disable transparent authentication for endpoint devices according to the user endpoint settings. For more information about user endpoint settings, see "Configuring global system settings."

To manually disable transparent authentication for endpoint devices:

1. Access the Transparent Portal User page.

2. Select one or more endpoint devices for which you want to disable transparent authentication.

3. Click Disabled.

A confirmation dialog box opens.

4. Click OK.

Deleting endpoint devices in batches

Deleting an endpoint device deletes the bindings among the endpoint MAC address, access user account, and service configuration for the device in UAM. When a new account uses the endpoint device to successfully access the network through the portal login page, UAM binds the endpoint MAC address with the new account and service.

To delete endpoint devices in batches:

1. Access the Transparent Portal User page.

2. Select one or more endpoint devices you want to delete.

3. Click Batch Delete.

A confirmation dialog box opens.

4. Click OK.

Configuring MAC/BYOD authentication

For endpoint users who are identified by MAC addresses, UAM provides the following authentication modes:

· Anonymous MAC authentication—UAM uses the BYODanonymous account to automatically authenticate users who have no accounts in UAM. After this authentication, users can register a guest account in UAM, and then use the guest account for authentication.

· Transparent MAC authentication—UAM uses the account associated with the user's MAC address to automatically authenticate the user. This does not require any manual intervention.

· Mute terminal MAC authentication—Automatically authenticates mute terminals, such as IP phones and printers. Mute terminals cannot actively initiate authentication processes.

The BYOD solution combines anonymous MAC authentication with transparent MAC authentication. An endpoint user first goes through anonymous MAC authentication and then transparent MAC authentication.

MAC authentication processes

The MAC authentication processes vary by authentication mode. This example uses X as the name of the MAC authentication domain.

Anonymous MAC authentication

Anonymous authentication uses the following workflow:

1. An IMC operator enables MAC authentication and RADIUS authentication on the access device, and configures Domain X as the MAC authentication domain.

2. When a guest attempts to access the network, the access device forwards the MAC address of the guest to UAM.

3. UAM checks the MAC address and performs anonymous MAC authentication for the guest if the following conditions are met:

¡ The MAC address is not in the MAC address range configured for mute terminals.

¡ The MAC address is not bound to any user account except the BYODanonymous account.

¡ Transparent authentication is enabled for the MAC address.

¡ The BYODanonymous account is configured in UAM, and one of the services applied for the account uses the service suffix X.

4. After authentication, UAM binds the MAC address to the BYODanonymous account, and controls the guest's access behaviors by using the service with the suffix X.

Table 28 describes the domain X and service suffix correlation in anonymous MAC authentication.

MAC address format	Authentication domain on the access device	Commands configured on the access device	Service suffix in UAM
MAC@Y	X	user-name-format with-domain	X
MAC@Y	X	user-name-format without-domain	None
MAC	[Default Domain] (Default domain on the access device)	user-name-format with-domain	[Default Domain]
MAC	[Default Domain] (Default domain on the access device)	user-name-format without-domain	None

Transparent MAC authentication

Transparent MAC authentication uses the following workflow:

1. An IMC operator enables MAC authentication and RADIUS authentication on the access device, and configures Domain X as the MAC authentication domain.

2. When an endpoint user attempts to access the network, the access device forwards the MAC address of the user to UAM.

3. UAM checks the MAC address and performs MAC-based authentication for the user if the following conditions are met:

¡ The MAC address is not in the MAC address range configured for mute terminals.

¡ The MAC address has been bound to a user account rather than the BYODanonymous account, and the user account has applied for a service that uses the service suffix X.

¡ Transparent authentication is enabled for the MAC address.

4. After authentication, UAM allows the user to access the network and controls the user's access behaviors by using the service with the suffix Domain X.

Mute terminal authentication

Mute terminal authentication uses the following workflow:

1. An IMC operator enables MAC authentication and RADIUS authentication on the access device, and configures Domain X as the MAC authentication domain.

2. When a mute terminal attempts to access the network, the access device forwards the MAC address of the mute terminal to UAM.

3. UAM checks the MAC address and performs a mute terminal authentication for the terminal if the following conditions are met:

¡ The MAC address is in the permitted MAC address range configured for mute terminals.

¡ The service applied for mute terminals in UAM has a service suffix X.

4. After authentication, UAM does the following:

¡ Creates an account for the mute terminal using the terminal's MAC address.

¡ Allows the terminal to access the network.

¡ Controls the terminal's access behaviors by using the service with the suffix X.

Table 29 describes the domain X and service suffix correlation in mute terminal authentication.

Table 29 Domain X and service suffix correlation

MAC address format	Authentication domain on the access device	Commands configured on the access device	Service suffix in UAM
MAC	[Default Domain] (Default domain on the access device)	user-name-format with-domain	[Default Domain]
user-name-format without-domain	None

MAC address format

Authentication domain on the access device

Commands configured on the access device

Service suffix in UAM

MAC

[Default Domain]

(Default domain on the access device)

user-name-format with-domain

[Default Domain]

user-name-format without-domain

None

BYOD solution

A typical BYOD solution uses the following processes:

1. After an endpoint user uses a smart device to access the wireless network, UAM performs anonymous MAC authentication for the user and restricts the user to an isolated VLAN enabled with portal authentication. The portal redirection page is set to the BYOD authentication page.

2. When the user attempts to access the Internet through the Web browser, UAM displays the BYOD authentication page and asks the user to enter a user name and password. If the entered user name and password match an access user in UAM, BYOD binds the access user with the endpoint MAC address and then informs UAM to log off the BYOD anonymous user.

3. UAM performs transparent MAC authentication for the user by using the bound access user account. After the authentication, UAM deploys to the user a portal-free VLAN (specified in the service configuration of the bound access user) so that user can access the wireless network.

Configuring computer authentication

Computer authentication has the following characteristics:

· Based on 802.1X authentication and can function as pre-authentication for 802.1X authentication.

· Authenticates computer names and certificates.

· Supported only on Windows operating systems.

· Automatically authenticates a user before the user logs in to Windows.

Computer authentication applies to the following scenarios:

· The iNode PC client performs computer authentication first and then 802.1X authentication for an endpoint user.

· The computer uses the Windows built-in 802.1X client for authentication.

Using the iNode PC client

To use the iNode PC client to perform computer authentication, configure UAM, access device, and iNode PC client.

Configuring UAM

This example provides a summary configuration procedure. For information about detailed steps, see "Adding access devices," "Adding an ordinary access user," and "Configuring certificate authentication."

1. Add an access device.

Make sure the access device parameters configured in UAM is the same as those configured on the device.

2. Add an access policy, as shown in Figure 91:

a. Enter for machine in the Access Policy Name field.

b. Select EAP-TLS as the preferred EAP type.

Figure 91 Adding an access policy

3. Add an access service.

¡ If the user-name-format with-domain command is configured on the device, use the default domain name as the service suffix.

¡ If the user-name-format without-domain command is configured on the device, leave the Service Suffix field empty.

Figure 92 shows the default access policy configurations. Figure 93 shows the configurations of a sample access policy.

Figure 92 Default access policy

Figure 93 Configurations of a sample access policy

4. Add a computer user and assigns the added service to the user.

The account name of a computer user is computer. The online user list displays the account name as computer for all computer users who have passed authentication.

Figure 94 Adding a computer user

5. Import the root and server certificates to UAM.

Configuring the access device

1. Configure a RADIUS scheme.

¡ The RADIUS scheme parameters configured on the device must be the same as those configured in UAM.

¡ If the access user is assigned a service with a suffix, configure the device to add domain information to the user names to be sent to the RADIUS servers. If the access user is assigned a service without any suffix, configure the device to remove domain information from the user names to be sent to the RADIUS servers.

2. Configure an ISP domain.

a. Create an ISP domain and configure the domain to use the RADIUS scheme for 802.1X users.

b. Configure the domain as the default ISP domain.

If the access user is assigned a service with a suffix, the domain name must be the same as the service suffix. If the access user is assigned a service without any suffix, use any domain name.

3. Configure 802.1X authentication.

a. Enable 802.1X globally and on the interface that connects to the computer.

b. Configure the device to relay EAP packets and support all EAP authentication methods for RADIUS communication.

Configuring the iNode PC client

1. Download and install the root and client certificates.

The client certificate name is the complete computer name. If the computer joins a domain, the login name includes the domain name.

The Online User List displays the login name of access users that have passed authentication as the computer name.

2. Create a common connection for 802.1X authentication in the iNode PC client.

a. Set the user name and password for 802.1X authentication.

Figure 95 Setting a user name and password for 802.1X authentication

b. On the Network Property Settings page, select Machine Authentication, and the Auto authN after startup option is automatically selected. With the configuration, the iNode PC client automatically performs 802.1X authentication after computer authentication succeeds.

Figure 96 Configuring computer authentication

Using the built-in Windows 802.1X client

Configuring UAM

See "Configuring UAM."

Configuring the access device

The configurations on the access device are the same as those described in "Configuring the access device," except that you must disable 802.1X handshake on the interface that connects to the computer. The Windows built-in client does not support 802.1X handshake.

Configuring the Windows host

1. Enable IEEE 802.1X authentication in Windows.

2. Install the client and root certificates.

The client certificate name is the complete computer name. If the computer joins a domain, the login name includes the domain name.

The Online User List displays the login name of access users that have passed authentication as the computer name.

3. Configure the network card for 802.1X authentication:

a. In the Local Area Connection Properties dialog box, select Enable IEEE 802.1X authentication.

b. Select Microsoft: Smart Card or other certificate as the network authentication method.

c. Select Remember my credentials for this connection each time I’m logged on to automatically process subsequent network access requests.

d. Click Settings.

Figure 97 Configuring the network card for 802.1X authentication

e. In the Smart Card or other Certificate Properties dialog box, select the following options:

- Use a certificate on this computer

- Use simple certificate selection (Recommended)

- Validate server certificate

- CA server (08R2-SQL08R2-88-CA in this example) on the Trusted Root Certification Authorities list.

f. Click OK.

Figure 98 Configuring the smart card or other certificate properties

g. In the Local Area Connection Properties dialog box, click Additional Settings.

h. In the Advanced settings dialog box, select Specify authentication mode, select Computer authentication from the list, and click OK.

i. In the Local Area Connection Properties dialog box, click OK.

Figure 99 Configuring the advanced settings

Configuring LDAP authentication

IMC UAM works with LDAP servers to provide authentication service for network access users and device management users.

In a network that uses an LDAP server for user management, you can synchronize user accounts from the LDAP server to UAM instead of adding them manually. Users of these accounts are called LDAP users.

When the authentication request from a user arrives, UAM looks up the user in the local user database. If the user is an LDAP user, UAM forwards the request to the LDAP server. If the user is not an LDAP user, UAM directly authenticates the user. Figure 100 shows the authentication process.

Figure 100 LDAP authentication

UAM works with most LDAP servers in the market, including Microsoft Windows Active Directory, Open LDAP, Sun ONE LDAP Server, and Novell eDirectory Server.

Managing LDAP servers

An LDAP server stores user data and verifies user identities in LDAP authentication.

Accessing the LDAP server list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > LDAP Service > LDAP Server.

The list includes all LDAP servers.

LDAP server list contents

¡ Server Name—LDAP server name.

¡ Version—Version of the LDAP protocol running on the LDAP server. UAM supports LDAPv2 and LDAPv3.

¡ Address—Domain name or IP address of the LDAP server.

¡ Server Type—Type of the LDAP server: Microsoft AD or General (any server type, including Microsoft Windows AD). To use Microsoft Windows AD specific functions like AD-based service assignment, you must set the server type to Microsoft AD. In any other cases, set the server type to General.

¡ Service Sync Type—The way you assign services to LDAP users:

- Manual Assignment—Assign services directly to LDAP users when you configure a synchronization policy for the LDAP server.

- Based On Active Directory Group—Assign services to LDAP AD groups when you configure a synchronization policy for the LDAP server. UAM assigns services to users depending on their LDAP AD groups. For more information, see "Adding a policy when the Service Sync Type is based on AD group."

¡ User Group—User group to which the users synchronized from the LDAP server to UAM belong, which can be Manual Specify or Synchronize by OU. Manual Specify indicates all LDAP users are synchronized to the user group that is specified in the synchronization policy assigned to the LDAP server. Synchronize by OU indicates that UAM builds user groups based on the OU structure in the base DN of the LDAP server, and synchronizes LDAP users to their respective user groups.

¡ Service Group—Service group that the LDAP server belongs to.

¡ Test—Click the Test link to test connectivity to the LDAP server.

¡ Modify—Click the Modify icon to modify the settings of the LDAP server.

¡ Delete—Click the Delete icon to delete the LDAP server.

¡ Certificate—Click the Configure icon for an LDAP server to display the certificate import wizard. You must import certificates to UAM if you have enabled the Use SSL function for the LDAP server. For more information, see "Importing certificates."

Viewing LDAP server details

1. Access the LDAP server list page.

2. Click the name of the LDAP server whose details you want to view.

The LDAP Server Information page opens.

Basic Information area

¡ Server Name—LDAP server name.

¡ Version—Version of the LDAP protocol running on the LDAP server. UAM supports LDAPv2 and LDAPv3.

¡ Address—Domain name or IP address of the LDAP server.

¡ Port—TCP port to which the LDAP server listens for packets sent by UAM.

¡ Server Type—Type of the LDAP server: Microsoft AD or General (any server type, including Microsoft Windows AD). Microsoft Windows AD specific functions like AD-based service assignment are only available for Microsoft AD servers.

¡ Service Sync Type—The way you assign services to LDAP users.

- Manual Assignment—Assign services directly to LDAP users when you configure a synchronization policy for the LDAP server.

- Based On Active Directory Group—Assign services to LDAP AD groups when you configure a synchronization policy for the LDAP server. UAM assigns services to users depending on their LDAP AD groups. For more information about LDAP synchronization policies, see "Adding a policy when the Service Sync Type is based on AD group."

¡ Real Time AuthN—Displays whether authentication is performed by the LDAP server.

- Yes—LDAP users are authenticated on the LDAP server.

- No—LDAP users are authenticated on UAM.

¡ Reconnect Interval—Time UAM waits before retrying to connect to the LDAP server after a connection failure. During this interval, UAM does not try to connect to the LDAP server or accept any authentication request that must be forwarded to the LDAP server. After the interval expires, UAM retries to connect to the LDAP server.

¡ Connection Wait Time—Time period within which if UAM fails to connect to the LDAP server, the connection attempt is considered failed.

¡ Sync Wait Time—Maximum duration of each synchronization. The sync wait timer starts when UAM starts synchronizing user data from the LDAP server. When this timer expires, UAM stops the synchronization, regardless of whether the synchronization is completed or not. If you do not want to set a time limit, set the timer to 0.

¡ User Group—User group to which the users synchronized from the LDAP server to UAM belong.

- Manual Specify—All LDAP users are synchronized to the user group that is specified in the synchronization policy assigned to the LDAP server.

- Synchronize by OU—UAM builds user groups based on the OU structure in the base DN of the LDAP server, and synchronizes LDAP users to their respective user groups.

¡ Parent Group—Parent user group of the user group to which the users synchronized from the LDAP server to UAM belong. If the field is empty, UAM creates the level 1 user group based on the topmost level of the OU hierarchy on the LDAP server. This field is displayed only when the User Group field displays Synchronize by OU.

¡ Service Group—Service group that the LDAP server belongs to. Each service group represents a set of assignable authorizations.

¡ Connectivity—If UAM failed to connect to the LDAP server, this field displays Not Connected within the reconnect interval. Otherwise, this field displays Connected.

¡ Use SSL—If SSL runs between UAM and the LDAP server for encryption, this field displays Yes. Otherwise, this field displays No. This parameter is displayed only when IMC is installed on the Windows server.

Server Information area

¡ Base DN—Absolute path of the directory that stores user data on the LDAP server.

¡ Admin DN—Administrator on the LDAP server, displayed as the absolute path on the LDAP server.

¡ User Name Attribute—Attribute description used on the LDAP server for user names.

¡ Password Attribute—Attribute description used on the LDAP server for user passwords, which also serve as LDAP user passwords in UAM. For more information, see "Supplementary information for LDAP user passwords stored in UAM."

¡ Account Format—Because the attributes on the LDAP server contain some redundant information, UAM might need to trim the account names obtained from the LDAP server.

Valid values for this parameter include:

- Unchanged—Does not change the account names.

- Remove Prefix—Removes the prefix of an account name.

- Remove Suffix—Removes the suffix of an account name.

- Add Prefix—Adds a prefix before an account name.

¡ Delimiter—Case-sensitive string used to separate the trimmed characters from the remaining characters. For example, if you select Remove Prefix and set the delimiter to an at sign (@) for account Jack@test.com, the remaining account name is test.com. If you select Remove Suffix and set the delimiter to a dot (.) for the account, the remaining account name is Jack@test.

The parameter is displayed only when Remove Prefix or Remove Suffix is selected.

¡ Prefix—String to be added before an account name. The prefix is separated from the account name by a forward slash (/). For example, if you set the prefix to uam for account guest, the resulting account name is uam/guest.

This parameter is displayed only when Add Prefix is selected and the LDAP server type is Microsoft AD.

¡ Password Policy—Policy an LDAP user must comply with when modifying the password. This policy must be consistent with the password policy configured on the LDAP server. This parameter is displayed only when the server type is set to Microsoft AD and SSL is used to encrypt the packets exchanged between UAM and the LDAP server.

Standby Server Information area

¡ Address—Domain name or IP address of the standby LDAP server. UAM sends the authentication requests of LDAP users to this server after the primary LDAP server becomes unavailable.

¡ Server in Use—LDAP server being used for authenticating LDAP users.

¡ Auto Back to Primary—When the primary LDAP server becomes unavailable, UAM switches over to the standby server and starts regularly checking the availability of the primary server.

- If the Auto Back to Primary setting is Yes, UAM automatically switches back to the primary server after the server becomes available.

- If the Auto Back to Primary setting is No, UAM continues to use the standby server.

¡ Interval—Minimum interval between a primary-to-standby switchover and an automatic back-to-primary switchover.

This setting takes effect only when auto back to primary is enabled. UAM can automatically switch back to the primary server only if the standby server has been working for a period equal to or longer than this interval since the primary-to-standby switchover.

MS-CHAPv2 Authentication area

The following parameters are displayed when MS-CHAPv2 authentication is enabled:

¡ Domain Controller Address—Domain name or IP address of the domain controller.

¡ Standby Domain Controller Address—Domain name or IP address of the standby domain controller.

¡ Domain Controller Full Name—Full name of the domain controller.

¡ Standby Domain Controller Full Name—Full name of the standby domain controller.

¡ Virtual Computer Name—Name of the virtual computer used by the domain controller to communicate with UAM.

3. To return to the LDAP server list page, click Back.

Adding an LDAP server

1. Access the LDAP server list page.

2. Click Add.

3. Configure the following basic information:

¡ Server Name—Enter the LDAP server name, which must be unique in UAM.

¡ Version—Select an LDAP protocol version (V2 or V3) from the list.

¡ Address—Enter the domain name or IP address of the LDAP server. If the LDAP server has more than one NIC, enter the IP address of the NIC used for communicating with UAM.

¡ Port—Enter the TCP port number to which the LDAP server listens for the packets from UAM. The default port number is 389, which is used by most LDAP servers.

¡ Server Type—Select an LDAP server type: Microsoft AD or General (any server type, including Microsoft Windows AD).

- To use Microsoft Windows AD specific functions like AD-based service assignment, you must set the server type to Microsoft AD. If the server type is set to Microsoft AD, LDAP user authentication must be performed by the LDAP server.

- In any other cases, set the server type to General.

For the compatibility matrix of Server Type, Service Sync Type, and Real Time AuthN settings, see Table 30.

Table 30 Matrix of server type, service sync type, and Real Time AuthN

Server Type	Service Sync Type	Real Time AuthN
General	Manual assignment	Yes or No
Microsoft AD	· Manual assignment · AD group based	Yes

Server Type

Service Sync Type

Real Time AuthN

General

Manual assignment

Yes or No

Microsoft AD

· Manual assignment

· AD group based

Yes

¡ Service Sync Type—Select a service synchronization type from the list: Manual assignment or Based On Active Directory Group.

The services assigned to the LDAP users synchronized from the LDAP server are determined by the following parameters: Service Sync Type, Apply for Service by User Group, and User Group. For the basic matrix of related parameters, see Table 31.

For more information about the Apply for Service by User Group feature, see "Configuring global system settings."

Table 31 Basic matrix of related parameters for services

Service sync type	Apply for service by user group	User group sync mode	Services applied for by the LDAP users
Manual assignment	Enabled	Synchronize by OU	No other configuration is needed for the LDAP synchronization policy to be assigned to the LDAP server. UAM builds user groups based on the OU structure in the base DN of the LDAP server, and synchronizes LDAP users to their respective user groups. UAM automatically applies for services for each LDAP user, and the services to be applied for are those assigned to their respective user groups.
	Enabled	Manual Specify	When assigning an LDAP synchronization policy to the LDAP server, operators must specify a user group for the LDAP users. UAM applies for the services assigned to the specified user group for all LDAP users.
	Disabled	N/A	When assigning an LDAP synchronization policy to the LDAP server, operators must select the services to be assigned to LDAP users. UAM applies for the selected services for all LDAP users.
Based on active directory group	N/A	N/A	When assigning an LDAP synchronization policy to the LDAP server, operators assign services only to LDAP AD groups. UAM automatically applies for services for each LDAP user, and the services to be applied for are those assigned to their respective LDAP AD groups. For information about configuring such LDAP synchronization policies, see "Adding a policy when the Service Sync Type is based on AD group."

¡ Real Time AuthN—Displays whether authentication is performed by the LDAP server.

- Yes—LDAP users are authenticated on the LDAP server.

- No—LDAP users are authenticated on UAM.

For the compatibility matrix of Server Type, Service Sync Type, and Real Time AuthN settings, see Table 30.

¡ Reconnect Interval—Select the time that UAM must wait before retrying to connect to the LDAP server after a connection failure.

If you select Do Not Connect Auto, you disable UAM from automatically retrying to connect to the LDAP server after a connection failure.

¡ Connection Wait Time—Enter the maximum duration of each connection attempt. If UAM fails to connect to the LDAP server within this period, the connection attempt is considered failed.

¡ Sync Wait Time—Set the maximum duration of each synchronization process. The sync wait timer starts when UAM starts synchronizing user data from the LDAP server. When this timer expires, UAM stops the synchronization, regardless of whether the synchronization is completed or not.

If you do not want to set a time limit, set the timer to 0.

¡ User Group—Select Manual Specify or Synchronize by OU from the list.

- Manual Specify—All LDAP users are synchronized to the user group that is specified in the synchronization policy assigned to the LDAP server.

- Synchronize by OU—UAM builds user groups based on the OU structure in the base DN of the LDAP server, and synchronizes LDAP users to their respective user groups.

¡ Parent Group—This option is displayed only when Synchronize by OU is selected for the User Group field.

Click the Select User Group icon to select a group in the Select User Group window. The selected user group will become the root parent user group of all user groups synchronized from the LDAP server to UAM.

If you leave this field empty, UAM uses the topmost level of the OU hierarchy on the LDAP server as the root user group.

You cannot select Ungrouped as the parent group. Otherwise, UAM displays an error message upon completion of adding the LDAP server.

UAM supports a user group hierarchy of at most five levels, and does not synchronize LDAP OUs that correspond to level 6 or lower level user groups. For example, if you select a level 2 user group as the parent group, UAM can further synchronize at most three levels of OUs from the LDAP server and ignores level 4 or lower level OUs.

¡ Service Group—Select a service group for the LDAP server from the list. Available options include all service groups that have been created in UAM and Ungrouped.

¡ Use SSL—Select the option to use SSL to encrypt the packets exchanged between UAM and the LDAP server. When this option is selected, you must import associated certificates to UAM. For more information, see "Importing certificates."

4. Configure server information.

UAM uses the Administrator DN and password to authenticate to the LDAP server, navigates to the user data directory according to the base DN, and gets the values in the user name and password attributes, and adds the user name and password pairs to its user database.

The base DN, administrator DN, user name, and password attribute descriptions vary with LDAP servers. You can use a tool such as Softerra LDAP Administrator to get attribute descriptions on the server you are working with.

¡ Base DN—Enter the absolute path of the directory that stores user data in the LDAP server.

¡ Admin DN—Enter the absolute path that locates the administrator on the LDAP server.

¡ Admin Password—Enter the administrator password.

¡ User Name Attribute—Enter the attribute description used on the LDAP server for user names.

¡ Password Attribute—Enter the attribute description used on the LDAP server for user passwords.

This parameter does not need to be configured when the Server Type is Microsoft AD, whose user passwords are not readable.

The password attribute values in UAM correspond to user passwords in the LDAP server. For more information, see "Supplementary information for LDAP user passwords stored in UAM."

¡ User Password Encryption—Select the mode that UAM uses to encrypt user passwords. If you select Autosense, UAM uses the user password encryption mode on the LDAP server. If you select Not encrypted, UAM does not encrypt user passwords. To select Not encrypted or a specific password encryption mode, make sure the password encryption mode is consistent with that on the LDAP server.

¡ Support Bind Requests—Select whether to enable the support for password verification by processing bind requests. Options are Yes and No.

- The server type is set to Microsoft AD.

- SSL is used to encrypt the packets exchanged between UAM and the LDAP server.

- The User must change password at next logon option is selected on the LDAP server.

¡ Account Format—Select the way in which UAM handles account names obtained from the LDAP server:

- Unchanged—Does not change the account names.

- Remove Prefix—Removes the prefix of an account name.

- Remove Suffix—Removes the suffix of an account name.

- Add Prefix—Adds a prefix before an account name.

¡ Delimiter—Enter a case-sensitive string that separates the trimmed characters from the remaining characters. For example, if you select Remove Prefix and set the delimiter to an at sign (@) for account Jack@test.com, the remaining account name is test.com. If you select Remove Suffix and set the delimiter to a dot (.) for the account, the remaining account name is Jack@test.

The parameter is displayed only when Remove Prefix or Remove Suffix is selected.

¡ Prefix—Enter the prefix to be added before an account name. The prefix is separated from the account name by a forward slash (/). For example, if you set the prefix to uam for account guest, the resulting account name is uam/guest.

This parameter is displayed only when Add Prefix is selected and the LDAP server type is Microsoft AD.

5. To provide non-stop services, configure a standby server to provide authentication for the LDAP users when the primary server is unavailable. The primary to standby switchover takes about 1 minute. During this period, all network access requests from LDAP users are rejected. However, the switchover does not affect any online user.

¡ Address—Enter the IP address or domain name of the standby LDAP server.

¡ Server in Use—Select the LDAP server being used for authenticating LDAP users.

¡ Auto Back to Primary—Select the option if you want UAM to automatically stop using the standby server and switch back to the primary server after the server becomes available. Otherwise, UAM continues to use the standby server. This parameter does not take effect if you set Server in Use to Standby.

¡ Interval—Enter the minimum interval between a primary-to-standby switchover and an automatic back-to-primary switchover. This parameter takes effect only when Auto Back to Primary is enabled. UAM can automatically switch back to the primary server only if the standby server has been working for a period equal to or longer than this interval since the primary-to-standby switchover.

6. To perform MS-CHAPv2 authentication on LDAP users, select the MS-CHAPv2 Authentication option and configure the following parameters:

¡ Use IP Addresses of LDAP Servers—Select this option to enable local MS-CHAPv2 authentication for LDAP users. The LDAP server address and standby LDAP server address are used as the domain controller address and standby domain controller address, respectively.

¡ Domain Controller Address—Enter the domain name or IP address of the domain controller. For example, if the full name of the domain controller is ad.hpe.com, you can enter the domain name hpe.com as the domain controller address.

¡ Standby Domain Controller Address—Enter the domain name or IP address of the standby domain controller. For example, if the full name of the standby domain controller is ad.hpe.com, you can enter the domain name hpe.com as the standby domain controller address.

¡ Domain Controller Full Name—Enter the full name of the domain controller. To view the domain controller name, right-click the My Computer icon, select Properties, and view the full computer name under the Computer name, domain, and workgroup settings tab.

¡ Standby Domain Controller Full Name—Enter the full name of the standby domain controller. To view the full name of the standby domain controller, right-click the My Computer icon, select Properties, and view the full computer name under the Computer name, domain, and workgroup settings tab.

¡ Virtual Computer Name—Enter the name of the virtual computer used by the domain controller to communicate with UAM. The value must be the same as the name of the virtual computer created in the Computers directory of the domain controller.

¡ Virtual Computer Password/Confirm Virtual Computer Password—Enter and confirm the password of the virtual computer. The value must be the same as the virtual computer's password configured on the domain controller. UAM enables you to modify the virtual computer's password on the domain controller by using a script. For more information, see "Configuring LDAP parameters."

IMPORTANT:

MS-CHAPv2 authentication settings must be consistent on all LDAP servers of the same IP address. If you modify the MS-CHAPv2 authentication settings on an LDAP server, UAM automatically applies the settings to all other LDAP servers that have the same IP address as the LDAP server.

7. Click Test to test the connectivity to the LDAP server. If the connection attempt fails, follow the displayed tips to check for configuration errors.

8. Click OK.

Testing connectivity to an LDAP server

1. Access the LDAP server list page.

2. Click Test for the LDAP server.

The test result is displayed at the top of the page. If the LDAP server fails to be connected, follow the displayed tips to check for LDAP server configuration errors.

Modifying LDAP server settings

1. Access the LDAP server list page.

2. Click the Modify icon for the LDAP server you want to modify.

The Modify LDAP Server page opens.

3. Modify basic information:

¡ Version—Select the version of the LDAP protocol running on the LDAP server from the list. UAM supports LDAPv2 and LDAPv3.

¡ IP Address—Enter the IP address of the LDAP server. If the LDAP server has more than one NIC, enter the IP address of the NIC used for communicating with UAM.

¡ Port—Enter the TCP port number to which the LDAP server listens for packets sent by UAM. The default port number is 389, which is used by most LDAP servers.

¡ Reconnect Interval—Select the time that UAM must wait before retrying to connect to the LDAP server after a connection failure, or select Do Not Connect Auto to disable UAM from automatically retrying to connect to the LDAP server after a connection failure.

During this interval, UAM does not try to connect to the LDAP server or accept any authentication request that must be forwarded to the server. After the interval expires, UAM retries to connect to the LDAP server.

¡ Connection Wait Time—Enter the maximum duration of each connection attempt. If UAM fails to connect to the LDAP server within this period, the connection attempt is considered failed.

¡ Sync Wait Time—Enter the maximum duration of each synchronization. The sync wait timer starts when UAM starts synchronizing user data from the LDAP server. When this timer expires, UAM stops the synchronization, regardless of whether the synchronization is completed or not. If you do not want to set a time limit, set the timer to 0.

¡ Use SSL—Select the option to use SSL to encrypt the packets exchanged between UAM and the LDAP server. When this function is enabled, you must import associated certificates to UAM. For more information about importing certificates, see "Importing certificates." This parameter is displayed only when IMC is installed on the Windows server.

¡ Connectivity—If UAM failed to connect to the LDAP server, the field displays Unconnected within the reconnect interval. If UAM has successfully connected to the LDAP server, the field displays Connected. You can manually modify the connectivity status.

Other parameters cannot be modified.

4. Modify server information:

¡ Admin DN—Enter the absolute path that locates the administrator on the LDAP server.

¡ Admin Password—Enter the administrator password.

¡ User Attribute Name—Enter the attribute description used on the LDAP server for user names.

¡ Password Attribute—Enter the attribute description used on the LDAP server for user password. This parameter does not need to be configured when the Server Type is Microsoft AD, whose user passwords are not readable. The password attribute values in UAM correspond to user passwords in the LDAP server. For more information, see "Supplementary information for LDAP user passwords stored in UAM."

¡ Password Policy—Policy an LDAP user must comply with when modifying the password. This parameter is displayed only when the following requirements are met:

- The server type is set to Microsoft AD.

- SSL is used to encrypt the packets exchanged between UAM and the LDAP server.

- The User must change password at next logon option is selected on the LDAP server.

Other parameters cannot be modified. For more information, see "Adding an LDAP server."

5. Modify standby server information:

¡ Address—Enter the IP address or domain name of the standby LDAP server.

¡ Server in Use—Select the LDAP server being used for authenticating LDAP users.

¡ Auto Back to Primary—Select the option to enable Auto Back to Primary. When the primary LDAP server becomes unavailable, UAM switches over to the standby server and starts regularly checking the availability of the primary server. If the option is enabled, UAM automatically switches back to the primary server after the server becomes available.

If the option is disabled, UAM continues to use the standby server. This parameter does not take effect if you select Standby for Server in Use.

6. Modify PEAP-MSCHAPv2 authentication:

To perform MS-CHAPv2 authentication on LDAP users, select the MS-CHAPv2 Authentication option and configure the following parameters:

If the domain controller with the same IP address is configured for other LDAP servers, the servers use the current MS-CHAPv2 authentication settings.

IMPORTANT:

7. Click Test to test the connectivity to the LDAP server. If the connection attempt fails, follow the displayed tips to check for configuration errors.

8. Click OK.

If the LDAP server has been associated with a policy that performs synchronization on an as-needed basis and you have changed the password or user name attribute description, click On-Demand Sync on the synchronization policy page to validate the change.

For more information, see "Managing LDAP synchronization policies."

Deleting an LDAP server

You can delete LDAP servers that are not associated with LDAP synchronization policies.

When an LDAP server is deleted, UAM automatically removes all empty user groups that are synchronized from the LDAP server and do not contain sub-groups or users.

To delete an LDAP server:

1. Access the LDAP server list page.

2. Click the Delete icon for the LDAP server you want to delete.

A confirmation dialog box opens.

3. Click OK.

Importing certificates

To deliver SSL-based authentication between UAM and the LDAP server, you have to:

· Enable the SSL function on the LDAP server, and import the certificate required for SSL authentication to the server. For specific procedures, see the related LDAP server configuration guide.

Select the Use SSL option when adding or modifying the LDAP server in UAM. For specific procedures, see "Managing LDAP servers."

· Import the root certificate that is associated with the LDAP server certificate to UAM.

IMC supports the following server certificate file formats:

¡ PEM—Base64 encoded, with a file suffix .pem or .cer.

¡ DER—DER encoded, with a file suffix .der or .cer.

¡ PKCS12—PKCS 12 encoded, with a file suffix .pfx or .p12.

To import certificates to UAM:

1. Access the LDAP Server List page.

2. Click the Configure icon for an LDAP server to display the certificate import wizard.

3. Configure Add Root Certificate.

4. Click Browse in the Root Certificate area to select a locally saved root certificate.

5. Click Next to display the Certificate Preview page.

6. Verify the displayed root certificate information and click OK.

Batch-modifying LDAP server admin passwords

UAM allows you to modify LDAP server admin passwords in batches to facilitate maintenance.

To batch modify LDAP server admin passwords:

1. Access the LDAP server list page.

2. Select one or more LDAP servers.

3. Click Modify Admin Password to display the page for modifying the administrative password.

4. Enter the new administrative password for the selected LDAP servers.

5. Click OK.

Synchronizing user groups

UAM supports synchronizing user groups in the following ways:

· UAM can execute an LDAP synchronization policy to automatically build user groups based on the OU structure in the LDAP server and synchronize LDAP users to their respective user groups. If an LDAP user has moved from one OU to another, IMC also moves the LDAP user to the corresponding user group accordingly. For information about manually executing an LDAP synchronization policy, see "Manually executing a synchronization policy."

· Operators can manually trigger an OU structure synchronization. In this case, UAM builds only user groups based on the OU structure without synchronizing any users from the LDAP server.

The following rules apply during user group synchronization:

· If a new OU is found on the LDAP server, UAM creates a user group for the OU.

· If an OU has been removed from the LDAP server, UAM checks whether the corresponding user group contains users. If it does, UAM keeps the user group. Otherwise, UAM deletes the user group.

To synchronize only the user groups from LDAP servers:

1. Access the LDAP server list page.

2. Click Synchronize.

If no server in the LDAP server list is configured to build user groups based on OUs, the Synchronize button is unavailable.

After the synchronization is completed, UAM displays numbers of successfully added user groups, deleted user groups, and operation failures. If failures exist, click Download to download or view the reasons for failure in the operation log.

Managing LDAP synchronization policies

An LDAP synchronization policy determines:

· How you synchronize user data from an LDAP server to UAM.

· The scope of user data.

· How the user data is handled on UAM.

Users synchronized from the LDAP server become access users or device management users in UAM.

An LDAP synchronization policy can be bound to only one LDAP server, but an LDAP server can have multiple LDAP synchronization policies.

Accessing the LDAP synchronization policy list page

1. Click the User tab.

2. From the navigation tree, select User Access Policy > LDAP Service > Sync Policy.

The list includes all the LDAP synchronization policies.

Synchronization policy list contents

¡ Policy Name—LDAP synchronization policy name. This parameter displays detailed policy information.

¡ Server Name—LDAP server name associated with the LDAP synchronization policy name. This parameter displays detailed LDAP server information.

¡ Sync Object—User type of the synchronization policy:

- Access Users—The policy synchronizes users from the LDAP server to UAM as access users.

- Device Users—The policy synchronizes users from the LDAP server to UAM as device management users.

¡ Service Group—Service group to which the policy is assigned. It is always the same as the service group to which the LDAP server is assigned.

¡ Status—Validity of the synchronization policy: Valid or Invalid.

¡ Synchronization Priority—Priority of the LDAP synchronization policy. Synchronization policies with higher priority values are executed first in a scheduled synchronization task.

¡ Synchronize Users as Needed—Enable this option to save user account licenses.

- If this option is enabled, UAM synchronizes a new user from the LDAP server only after the user passes authentication.

- If this option is disabled, UAM synchronizes all the matching users from the LDAP server.

¡ Bind User—Displays a Bind User icon or empty.

- If the Sync Object is Access Users, this field provides a Bind User icon . Click the icon to view users that are bound to the policy. For more information about managing LDAP users, see "Managing LDAP users."

- If the Sync Object is Device Users, this field is empty.

¡ Synchronize—Click the Synchronize link for a synchronization policy link to execute the policy.

¡ Modify—Click the Modify icon to display the page for modifying the LDAP synchronization policy.

¡ Delete—Click the Delete icon to delete the LDAP synchronization policy.

Querying LDAP synchronization policies

1. Access the LDAP synchronization policy list page.

2. Specify one or more of the following query criteria in the Query Sync Policies area:

¡ Policy Name—Enter a partial or complete LDAP synchronization policy name. For example, if you enter lab, all policy names that contain lab are matched.

¡ Server Name—Select the LDAP server from the list.

¡ User Group—Click the Select User Group icon . The Select User Group window opens. Select a group and click OK. You can select only one user group for query. Because device users cannot be grouped, if you select a user group, any synchronization policy with the Sync Object set to Device Users cannot be queried.

¡ Sync Object—Select a user type from the list. Options include Access Users and Device Users.

¡ Service Group—Select from the list a service group configured in UAM.

The query ignores empty fields.

3. Click Query.

The list includes all LDAP synchronization policies that match the query criteria.

To clear the query criteria, click Reset. The list includes all LDAP synchronization policies.

Viewing LDAP synchronization policy details

The Sync Policy Information page contents vary with the policy synchronization object, which can be Access Users or Device Users.

Viewing policy information whose Sync Object is Access Users

To view detailed information about a synchronization policy whose Sync Object is Access Users:

1. Access the LDAP synchronization policy list page.

2. Click the name of an LDAP synchronization policy whose Sync Object is set to Access Users.

The Sync Policy Information page opens.

Sync Policy Basic Information area

¡ Policy Name—LDAP synchronization policy name.

¡ Server Name—LDAP server name.

¡ Base DN—Absolute path of the base directory that stores user data in the LDAP server.

¡ Sub-Base DN—Absolute path of the subdirectory that stores user data in the LDAP server. UAM synchronizes only the user data under the specified subdirectory from the server.

¡ Filter Condition—Filter criteria for the synchronization policy. Only users who match these criteria can be synchronized to UAM.

¡ States—Policy usability state: Valid or Invalid.

¡ Synchronization Priority—Priority of the LDAP synchronization policy. Synchronization policies with higher priority values are executed first in a scheduled synchronization task.

¡ Auto Synchronization—Automatic synchronization status.

- If this option is enabled (Yes), UAM automatically executes the synchronization policy every day as scheduled. The execution time depends on the system settings for scheduled daily tasks.

- If this option is disabled (No), UAM performs synchronization on an as-needed basis.

¡ Synchronize Users as Needed—You can enable this option to save user account licenses.

- If this option is enabled (Yes), UAM synchronizes a new user from the LDAP server only after the user passes authentication.

- If this option is disabled (No), UAM synchronizes all the matching users from the LDAP server.

¡ Synchronize New Users and Accounts—If this option is enabled (Yes), UAM synchronizes users that are not in the IMC platform's user database from the LDAP server, adds these users to the IMC platform and creates associated access user accounts in the UAM database. If this option is disabled (No), UAM does not synchronize users that are not in the IMC platform.

¡ Synchronize New Accounts of Existing Users—If this option is enabled (Yes), UAM adds an associated access account for a user during synchronization when both the following requirements are met:

- The user exists both in the IMC platform and the LDAP server.

- The user does not have an access user account in UAM.

If this option is disabled (No), UAM does not add access accounts for such users.

¡ Synchronize Users in Current Node Only—If this option is enabled (Yes), UAM synchronizes users directly under the specified sub-base DN, but does not synchronize users in any OU under the sub-base DN. If this option is disabled (No), UAM synchronizes all users in the sub-base DN, including users in the OUs in the sub-base DN.

¡ Inherit Parent Group's Service—This option is displayed only when the selected LDAP server uses the following settings:

- Manual Assignment is selected for the Service Sync Type field.

- The Apply for Service by User Group option is enabled.

- Synchronize by OU is selected for the User Group field.

With the Inherit Parent Group's Service option enabled, UAM applies for the services of the parent user group for the LDAP users who belong to a group of no service.

- If the parent user group has no service, UAM uses the services of the parent user group of that parent group, and so forth until the upper-most user group.

- If none of these parent user groups have services, UAM does not apply for any service for the LDAP users. When the Inherit Parent Group's Service option is disabled, UAM applies for the same services for each LDAP user as those assigned to the user group to which the LDAP user belongs.

- If a user belongs to a user group of no service, UAM does not apply for any service for the user.

¡ Service Group—Service group that the LDAP synchronization policy belongs to. It is always the same as the service group that the LDAP server is assigned to.

Basic Information area

¡ User Name—User name attribute description used on the LDAP server. UAM uses the value of this attribute as the user name of the LDAP user account when executing the synchronization policy.

¡ Identity Number—Identity attribute description used on the LDAP server. UAM uses the value of this attribute as the LDAP user identity when executing the synchronization policy.

¡ Contact Address—Contact address attribute description used on the LDAP server. UAM uses the value of the attribute as the LDAP user identity when executing the synchronization policy. An empty field indicates that user contact addresses are not synchronized from the LDAP server.

¡ Telephone—Telephone attribute description used on the LDAP server. UAM uses the value of this attribute as the user telephone number when executing the synchronization policy. An empty field indicates that user telephone numbers are not synchronized from the LDAP server.

¡ Email—Email attribute description used on the LDAP server. UAM uses the value of this attribute as the user email account when executing the synchronization policy. An empty field indicates that user email accounts are not synchronized from the LDAP server.

¡ User Group—User group that the LDAP users are assigned to in UAM. This option is displayed only when Manual Specify is selected for the User Group field of LDAP server specified in the synchronization policy.

Additional Information area

Attribute descriptions used on the LDAP server for user additional information fields, which vary with your choice. UAM uses the values of these attributes to populate the user additional information fields. An empty field indicates that the additional information settings are not synchronized from the LDAP server.

Access Information area

¡ Account Name—Attribute description used on the LDAP server for user account names. UAM uses the value of this attribute as the user account name when executing the synchronization policy.

¡ Expiration Time—Attribute description used on the LDAP server for user account expiration time. UAM uses the value of the attribute as the account expiration time when executing the synchronization policy. An empty field indicates that the account expiration time is not synchronized from the LDAP server.

¡ Max. Idle Time (Minutes)—Attribute description used on the LDAP server for the maximum idle time a user is allowed to have. UAM uses the value of this attribute as the maximum idle time settings when executing the synchronization policy. An empty field indicates that the maximum idle time settings are not synchronized from the LDAP server.

¡ Max. Concurrent Logins—Attribute description used on the LDAP server for the maximum number of concurrent logins allowed with the same user account. UAM uses the value of this attribute as the maximum concurrent logins setting when executing the synchronization policy. An empty field indicates that the maximum concurrent logins settings are not synchronized from the LDAP server.

¡ Login Message—Login message attribute description used on the LDAP server. UAM uses the value of this attribute as the message displayed at user login when executing the synchronization policy. An empty field indicates that login messages are not synchronized from the LDAP server.

Access Device Binding Information area

¡ Device IP—Access device IP address attribute description used on the LDAP server. UAM uses the value of the attribute as the access device IP address when executing the synchronization policy. An empty field indicates that the device IP addresses are not synchronized from the LDAP server.

¡ Port—Access device port attribute description used on the LDAP server. UAM uses the value of the attribute as the access device port number when executing the synchronization policy. An empty field indicates that the device port numbers are not synchronized from the LDAP server.

¡ VLAN ID/Inner VLAN ID—Attribute description used on the LDAP server for access device VLAN ID/Inner VLAN ID. UAM uses the value of this attribute as the device VLAN ID/Inner VLAN ID when executing the synchronization policy. An empty field indicates that the device VLAN IDs/Inner VLAN IDs are not synchronized from the LDAP server.

¡ Outer VLAN ID—Attribute description used on the LDAP server for access device Outer VLAN ID. UAM uses the value of this attribute as the device Outer VLAN ID when executing the synchronization policy. An empty field indicates that the device outer VLAN IDs are not synchronized from the LDAP server.

¡ User SSID—Wireless SSID attribute description on the LDAP server. UAM uses the value of this attribute as the SSID for the wireless user when executing the synchronization policy. An empty field indicates that the SSIDs are not synchronized from the LDAP server.

¡ Device SN—Attribute description used on the LDAP server for the device sequence number. UAM uses the value of the attribute as the device sequence number when executing the synchronization policy. An empty field indicates that device sequence numbers are not synchronized from the LDAP server.

Access service list contents

This area is displayed only when the system parameter Apply for Service by User Group is disabled. For more information about the Apply for Service by User Group feature, see "Configuring global system settings."

The list includes the services that have been applied for by the users synchronized to UAM.

Viewing policy information whose Sync Object is Device Users

To view detailed information about a synchronization policy whose Sync Object is Device Users:

1. Access the LDAP synchronization policy list page.

2. Click the name of an LDAP synchronization policy whose Sync Object is set to Device Users.

The Sync Policy Information page opens.

Sync Policy Basic Information area

¡ Policy Name—LDAP synchronization policy name.

¡ Server Name—LDAP server name.

¡ Base DN—Absolute path of the base directory that stores user data in the LDAP server.

¡ Sub-Base DN—Absolute path of the subdirectory that stores user data in the LDAP server. UAM synchronizes only the user data under the specified subdirectory from the server.

¡ Filter Condition—Filter criteria for the synchronization policy. Only users who match these criteria can be synchronized to UAM.

¡ Status—Policy usability state: Valid or Invalid.

¡ Auto Synchronization—Automatic synchronization status.

- If this option is enabled (Yes), UAM automatically executes the synchronization policy every day as scheduled. The execution time depends on the system settings for scheduled daily tasks.

- If this option is disabled (No), UAM performs synchronization on an as-needed basis.

¡ Create Device User—If this option is enabled (Yes), UAM synchronizes users that do not exist in UAM from the LDAP server, and add these users to UAM database as device management users. If this option is disabled (No), UAM does not synchronize users in LDAP server that do not exist in UAM.

¡ Service Group—Service group that the LDAP synchronization policy belongs to. It is always the same as the service group that the LDAP server is assigned to.

¡ Sync Object—Displays Device Users, which indicates that the policy synchronizes users from LDAP server to UAM as device management users.

Basic Information of Device User area

¡ User Name Attribute—Attribute description used on the LDAP server for user names. UAM uses the value of the attribute as the user name of the LDAP user account when executing the synchronization policy.

¡ Password Attribute—Attribute description used on the LDAP server for user passwords. UAM uses the value of the attribute as the user password when executing the synchronization policy.

For more information about LDAP user passwords, see "Supplementary information for LDAP user passwords stored in UAM."

¡ Full Name—Full name of the device management user.

¡ User Password—Local user passwords in UAM, which can be manually configured, or synchronized from a certain attribute on the LDAP server. If the parameter is manually configured, the field displays a series of asterisks (****). If the parameter is synchronized from the LDAP server, the field displays the attribute description. For more information, see "Supplementary information for LDAP user passwords stored in UAM."

¡ Login Type—Login type of the device management user. Options include Telnet, FTP, SSH, and Terminal.

¡ Service Type—Value of the service type in the Access-Accept packet sent to the device. The value of the service type can be Login, Framed, Callback Login, Callback Framed, Outbound, Administrative, NAS Prompt, Authenticate Only, Callback NAS Prompt, Call Check, or Callback Administrative.

¡ EXEC Priority—Level of the command execution privilege assigned to the device management user. The value is an integer in the range of 0 to 15. A greater value represents a higher privilege, which grants users to execute more commands. If the field is empty, the user uses the default level specified on the device.

¡ FTP Directory—Accessible FTP directory for the device management user. This field is displayed only when the Login Type is FTP. If the parameter is not configured, this field displays two consecutive hyphens (--), and the user enters the default FTP directory on the device after login.

Bound User IP List area

The list contains one or more IPv4 or IPv6 address ranges permitted for logins. A device management user can log in to a device only when the IP address of the user is in the list.

IP Address List of Managed Devices area

The list contains one or more IPv4 or IPv6 address ranges of managed devices. Device management users can only log into the devices specified in the list.

Adding an LDAP synchronization policy

Configuring an LDAP synchronization policy for an LDAP server differs depending on the synchronization type, service sync type, and the way you assign services to the LDAP users.

Adding a policy when the Service Sync Type is Manual Assignment

1. Access the LDAP synchronization policy list page.

2. Click Add.

3. Configure basic policy information:

¡ Policy Name—Enter a unique policy name.

¡ Server Name—Select the LDAP server to which you want to assign the policy. Available options are all the LDAP servers that have been configured in UAM.

¡ Service Group—Displays the service group that the LDAP synchronization policy belongs to. The system automatically populates this field with the same service group as the LDAP server.

¡ Synchronization Priority—Enter the priority of the LDAP synchronization policy. Synchronization policies with higher priority values are executed first in a scheduled synchronization task.

¡ Base DN—Displays the absolute path of the directory that stores user data in the LDAP server. The system automatically populates this field with the base DN specified for the LDAP server.

¡ Sub-Base DN—Enter the absolute path of the subdirectory that stores user data in the LDAP server. Make sure that it is in the base DN directory or is the same as the base DN directory. UAM synchronizes the user data under sub-base DN rather than base DN. The DNs of attributes vary with LDAP servers. To get the correct sub-base DN path, use a tool such as Softerra LDAP Administrator.

¡ Filter Condition—Enter a filter to match user data you want to synchronize to UAM. The default filter condition is (&(objectclass=user)(sAMAccountName=*)(accountExpires>=now)). The most basic filter must be in the format (attribute=value), where you can use the wildcard asterisk (*) in some value patterns to match any character or character string. For example, the filter (cn=He*) matches any entry that has a cn attribute value that starts with He.

You can use an advanced filter in the format (operator(attribute1=value)(attribute2=value)) or (operator(attribute1=value)(operator(attribute2=value))). The operator can be AND (&), OR (|), or NOT (!). For example, the filter (&(objectclass=a*)(!(cn=b*))) enables UAM to synchronize any entry that has an objectclass attribute value starting with a but a cn attribute value not starting with b. The default filter is (&(objectclass=*)(cn=*)), which matches entries that have any objectclass attribute value and any cn attribute value.

To filter out expired users, use the following filter conditions:

Filter condition	Meaning
accountExpires>=now	Do not synchronize expired users.
accountExpires<=now	Synchronize expired users only.
accountExpires>=now+n	Do not synchronize users that are already expired and will be expired in n days.
accountExpires>=now-n	Do not synchronize users that have been expired for n days.
accountExpires<=now+n	Synchronize users that are already expired and will be expired in n days.
accountExpires<=now-n	Synchronize users that have been expired for n days.

¡ Status—Select Valid or Invalid from the list to enable or disable the policy. Disabling the policy does not affect users that have been synchronized to UAM. They can continue to use the authentication service and self-service. To re-enable a policy, examine the additional user information fields in the policy to make sure they exist in the IMC platform and change the policy state to Valid.

¡ Sync Object—Select a user type, Access Users or Device Users, from the list. Select Access User to synchronize users from the LDAP server to UAM as access users. Select Device Users to synchronize users from the LDAP server to UAM as device management users. Select Access User in this example.

To avoid synchronization errors, all synchronization policies change to the invalid state when the additional user information field settings are added, modified, or deleted in the user management module of the IMC platform.

¡ Sync Options-Auto synchronization—Select this option to execute the policy every day to synchronize all matching users to UAM. The execution time depends on the system settings for scheduled daily tasks. For more information, see "Configuring global system settings."

¡ Sync Options-Synchronize Users as Needed—Select this option to have UAM synchronize a new policy-matching user from the server only after the user passes authentication. This option and the automatic synchronization option are mutually exclusive. If you have a limited number of licenses, use this option to save user licenses.

¡ Sync Options-Synchronize New Users and Accounts—Select this option to have UAM synchronize users that are not in the IMC platform's user database from the LDAP server, add these users to the IMC platform and create associated access user accounts in UAM. If this option is not selected, UAM does not synchronize users that are not in the IMC platform. This option is mutually exclusive with the Synchronize Users as Needed option.

¡ Sync Options-Synchronize New Accounts of Existing Users—Select this option to have UAM add associated access user accounts in UAM for users that exist both in the IMC platform's user database and LDAP server but do not have access accounts in UAM. If this option is not selected, UAM does not add access accounts for such users.

¡ Sync Options-Synchronize Users in Current Node Only—Select this option to have UAM synchronize users under the specified sub-base DN, but not synchronize users in any OU under the sub-base DN. If this option is not selected, UAM synchronizes all users in the sub-base DN, including users in the OUs in the sub-base DN.

¡ Sync Options-Inherit Parent Group's Service—This option is displayed only when the selected LDAP server uses the following settings:

- Manual Assignment is selected for the Service Sync Type field.

- The Apply for Service by User Group option is enabled.

- Synchronize by OU is selected for the User Group field.

For more information about the LDAP server configuration, see "Managing LDAP servers." With the Inherit Parent Group's Service option enabled (Yes), UAM applies for the services of the parent user group for the LDAP users who belong to a group of no service.

- If the parent user group has no service, UAM uses the services of the parent user group of that parent group, and so forth until the upper-most user group.

- If none of these parent user groups have services, UAM does not apply for any service for the users. When the Inherit Parent Group's Service option is disabled (No), UAM applies for the same services for each LDAP user as those assigned to the user group to which the LDAP user belongs.

- If a user belongs to a user group of no service, UAM does not apply for any service for the user.

4. Click Test to verify the settings. If the settings are incorrect, modify the settings according to the prompt information at the top of the page.

5. Click Next. The page for configuring access user parameters opens.

6. Configure access user parameter associations with the attributes on the LDAP server.

Configure basic information

¡ User Name—Select the user name attribute description used on the LDAP server from the list. UAM uses the value of the attribute as the user name of the LDAP user account when executing the synchronization policy.

¡ Identity Number—Select the identity attribute description used on the LDAP server from the list. UAM uses the value of the attribute as the LDAP user identity when executing the synchronization policy.

¡ Contact Address—Select the contact address attribute description used on the LDAP server from the list, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the user contact address when executing the synchronization policy. If you select Do Not Sync, user contact addresses are not synchronized from the LDAP server.

¡ Telephone—Select the telephone attribute description used on the LDAP server from the list, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the user telephone number when executing the synchronization policy. If you select Do Not Sync, user telephone numbers are not synchronized from the LDAP server.

¡ Email—Select the email attribute description used on the LDAP server from the list, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the user email account when executing the synchronization policy. If you select Do Not Sync, user email accounts are not synchronized from the LDAP server.

¡ User Group—This option is displayed only when Manual Specify is selected for the User Group field for the LDAP server specified in the synchronization policy. Click the Select User Group icon . The Select User Group window opens. Select an existing user group and click OK. All the users synchronized from the LDAP server under this policy are assigned to the selected user group.

Configure additional information

This area is displayed only when the additional user information is configured on the IMC platform.

Select an attribute from the list to represent the user additional information entry, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute to populate the user additional information field when executing the synchronization policy. If you select Do Not Sync, specify the user additional information based on pre-defined rules.

Configure access information

¡ Account Name—The system automatically populates this field with the account name attribute description configured when adding the LDAP server, which cannot be modified.

¡ Expiration Time—Select an attribute to represent the expiration time of the LDAP user account, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the account expiration time when executing the synchronization policy. If you select Do Not Sync, enter the expiration time in the format of YYYY-MM-DD or click the Calendar icon to set the time.

¡ User Password—Select an attribute from the list to represent the user password, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the user password when executing the synchronization policy. If you select Do Not Sync, enter a user password in the text box next to the list.

¡ Max. Idle Time (Minutes)—Select an attribute from the list to represent the maximum idle time, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the maximum idle time when executing the synchronization policy. If you select Do Not Sync, enter a maximum idle time in the text box next to the list.

¡ Max. Concurrent Logins—Select an attribute from the list to represent the maximum number of concurrent logins allowed with the same user account, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the maximum number of concurrent logins with the same user account when executing the synchronization policy. If you select Do Not Sync, enter the maximum concurrent logins in the text box next to the list.

¡ Login Message—Select an attribute from the list to represent the login messages displayed when the users attempt to access the network, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the user login message when executing the synchronization policy. If you select Do Not Sync, enter a user login message in the text box next to the list.

Configure access device binding information

¡ Device IP—Select an attribute from the list to represent the device IP address, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the device IP address when executing the synchronization policy. If you select Do Not Sync, enter a device IP address in the text box next to the list.

¡ Port—Select an attribute from the list to represent the device port number, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the device port number when executing the synchronization policy. If you select Do Not Sync, enter a device port number in the text box next to the list.

¡ VLAN ID/Inner VLAN ID—Select an attribute from the list to represent the device VLAN ID/Inner VLAN ID, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the device VLAN ID/Inner VLAN ID when executing the synchronization policy. If you select Do Not Sync, enter a device VLAN ID/Inner VLAN ID in the text box next to the list.

¡ Outer VLAN ID—Select an attribute from the list to represent the device Outer VLAN ID, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the device Outer VLAN ID when executing the synchronization policy. If you select Do Not Sync, enter a device Outer VLAN ID in the text box next to the list.

¡ User SSID—Select an attribute from the list to represent the user SSID, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the user SSID when executing the synchronization policy. If you select Do Not Sync, enter a user SSID in the text box next to the list.

¡ Device SN—Select an attribute from the list to represent the device sequence number, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the device sequence number when executing the synchronization policy. If you select Do Not Sync, enter a device sequence number in the text box next to the list.

7. Assign services to the LDAP users.

This area is displayed only when the system parameter Apply for Service by User Group is disabled. For more information about system parameters, see "Configuring global system settings."

The list includes all services available for the users. You may select multiple services with different suffixes. To select a service, click the box next to it.

8. Click Finish.

Adding a policy when the Service Sync Type is based on AD group

1. Access the LDAP synchronization policy list page.

2. Click Add.

3. Configure basic policy information:

¡ Policy Name—Enter a policy name, which must be unique among all the LDAP synchronization policies in UAM.

¡ Server Name—Select the LDAP server to which you want to assign the policy. Available options are all the LDAP servers that have been configured in UAM.

¡ Service Group—Displays the service group that the LDAP synchronization policy belongs to. The system automatically populates this field with the same service group that the LDAP server is assigned to.

¡ Synchronization Priority—Specify the priority of the LDAP synchronization policy. Synchronization policies with higher priority values are executed first in a scheduled synchronization task.

¡ Base DN—Displays the absolute path of the directory that stores user data in the LDAP server. The system automatically populates this field with the base DN specified for the LDAP server.

¡ Sub-Base DN—Enter the absolute path of the subdirectory that stores user data in the LDAP server and make sure that it is in the base DN directory or be the same as the base DN directory. UAM synchronizes the user data under sub-base DN rather than base DN. The DNs of attributes vary with LDAP servers. To get the correct sub-base DN path, use a tool such as Softerra LDAP Administrator.

¡ Filter Condition—Enter a filter to match user data you want to synchronize to UAM. The most basic filter takes the form (attribute=value), where you can use the wildcard asterisk (*) in the value pattern to match any character or character string. For example, the filter (cn=He*) matches any entry that has a cn attribute value that starts with He.

¡ Sync Object—Select Access Users or Device Users from the list. Select Access Users to synchronize users from the LDAP server to UAM as access users. Select Device Users to synchronize users from the LDAP server to UAM as device management users. In this example, the Access Users option is selected.

¡ Sync Options-Synchronize New Users and Accounts—Select this option to have UAM synchronize users that are not in the IMC platform's user database from the LDAP server, add these users to the IMC platform, and create associated access user accounts in UAM. If this option is not selected, UAM does not synchronize users that are not in the IMC platform. This option is mutually exclusive with the Synchronize Users as Needed option.

4. Click Next to assign services to AD groups.

5. Assign services to AD groups.

AD groups are organized in a tree hierarchy, see Figure 101. Users may use the service assigned to a specific AD group in the chain of AD groups on top of them, depending on your configuration.

Service assignment page includes two areas: Basic Information and Group & Service Configuration List.

Basic Info

¡ Default Service—Select a default service for the LDAP users. This service is assigned to an LDAP user if no service has been assigned to any AD group available for the user.

¡ Service Query Level—Select the number of AD group layers to be searched for services for the LDAP users. Options include 1 to 5. The AD group that has the users is Layer 1.

UAM starts the search from Layer 1 AD group and moves up until services are found in an AD group or the specified top layer is reached.

If no service is assigned to any of these AD groups, the default service is assigned to the users. The rules that UAM uses to assign services to LDAP users are described later in this topic.

AD Group & Service Configurations

The configuration list displays the service assignment for the AD groups and the AD group priority.

To assign a service to an AD group:

a. Click Add in the AD Group & Service Configurations area.

b. Enter a partial or complete group name in the LDAP group query field. For example, if you enter a, all group names that contain a are matched. If the field is empty, all available groups are matched.

c. Click Query.

All the AD groups matching the query criterion are displayed in the AD Group & Service Configurations area.

d. Select one or more group names, and click OK.

All the selected AD groups are displayed in the AD Group & Service Configurations area. The AD Group Distinguished Name column displays the AD group and its absolute path in the active directory. The Service Configuration column provides a Service Configuration icon . Click the icon to view the available services list.

To delete AD groups, select the boxes next to their group names, and click Delete. In the confirmation dialog box that opens, click OK.

e. Select services for each AD group.

Click the Service Configuration icon for an AD group. The Services List window opens. Select one or more services and click OK. The selected services are associated with the AD group.

f. Adjust the priorities for the AD groups.

Click the Move down icon for an AD group to reduce its priority.

Click the Move up icon for an AD group to raise its priority.

g. Click Next. The page for configuring LDAP user parameters opens.

Rules for assigning services to LDAP users

UAM uses the following rules to assign a service to an LDAP user in only one AD group:

¡ Assigns the service in the AD group to the user.

¡ If the AD group has no service, assigns the service in its parent AD group to the user. If the parent AD group has no service, moves up until an AD group is found having services or the specified maximum number of AD group layers is reached.

¡ If none of the AD group layers have a service, assigns the default service to the user.

UAM uses the following rules to assign services to an LDAP user in more than one AD group:

¡ If at least two of the AD groups have a service, compares the priorities of AD groups, and assigns the services of a higher priority AD group to the user.

¡ If none of the AD groups have services, searches their respective parent AD groups for services. If only one parent AD group has services, assigns the service to the user. If at least two parent AD groups a have a service, compares the priorities of the AD groups, and assigns the services of a higher priority AD group to the user. If none of their parent AD groups have a service, moves up the chains of AD groups until one AD group is found having a service or the specified maximum number of AD group layers is reached.

¡ If none of the AD group layers have a service, assigns the default service to the user.

See the AD group tree hierarchy in Figure 101. For users in group C1, the AD group chain available for service assignment is C1 > B1 > A. For users in C5 group, the AD group chain available for service assignment is C5 > B2 > A. UAM moves up the chains to search for a service for the users.

Suppose the Service Query Level is 3, group C1 (AD group priority 2) has service L1S1, group C2 has no service, group C4 (AD group priority 3) has service L1S4, group C5 has no service, group B1 has service L2S1, group B2 has no service, and group A has service L3S.

For users only in group C1, UAM assigns service L1S1. For users in groups C1 and C4, UAM assigns service L1S4, because group C4 is at the same layer as C1 but has higher LDAP priority. For users in group C2, UAM assigns service L2S1, the service of group B1, because even though group C2 has no service, its parent group (group B1) has the service and is below the top layer set by Service Query Level. For users in group C5, UAM assigns service L3S (the service of group A), because the two lower-layer AD groups in the AD group chain (C5 -> B2 -> A) have no services, and group A is the top layer set by Service Query Level.

Figure 101 AD group tree hierarchy

6. Configure access user parameter associations with the attributes on the LDAP server.

Configure basic information

¡ User Group—Click the Select User Group icon . The Select User Group window opens. Select a group and click OK. Available options include all the user groups that have been created on UAM. Users synchronized from the LDAP server under this policy belong to the selected user group.

Configure additional information

This field is displayed only when the additional user information is configured on IMC platform.

Configure access information

¡ Account Name—The system automatically populates this field with the account name attribute description configured when adding the LDAP server, which cannot be modified.

¡ Login Message—Select an attribute from the list to represent the login messages displayed when the users attempt to access the network, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the login message when executing the synchronization policy. If you select Do Not Sync, enter a login message in the text box next to the list.

Configure access device binding information

¡ User SSID—Select an attribute from the list to represent the wireless SSID, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the SSID when executing the synchronization policy. If you select Do Not Sync, enter an SSID in the text box next to the list.

7. Click Finish.

Adding a policy with the Sync Object set to Device Users

To add a policy with the synchronization object set to Device Users:

1. Access the LDAP synchronization policy list page.

2. Click Add to display the page for adding synchronization policies.

3. Configure the following basic policy information:

¡ Policy Name—Enter a policy name, which must be unique among all the LDAP synchronization policies in UAM.

¡ Server Name—Select the LDAP server to which you want to assign the policy. Available options are all the LDAP servers that have been configured in UAM.

¡ Service Group—Displays the service group that the LDAP synchronization policy belongs to. The system automatically populates this field with the same service group as the LDAP server.

¡ Synchronization Priority—Specify the priority of the LDAP synchronization policy. Synchronization policies with higher priority values are executed first in a scheduled synchronization task.

¡ Base DN—Displays the absolute path of the directory that stores user data in the LDAP server. The system automatically populates this field with the base DN specified for the LDAP server.

¡ Sub-Base DN—Enter the absolute path of the subdirectory that stores user data in the LDAP server and make sure that it is in the base DN directory or is the same as the base DN directory. UAM synchronizes the user data under sub-base DN rather than base DN. The DNs of attributes vary with LDAP servers. To get the correct sub-base DN path, use a tool such as Softerra LDAP Administrator.

¡ Sync Options-Create Device User—Select this option to have UAM synchronize from the LDAP server users that do not exist in UAM, and add these users to UAM database as device management users. If you do not select this option, users in LDAP server that do not exist in UAM are not synchronized.

4. Click Next. The page for configuring device management user information opens.

5. Configure the device management user parameter associations with the attributes on the LDAP server.

Configure basic information of the device management user

¡ User Name Attribute—Displays the user name attribute that is configured when adding/modifying an LDAP server, which cannot be modified.

¡ Password Attribute—Displays the password attribute that is configured when adding or modifying an LDAP server, which cannot be modified. Each user password in UAM corresponds to a user password in the LDAP server. For more information, see "Supplementary information for LDAP user passwords stored in UAM."

¡ Full Name—Select an attribute from the list to represent the full name of the device management user. If you select Do Not Sync, the system does not synchronize this parameter.

¡ User Password—Select an attribute from the list to represent the local user password, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the local user password when executing the synchronization policy. If you select Do Not Sync, enter a local user password in the text box next to the list. For more information about user passwords, see "Supplementary information for LDAP user passwords stored in UAM."

¡ User Password/Confirm Password—If you select Do Not Sync for the User Password field, enter the same password twice in both fields to set it as the local user password.

¡ Login Type—Select a login type for the device management users from the list. Options include Telnet, FTP, SSH, and Terminal.

¡ Service Type—Select a service type sent to the device. UAM sets the value of the service type in the Access-Accept packet sent to the device after the device management user passes authentication. If this field is not configured, UAM sends the default value of the service type in the Access-Accept packet to the device. The value of the service type includes:

- Login—The user should be connected to a host.

- Framed—A Framed Protocol should be enabled for the user, such as PPP or SLIP.

- Callback Login—The user should be disconnected and called back, and then be reconnected to a host.

- Callback Framed—The user should be disconnected and called back, and then a Framed Protocol should be enabled for the user, such as PPP or SLIP.

- Outbound—The user should be granted access to outgoing devices.

- Administrative—The user should be granted access to the NAS through the administrative interface from which privileged commands can be executed.

- NAS Prompt—The user should be provided a command prompt on the NAS from which non-privileged commands can be executed.

- Authenticate Only—Only Authentication is requested, and no authorization information is returned in the Access-Accept packet (typically used by proxy servers rather than the NAS).

- Callback NAS Prompt—The user should be disconnected and called back, and then be provided with a command prompt on the NAS from which non-privileged commands can be executed.

- Call Check—Used by the NAS in an Access-Request packet to indicate that a call is being received. The RADIUS server should send back an Access-Accept packet to answer the call, or an Access-Reject packet to reject the call, typically based on the Called-Station-Id or Calling-Station-Id attributes. As a best practice, use the value of Calling-Station-Id in the Access-Request packets as the value of the User-Name.

- Callback Administrative—The user should be disconnected and called back, and then be granted access to the NAS through the administrative interface from which privileged commands can be executed.

¡ EXEC Priority—Specify the level of command execution privilege assigned to the device management users. The value range from 0 to 15. A greater value represents a higher privilege, which grants users to execute more commands. If the parameter is not configured, the user uses the default level specified on the device.

¡ FTP Directory—Enter the FTP directory accessible to the device management user. This field is displayed only when the Login Type is FTP. If the parameter is not configured, the user enters the default FTP directory on the device. If you configure a nonexistent directory, the device management user might fail to log into the device.

Configure the Bound User IP List area

Specify one or more IPv4 address ranges permitted for logins in the list. A device management user can log in to a device only when the IP address of the user is in the list.

To configure the bound user IP list:

a. Click Add in the Bound User IP List area. The page for adding IP addresses opens.

b. Specify the start and end IP addresses.

Select an attribute from the list to synchronize the IP addresses from the LDAP server. Or select Do Not Sync, and then manually enter the IP addresses. Either way, the end IP address must be greater than the start one.

c. Click OK.

d. Repeat steps a through c to add more IP address ranges.

e. To delete an IP address range, click the Delete icon of the IP address range, and then click OK in the confirmation dialog box that opens.

f. To clear the list, click Delete all.

Configure the IP Address List of Managed Devices area

Specify one or more IPv4 address ranges of devices that can be managed in the list. Device management users can only log into the devices specified in the list.

To configure the IP address list of managed devices:

g. Click Add in the IP Address List of Managed Devices area. The page for adding devices opens.

h. Specify the start and end IP addresses.

i. Click OK.

j. Repeat steps a through c to add more device IP address ranges.

k. To delete a device range, click the Delete icon of the IP address range, and then click OK in the dialog box that opens.

l. To clear the list, click Delete all.

6. Click OK.

Modifying an LDAP synchronization policy

There are three ways of modifying an LDAP synchronization policy for an LDAP server, depending on policy sync object, service sync type, and the way you assign services to the LDAP users.

Modifying a policy when the Service Sync Type is Manual Assignment

1. Access the LDAP synchronization policy list page.

2. Click the Modify icon for the synchronization policy you want to modify.

The page for modifying the synchronization policy opens.

3. Modify basic policy information.

¡ Service Group—Displays the service group that the LDAP synchronization policy belongs to. The system automatically populates this field with the same service group as the LDAP server.

¡ Synchronization Priority—Modify the priority of the LDAP synchronization policy. Synchronization policies with higher priority values are executed first in a scheduled synchronization task.

¡ Base DN—Displays the absolute path of the directory that stores user data in the LDAP server. The system automatically populates this field with the base DN specified for the LDAP server.

¡ Filter Condition—Enter a filter to match user data you want to synchronize to UAM. The default filter is (&(objectclass=*)(cn=*)), which matches entries that have any objectclass attribute value and any cn attribute value. For information about defining a filter, see "Adding a policy when the Service Sync Type is Manual Assignment."

¡ Sync Options–Auto Synchronization—Select this option to execute the policy every day to synchronize all matching users to UAM. The execution time depends on the system settings for scheduled daily tasks. For more information, see "Configuring global system settings."

¡ Sync Options–Synchronize Users as Needed—Select this option to have UAM synchronize a new policy-matching user from the server only after the user passes authentication. This option and the automatic synchronization option are mutually exclusive. If you have a limited number of licenses, use this option to save user licenses. To avoid synchronization errors, see "Configure basic policy information:."

¡ Sync Options–Synchronize New Users and Accounts—Select this option to have UAM synchronize users that are not in the IMC platform's user database from the LDAP server, add these users to the IMC platform, and create associated access user accounts in UAM. If this option is not selected, UAM does not synchronize users that are not in the IMC platform. This option is mutually exclusive with the Synchronize Users as Needed option.

¡ Sync Options–Synchronize New Accounts of Existing Users—Select this option to have UAM add associated access user accounts in UAM for users that exist both in the IMC platform's user database and LDAP server but do not have access accounts in UAM. If this option is not selected, UAM does not add access accounts for such users.

¡ Sync Options–-Synchronize Users in Current Node Only—Select this option to have UAM synchronize users under the specified sub-base DN, but not synchronize users in any OU under the sub-base DN. If this option is not selected, UAM synchronizes all users in the sub-base DN, including users in the OUs in the sub-base DN.

¡ Sync Options–Inherit Parent Group's Service—This option is displayed only when the selected LDAP server uses the following settings: Manual Assignment selected for the Service Sync Type field, the Apply for Service by User Group option enabled, and Synchronize by OU selected for the User Group field. For more information about the LDAP server configuration, see "Managing LDAP servers." With the Inherit Parent Group's Service option enabled, UAM applies for the services of the parent user group for the LDAP users who belong to a group of no service. If the parent user group has no service, UAM uses the services of the parent user group of that parent group, and so forth until the upper-most user group. If none of these parent user groups have services, UAM does not apply for any service for the users. When the Inherit Parent Group's Service option is disabled, UAM applies for the same services for each LDAP user as those assigned to the user group to which the LDAP user belongs. If a user belongs to a user group of no service, UAM does not apply for any service for the user.

Other parameters cannot be modified.

4. Click Test to verify the settings. If the settings are incorrect, modify the settings according to the prompt information at the top of the page.

5. Click Next. The Access User Configuration page opens.

6. Modify the access user parameter associations with the attributes on the LDAP server.

Modify basic information

¡ User Group—This option is displayed only when Manual Specify is selected for the User Group field for the LDAP server specified in the synchronization policy. Click the Select User Group icon . The Select User Group window opens. Select an existing user group and click OK. All users synchronized from the LDAP server to UAM under this policy are assigned to the selected user group.

Modify additional information

This area is displayed only when the additional user information is configured on the IMC platform.

Modify access information

¡ Account Name—The system automatically populates this field with the account name attribute description configured when adding the LDAP server, which cannot be modified.

¡ Expiration Time—Select an attribute to represent the expiration time of the LDAP user account or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the account expiration time when executing the synchronization policy. If you select Do Not Sync, enter the expiration time in the format of YYYY-MM-DD or click the Calendar icon to set the time.

¡ Password—Select an attribute from the list to represent the user password or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the user password when executing the synchronization policy. If you select Do Not Sync, enter a user password in the text box next to the list.

¡ Max. Idle Time—Select an attribute from the list to represent the maximum idle time allowed for a user, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the maximum idle time when executing the synchronization policy. If you select Do Not Sync, enter a maximum idle time in the text box next to the list.

¡ Login Message—Select an attribute from the list to represent the login message displayed when the users attempt to access the network, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the login message when executing the synchronization policy. If you select Do Not Sync, enter a login message in the text box next to the list.

Modify access device binding information

¡ Outer VLAN ID—Select an attribute from the list to represent the device outer VLAN ID, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the device outer VLAN ID when executing the synchronization policy. If you select Do Not Sync, enter a device Outer VLAN ID in the text box next to the list.

¡ User SSID—Select an attribute from the list to represent the wireless SSID, or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the wireless SSID when executing the synchronization policy. If you select Do Not Sync, enter an SSID in the text box next to the list.

Reassign services to the LDAP users

This area is displayed only when the system parameter Apply for Service by User Group is disabled. For more information about system parameters, see "Configuring global system settings."

The access service list displays all services available for the users. You may select multiple services with different suffixes. To select a service, click the box next to it.

7. Click Finish.

Modifying a policy when the Service Sync Type is based on AD group

1. Access the LDAP synchronization policy list page.

2. Click the Modify icon for the synchronization policy you want to modify.

The page for modifying the synchronization policy opens.

3. Modify the following basic policy information:

¡ Service Group—Displays the service group that the LDAP synchronization policy belongs to. The system automatically populates this field with the same service group as the LDAP server.

¡ Base DN—Displays the absolute path of the directory that stores user data in the LDAP server. The system automatically populates this field with the base DN specified for the LDAP server.

¡ Synchronization Priority—Modify the priority of the LDAP synchronization policy. Synchronization policies with higher priority values are executed first in a scheduled synchronization task.

¡ Sub-Base DN—Enter the absolute path of the subdirectory that stores user data in the LDAP server. Make sure that it is in the base DN directory or will be the same as the base DN directory. UAM synchronizes the user data under sub-base DN rather than base DN. The DNs of attributes vary with LDAP servers. To get the correct sub-base DN path, use a tool such as Softerra LDAP Administrator.

¡ Sync Options–Auto synchronization—Select this option to execute the policy every day to synchronize all matching users to UAM. The execution time depends on the system settings for scheduled daily tasks. For more information, see "Configuring global system settings."

¡ Sync Options–Synchronize Users as Needed—Select this option to have UAM synchronize a new policy-matching user from the server only after the user passes authentication. This option and the Synchronize New Users and Accounts option are mutually exclusive. If you have a limited number of licenses, use this option to save user licenses. To avoid synchronization errors, see "Configure basic policy information:."

¡ Sync Options–Synchronize New Users and Accounts—Select this option to have UAM synchronize users that are not in the IMC platform's user database from the LDAP server, add these users to the IMC platform and create associated access user accounts in the UAM database. If this option is not selected, UAM does not synchronize users that are not in the IMC platform. This option is mutually exclusive with the Synchronize Users as Needed option.

¡ Sync Options–Synchronize New Accounts of Existing Users—Select this option to have UAM add associated access user accounts in UAM for users that exist both in the IMC platform's user database and LDAP server, but do not have access accounts in UAM. If this option is not selected, UAM does not add access accounts for such users.

Other parameters cannot be modified.

4. Click Next. The Access User Configuration page opens.

5. Reassign services to AD groups:

AD groups are organized in a tree hierarchy, see Figure 101. Users may use the services assigned to a specific AD group in the chain of AD groups on top of them, depending on your configuration.

Service assignment page includes two areas: Basic Information and Group & Service Configuration List.

Basic Info

¡ Default Service—Select a default service for the LDAP users. This service is assigned to an LDAP user if no service has been assigned to any AD group available for the user.

¡ Service Query Level—Select the number of AD group layers to be searched for services for the LDAP users. Options include 1 to 5. The AD group that has the users is Layer 1.

UAM starts the search from Layer 1 AD group and moves up until services are found in an AD group or the specified top layer is reached.

If no service is assigned to any of these AD groups, the default service is assigned to the users. The rules that UAM uses to assign services to LDAP users are described later in this topic.

AD Group & Service Configurations

The configuration list displays the service assignment for the AD groups and the AD group priority.

To assign a service to an AD group:

a. Click Add in the AD Group & Service Configurations area.

c. Click Query.

All the AD groups matching the query criterion are displayed in the AD Group & Service Configurations area.

d. Select one or more group names, and click OK.

To delete AD groups, select the boxes next to their group names, and click Delete. In the confirmation dialog box that opens, click OK.

e. Select services for each AD group.

Click the Service Configuration icon for an AD group. The Services List window opens. Select one or more services and click OK. The selected services are associated with the AD group.

f. Adjust the priorities for the AD groups.

Click the Move down icon for an AD group to reduce its priority.

Click the Move up icon for an AD group to raise its priority.

g. Click Next. The page for configuring LDAP user parameters opens.

Rules for assigning services to LDAP users

UAM uses the following rules to assign services to an LDAP user in only one AD group:

¡ Assigns the services in the AD group to the user.

¡ Assigns the services in its parent AD group to the user, if the AD group has no service. If the parent AD group has no services, it moves up until an AD group is found having services or the specified maximum number of AD group layers is reached.

¡ Assigns the default service to the user, if none of the AD group layers have services.

UAM uses the following rules to assign services to an LDAP user in more than one AD group:

¡ If at least two of the AD groups are associated a service, it compares the priorities of AD groups, and assigns the services of a higher priority AD group to the user.

¡ If none of the AD groups have services, it searches their respective parent AD groups for services. If only one parent AD group has services, it assigns the services to the user. If at least two parent AD groups are associated a service each, it compares the priorities of the AD groups and assigns the services of the group with a higher priority to the user. If none of their parent AD groups have services, it moves up the chains of AD groups until one AD group is found having services or the specified maximum number of AD group layers is reached.

¡ If none of the AD group layers have services, it assigns the default service to the user.

Look at the AD group tree hierarchy in Figure 102. For users in group C1, the AD group chain available for service assignment is C1 > B1 > A. For users in C5 group, the AD group chain available for service assignment is C5 > B2 > A. UAM moves up the chains to search services for the users.

Figure 102 AD group tree hierarchy

6. Modify the access user parameter associations with the attributes on the LDAP server.

Modify basic information

¡ Telephone—Select the telephone attribute description used on the LDAP server from the list. UAM uses the values of this attribute as the telephone numbers of LDAP users. If you select Do Not Sync, user telephone numbers are not synchronized from the LDAP server.

¡ Email—Select the email attribute description used on the LDAP server from the list. UAM uses the values of this attribute as the email accounts of LDAP users. If you select Do Not Sync, user email accounts are not synchronized from the LDAP server.

¡ User Group—Click the Select User Group icon . The Select User Group window opens. Select a group and click OK. Available options include all the user groups that have been created on IMC platform. Users synchronized from the LDAP server under this policy are assigned to the selected user group.

Modify additional information

This area is displayed when the additional user information is configured on the IMC platform.

Modify access information

¡ Account Name—The system automatically populates this field with the account name attribute description configured when adding the LDAP server, which cannot be modified.

¡ Expiration Time—Select an attribute to represent the expiration time of LDAP user account or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the expiration time when executing the synchronization policy. If you select Do Not Sync, enter the expiration time in the format of YYYY-MM-DD or click the Calendar icon to set the time.

¡ User Password—Select an attribute from the list to represent the user password or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the user password when executing the synchronization policy. If you select Do Not Sync, enter a user password in the text box next to the list.

¡ Max. Idle Time (Minutes)—Select an attribute from the list to represent the maximum idle time period a user is allowed to have or select Do Not Sync. If you select an attribute, UAM uses the value of the attribute as the maximum idle time period a user is allowed to have when executing the synchronization policy. If you select Do Not Sync, enter a maximum idle time in the text box next to the list.

Modify access device binding information

7. Click Finish.

Modifying a policy with the Sync Object set to Device Users

To modify a policy with the synchronization object set to Device Users:

1. Access the LDAP synchronization policy list page.

2. Click the Modify icon for the synchronization policy you want to modify.

The page for modifying synchronization policy opens.

3. Modify the following basic policy information:

¡ Service Group—Displays the service group that the LDAP synchronization policy belongs to. The system automatically populates this field with the same service group as the LDAP server.

¡ Synchronization Priority—Modify the priority of the LDAP synchronization policy. Synchronization policies with higher priority values are executed first in a scheduled synchronization task.

¡ Base DN—Displays the absolute path of the directory that stores user data in the LDAP server. The system automatically populates this field with the base DN specified for the LDAP server.

¡ Sub-Base DN—Enter the absolute path of the subdirectory that stores user data in the LDAP server Make sure that it is in the base DN directory or will be the same as the base DN directory. UAM synchronizes the user data under sub-base DN rather than base DN. The DNs of attributes vary with LDAP servers. To get the correct sub-base DN path, use a tool such as Softerra LDAP Administrator.

¡ Filter Condition—Enter a filter to match user data you want to synchronize to UAM. The default filter is (&(objectclass=*)(cn=*)), which matches entries that have any objectclass attribute value and any cn attribute value. For more information, see "Viewing policy information whose Sync Object is Device Users."

Other parameters cannot be modified.

4. Click Next. The Modify Device User page opens.

5. Modify the device user parameter associations with the attributes on the LDAP server.

Modify basic information of the device management user

¡ User Name Attribute—Displays the user name attribute that is configured when adding/modifying an LDAP server, which cannot be modified.

¡ Password Attribute—Displays the password attribute that is configured when adding/modifying an LDAP server, which cannot be modified. Each user password in UAM corresponds to a user password in the LDAP server. For more information, see "Supplementary information for LDAP user passwords stored in UAM."

¡ User Password/Confirm Password—If you select Do Not Sync for the User Password field, enter the same password twice in both fields that is displayed to set it as the local user password stored in UAM.

¡ Login Type—Select a login type for the device management user from the list. Options include Telnet, FTP, SSH, and Terminal.

¡ EXEC Priority—Specify the level of command execution privilege assigned to the device management user. The value range from 0 to 15. A greater value represents a higher privilege, which grants users to execute more commands. If the parameter is not configured, the user uses the default level specified on the device.

Modify the Bound User IP List area

Specify one or more IPv4 address ranges permitted for logins in the list. A device management user can log in to a device only when the IP address of the user is in the list.

To configure the bound user IP list:

a. Click Add in the Bound User IP List area. The page for adding IP address opens.

b. Specify the start and end IP addresses.

c. Click OK.

d. Repeat steps a through c to add more IP address ranges.

e. To delete an IP address range, click the Delete icon next to it. And then click OK in the confirmation dialog box that opens.

f. To delete one or more IP address ranges, select the box to the left of the start IP addresses, and click Delete in the Bound User IP List area.

Modify the IP Address List of Managed Devices area

Specify one or more IP address ranges of devices that can be managed. Device management users can only log in the access devices in the list.

g. Click Add in the IP Address List of Managed Devices area. The page for adding devices opens.

h. Specify the start and end IP addresses.

i. Click OK.

j. Repeat steps a through c to add more device IP address ranges.

k. To delete a device range, click the Delete icon of the IP address range, and click OK in the dialog box that opens.

l. To delete one or more device ranges, select the box to the left of the start IP address, and click Delete in the IP Address List of Managed Devices area.

6. Click OK.

Deleting an LDAP synchronization policy

Before you delete a policy, unbind or delete any users that are bound to the synchronization policy you want to delete.

To delete an LDAP synchronization policy:

1. Access the LDAP synchronization policy list page.

2. Click the Delete icon for the synchronization policy you want to delete.

A confirmation dialog box opens.

When the synchronization stops, UAM displays the synchronization results, including the number of successfully synchronized user accounts and the number of user accounts that failed to be synchronized.

Manually executing a synchronization policy

1. Access the LDAP synchronization policy list page.

2. Click the Synchronize link for the policy to start synchronization.

This process may take a few minutes or hours, depending on the amount of user data. When the synchronization stops, UAM displays the synchronization results, including the number of successfully synchronized user accounts and the number of user accounts that failed to be synchronized.

3. (Optional.) To view or save the synchronization failure log, click the Download link.

4. (Optional.) Click Back to return to the synchronization policy list page.

5. (Optional.) Click the Synchronized Result link on the upper right side of the page to view the results of the last synchronization.

Managing users bound to an LDAP synchronization policy

Only the users bound to an LDAP synchronization policy whose Sync Object is set to Access Users can be managed by UAM.

To manage users bound to an LDAP synchronization policy:

1. Access the LDAP synchronization policy list page.

2. Click the Bind User icon for the synchronization policy.

The Bind User List displays all LDAP users bound to the policy. For more information about LDAP user management, see "Managing LDAP users."

Validating on-demand synchronization policies

This function allows you to validate all newly added or modified on-demand synchronization policies.

To validate on-demand synchronization policies:

1. Access the LDAP synchronization policy list page.

2. Click On-Demand Sync.

A confirmation dialog box opens.

3. Click OK.

All the on-demand synchronization policies in valid state are validated.

Managing LDAP users

In UAM, an LDAP user is an access user or a device management user that is bound with an LDAP synchronization policy.

During each synchronization process, the following operations are carried out:

· For LDAP users in UAM that exist on the LDAP server, user information in UAM is overwritten by information from the LDAP server.

· For LDAP users in UAM that are removed from the LDAP server, UAM marks the LDAP user status as Nonexistent.

· For users that are newly added to the LDAP server, according to the synchronization policy, the system synchronizes such users to UAM and creates new LDAP users accordingly.

Viewing LDAP users

UAM provides the following methods to view detailed information about LDAP users:

· View LDAP users in the access user list.

· View LDAP users in the all bound user list.

· View LDAP users in the bound user list.

Viewing LDAP users in the access user list

1. Click the User tab.

2. From the navigation tree, select Access User > All Access Users.

The list includes all access users. Account names with the Bind User icon are LDAP users.

LDAP user information contents

¡ Account Name—Account name of an LDAP user.

¡ User Name—Associated platform user name for an LDAP user.

¡ User Group—Group that the platform user associated with the LDAP user belongs to.

¡ Creation Date—Date when an LDAP user was created.

¡ Validity Time—Date and time when the LDAP user becomes valid. An empty field indicates that the LDAP user is already valid.

¡ Expiration Time—Date and time when an LDAP user expires and becomes invalid. An empty field indicates that the LDAP user never expires.

¡ Account Status—Account status, including Normal, Temporarily Cancelled, and Cancelled.

- Accounts can be authenticated only when they are in the Normal state.

- Temporarily Cancelled indicates an invalid account that is temporarily deleted. Temporarily cancelled accounts are counted in the user accounts managed by a license.

- Cancelled indicates an invalid account that is permanently deleted.

¡ Modify—Click the Modify icon to display the page for modifying the associated LDAP user.

Viewing LDAP users in the All Bound User List

1. Click the User tab.

2. From the navigation tree, select Access User > LDAP User.

The list includes all LDAP users.

All Bound User List contents

¡ Account Name—Account name of an LDAP user.

¡ User Name—Platform user name that the LDAP user is associated with.

¡ User Group—Group that an LDAP user belongs to.

¡ Policy Name—Name of the LDAP synchronization policy an LDAP user is bound with. Click the name link of a policy to display the Sync Policy Information page.

For more information, see "Viewing LDAP synchronization policy details."

¡ Status in LDAP Server—Status of an LDAP user during the last synchronization process: Existent or Nonexistent.

If the user is in the LDAP server, the field displays Existent. Otherwise, the field displays Nonexistent.

To learn the current status of an LDAP user, synchronize the user immediately. For specific procedures, see "Manually executing a synchronization policy."

Viewing LDAP users in the Bound User List

1. Click the User tab.

2. From the navigation tree, select Access User > LDAP User > Sync policy name.

The list includes all LDAP users bound with the policy.

Bound Users List contents

¡ Account Name—Account name of the LDAP user.

¡ User Name—Associated platform user name for the LDAP user.

¡ User Group—User group to which the LDAP user belongs.

¡ Policy Name—Name of the synchronization policy bound to the LDAP user. Click the policy name to view the policy details. For more information, see "Viewing LDAP synchronization policy details."

¡ Status in LDAP Server—Status of the LDAP user in the LDAP server during last synchronization: Existent or Nonexistent.

To learn the current status of an LDAP user, synchronize the user immediately. For specific procedures, see "Manually executing a synchronization policy."

Querying LDAP users

You can use the same procedure to query LDAP users in the All Bound User List and the Bound User List. This example uses the All Bound User List.

To query LDAP users in the All Bound User List:

1. Click the User tab.

2. From the navigation tree, select Access User > LDAP User.

The list includes all the LDAP users.

3. Specify one or more of the following query criteria:

¡ Account Name—Enter a partial or complete account name of an LDAP user. For example, if you enter x, all account names that contain x are matched.

¡ User Group—Click the Select User Group icon . The Select User Group window opens. Select a group and click OK. You can select only one user group for query.

¡ Service Name—Select an existing service from the list.

¡ Status in LDAP Server—Select the LDAP user status from the list. Options include Unknown, Existent, and Nonexistent. To learn the current status of the LDAP user, synchronize the user immediately. For more information, see "Synchronizing LDAP users."

The query ignores empty fields.

4. Click Query.

The list includes all LDAP users matching the query criteria.

To clear the query criteria, click Reset. The All Bound User List includes all LDAP users.

Viewing LDAP user details

You can use the same procedure to view LDAP user details in the Access User List, the All Bound User List, and the Bound User List of a specific synchronization policy. This example uses the All Bound User List.

To view LDAP user details in the All Bound User List:

1. Click the User tab.

2. From the navigation tree, select Access User > LDAP User.

The list includes all the LDAP users.

3. Click the account name of an access user to display the Access Account Info page.

The page includes the following areas and parameters:

Basic Information

¡ User Name—Platform user name used on the LDAP server.

¡ ID Number—Platform user's identity number used on the LDAP server.

¡ Contact Address—Platform user's contact address used on the LDAP server.

¡ Telephone—Platform user's telephone number used on the LDAP server.

¡ Email—Platform user's email address used on the LDAP server.

¡ User Group—User group to which the LDAP user belongs. If the user group has a parent group or subgroups, this field displays the complete group hierarchy of the user group.

Access Information

¡ Account Name—Account name of an LDAP user. When an LDAP user is blacklisted, the account name of the user is followed with Blacklisted Users.

¡ Account Status—Options are Normal, Temporarily Cancelled, or Cancelled. Except the normal state, accounts in any other state cannot be authenticated.

- Accounts can be authenticated only when they are in the Normal state.

- Temporarily Cancelled indicates an invalid account that is temporarily deleted. Temporarily cancelled accounts are counted in the user accounts managed by a license.

- Cancelled indicates an invalid account that is permanently deleted.

¡ Creation Date—Date when the LDAP user was created.

¡ Validity Time—Date and time when the LDAP user becomes valid. An empty field indicates that the LDAP user is already valid.

¡ Expiration Time—Date and time when the LDAP user expires and becomes invalid. An empty field indicates that the LDAP user never expires.

¡ Max. Idle Time (Minutes)—The maximum idle time that the LDAP user is allowed to have. The LDAP user is forced to log off when the idle time expires.

An empty field indicates that the LDAP user can always stay online.

¡ Max. Concurrent Logins—The maximum number of concurrent logins allowed by the user account.

An empty field indicates that maximum number of the concurrent logins of the LDAP user is not restricted.

¡ Online Status—Whether or not the LDAP user is online.

¡ Last Logoff—Time when the LDAP user last logged off.

¡ Login Message—Message delivered to the LDAP user when the user passes the authentication.

¡ Guest Manager Type—Whether or not the LDAP user is a Guest Manager or Super Guest Manager. This parameter is displayed only after the LDAP user is specified as a Guest Manager.

Access Service list contents

The list includes all services available for the users.

¡ Service Name—Name of the service.

¡ Service Suffix—Distinguishes services when LDAP users perform authentication. The user name and service suffix entered by the LDAP user is closely related to the authentication domain. For more information, see Table 30.

¡ Allocate IP—IP address that the access service allocates to the user. An empty field indicates that the access service does not allocate any IP address.

Smart Device MAC Address Binding area

The Smart Device MAC Address Binding area displays all smart device MAC addresses that are bound to the account for transparent authentication (see "Configuring transparent portal authentication").

¡ Service Name/MAC Address—Displays the service name and MAC address that are bound to the account for transparent portal authentication.

¡ Transparent Authentication—Whether the MAC address is allowed to use the account and service for transparent portal authentication. The status can be Enabled or Disabled.

¡ Enabled/Disabled Time—If transparent portal authentication is enabled, this field indicates the time when the device MAC address was bound to the user and service. If transparent portal authentication is disabled, this field indicates the time when transparent authentication was automatically or manually disabled on the device.

Access Device Binding Information area

To pass authentication, an LDAP user must meet all requirements of the access device bindings and terminal bindings. The query ignores empty fields.

¡ Device SN—Sequence number of the access device bound to the LDAP user. An LDAP user can pass authentication only when sequence number of the access device matches this parameter value.

¡ Port—Port of the access device bound to the LDAP user. An LDAP user can pass the authentication only when the connected port (of any access device) matches the bound port. UAM uses the last portion of an interface number to match access ports. For example, if you specify port 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

¡ Outer VLAN ID—Outer VLAN ID bound to the LDAP user. An LDAP user can pass the authentication only when the VLAN tag of the packets sent by the user matches the bound outer VLAN tag.

¡ VLAN ID/Inner VLAN ID—VLAN ID or inner VLAN ID bound to the LDAP user. A user can pass the authentication only when the VLAN tag of the packets sent by the user matches the bound VLAN tag.

¡ User SSID—SSID bound to the LDAP user when the user uses wireless access. An LDAP user can pass authentication only when the used SSID is on the User SSID list.

¡ Device IP—IPv4 address of the access device bound to the LDAP user. An LDAP user can pass authentication only when the connected access device's IP address is on the Device IP list. The access device IPv4 address is the address when the device is being added to UAM as an access device.

¡ Device IPv6 Address—IPv6 address of the access device bound to the LDAP user. An LDAP user can pass authentication only when the connected access device's IP address is on the Device IPv6 Address list. The access device IPv6 address is the address when the device is being added to UAM as an access device.

Terminal Binding Information area

To pass authentication, the LDAP user must meet all requirements of the access device bindings and terminal bindings. The query ignores empty fields.

¡ Computer Name—Name of the computer bound to the LDAP user. An LDAP user can pass authentication only when the computer name matches the bound computer name.

¡ IMSI—IMSI number bound to the LDAP user. An LDAP user can pass authentication only when the IMSI number of the user endpoint matches the bound IMSI.

¡ Windows Domain—Name of the Windows domain bound to the LDAP user. An LDAP user can pass authentication only when the computer used by the user joins or logs in to the domain.

¡ Terminal IP Address—List of IPv4 addresses or IPv4 address ranges bound to the LDAP user. An LDAP user can pass authentication only by using an endpoint with a bound IPv4 address or an IPv4 address in the bound IPv4 address ranges.

¡ Terminal MAC Address—List of MAC addresses bound to the LDAP user. An LDAP user can pass authentication only by using an endpoint with a bound MAC address or a MAC address in the bound MAC address ranges.

¡ Terminal IPv6 Address—List of IPv6 addresses bound to the LDAP user. An LDAP user can pass authentication only by using an endpoint with a bound IPv6 address or an IPv6 address in the bound IPv4 address ranges.

¡ IMEI—IMEI number bound to the LDAP user. An LDAP user can pass authentication only when the IMEI number of the user endpoint matches the bound IMEI.

Action

The Action menu is located to the right of the Access Account Info pane, and offers the following options:

¡ Refresh—Click the link to refresh the detailed information about the access user.

¡ Modify—Click the link to access the page for modifying the access user. For more information, see "Modifying LDAP user information."

¡ Cancel Account—Click the Cancel Account link and click OK in the confirmation dialog box to delete the access user.

¡ Add to Blacklist—Available only when the access user is not blacklisted. Click the Add to Blacklist link and click OK in the dialog box to add the access user to the blacklist.

¡ Release from Blacklist—Available only when the access user is blacklisted. Click the link and click OK in the dialog box to release the access user from the blacklist.

¡ Authentication Failure Log—Click the link to view the list of authentication failure logs for the access user. For more information, see "Managing authentication failure logs."

¡ Authentication Violation Log—Click the link to view the list of authentication violation logs for the access user. For more information about violation logs, see "Managing authentication violation logs."

¡ Access Details—Click the link to view the list of access details for the access user. For more information, see "Viewing ordinary access user details."

¡ MAC Address Entry—Click the link to view the list of MAC addresses bound to the LDAP user. These addresses are used for transparent MAC authentication. This link is displayed only when the transparent MAC authentication function is enabled in user endpoint settings. For information about transparent MAC authentication, see "Transparent MAC authentication."

¡ Unbind LDAP User—Click the link to unbind the LDAP user with the LDAP synchronization policy. The LDAP user becomes a common access user after this process.

¡ Basic User Info—Click the link to access the page that displays detailed information about the platform user to which the access user is attached. For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide.

¡ Send Password via SMS—Click the link to send a message that contains the account name and password to the current user. To use this function, operators must first enable Send Password via SMS in the IMC platform. For more information, see HPE Intelligent Management Center v7.3 Enterprise and Standard Platform Administrator Guide. UAM cannot read user passwords from some LDAP servers (Microsoft ADs, for example), and you cannot send password messages to users synchronized from such LDAP servers.

¡ Temporary Cancel—This link is displayed only when the LDAP user account is in Normal state. Click the link to display a confirmation dialog box. Click OK to temporarily cancel the user account.

¡ Undo TempCancel—This link is displayed only when the LDAP user account is in Temporarily Cancelled state. Click the link to display a confirmation dialog box. Click OK to restore the user account to the normal state.

Binding common users with LDAP synchronization policies

UAM provides the following ways to bind users with an LDAP synchronization policy:

· Auto—UAM automatically synchronizes user data from an LDAP server and creates corresponding LDAP users during synchronization.

These users are automatically bound with the synchronization policy. For more information, see "Manually executing a synchronization policy."

· Manual—A common user can be manually bound with a synchronization policy.

To manually bind access users with an LDAP synchronization policy:

1. Click the User tab.

2. From the navigation tree, select Access User > LDAP User > Policy Name.

The list includes all LDAP users bound with the policy.

3. Click Bind in the bound user list area.

The Unbound User List window opens, displaying all the access users that are not bound with any LDAP synchronization policy.

4. Specify one or more of the following query criteria in the Query Unbound Users area:

¡ Account Name—Enter a partial or complete account name of an access user. For example, if you enter x, all account names that contain x are matched.

¡ User Group—Click the Select User Group icon . The Select User Group window opens. Select a group and click OK. You can select only one user group for query.

The query ignores empty fields.

5. Click Query.

The list includes all unbound users that match the query criteria.

6. Select one or more users.

7. Click OK.

The selected users are displayed in the bound users list with the Status in the LDAP Server of Unknown.

8. Click Sync All in the Bound User List area to start executing the synchronization policy.

This process may take a few minutes or hours, depending on the amount of user data.

After synchronization, if a newly bound LDAP user exists in the LDAP server, the user status in the LDAP server is changed to Existent. Otherwise, the user status in the LDAP server is changed to Nonexistent.

Unbinding LDAP users with an LDAP synchronization policy

To unbind LDAP users with an LDAP synchronization policy:

1. Click the User tab.

2. From the navigation tree, select Access User > LDAP User > Policy Name.

The list includes all LDAP users bound with the synchronization policy.

3. Select one or more users to be unbound from the policy.

4. Click Unbind in the Bind Users List area.

A confirmation dialog box opens.

5. Click OK.

An LDAP user becomes a common access user after being unbound with the LDAP synchronization policy.

Synchronizing LDAP users

A synchronization operation synchronizes all users bound with a synchronization policy under the following guidelines:

· For LDAP users in UAM that exist on the LDAP server, user information in UAM is overwritten by that stored on the LDAP server.

· For LDAP users in UAM that no longer exist on the LDAP server, UAM marks the LDAP user status as Nonexistent.

· For users that are newly added to the LDAP server, according to the synchronization policy, the system synchronizes such users to UAM and creates new LDAP users accordingly.

To synchronize LDAP users:

1. Click the User tab.

2. From the navigation tree, select Access User > LDAP User > Policy Name.

The list includes all LDAP users bound with the policy.

3. Click Sync All in the Bound User List area to start executing the synchronization policy.

This process may take a few minutes or hours, depending on the amount of user data.

4. (Optional.) To view or save the synchronization failure log, click the Download link.

5. (Optional.) Click Back to return to Bound Users List.

Modifying LDAP user information

Modifications to a user parameter synchronized from an LDAP server will last only until the next synchronization, because during synchronization the user information in UAM is overwritten by the information stored on the LDAP server.

To modify LDAP user information:

1. Click the User tab.

2. From the navigation tree, select Access User > All Access Users.

The list includes all access users. Account names with the Bind User icon are LDAP users.

3. Click the Modify icon for the LDAP user you want to modify.

The page for modifying the LDAP user opens.

Modify access information

¡ Validity Time—Click the Calendar icon to select a valid time, or enter a valid time in the format of YYYY-MM-DD hh:mm. The LDAP user becomes valid since the valid time. An empty field indicates that the LDAP user becomes valid immediately after the modification.

¡ Expiration Time—Click the Calendar icon to set the expiration time, or enter a time string in the format of YYYY-MM-DD hh:mm. The LDAP user becomes invalid since the expiration time. An empty field indicates that the LDAP user never expires.

¡ Max. Idle Time (Minutes)—Enter the maximum idle time allowed for the LDAP user. The LDAP user is forced to log off when the idle time expires. An empty field indicates that the LDAP user can always stay online.

¡ Max. Concurrent Logins—Enter the maximum number of concurrent logins allowed for the LDAP user. An empty field indicates that the maximum number of concurrent logins with the same user account is not restricted.

¡ Login Message—Enter the message delivered to the LDAP user when the user passes authentication.

Other parameters cannot be modified.

Modify access service

If Apply for Service by User Group is disabled, UAM displays this field to allow manual service assignment for LDAP users. If Apply for Service by User Group is enabled, UAM hides this field and automatically applies for services for LDAP users according to their user groups. For more information about configuring the Apply for Service by User Group option, see "Configuring global system settings."

The access service list displays all services available to users. You may select multiple services with different suffixes. To select a service, click the box next to it.

¡ Service Name—Unique name of the service in UAM.

¡ Service Suffix—Distinguishes services when endpoint users perform authentication. The user name and service suffix entered by the endpoint user is closely related to the authentication domain. For more information, see Table 30.

¡ Status—Identifies whether the service is available. The access service list displays all services available to users, including those with their status changed to Unavailable by network administrators.

¡ Allocate IP—Enter the IP address that the access service allocates to the user. An empty field indicates that the access service does not allocate any IP address.

Modify access device binding information

Set the values for access device binding parameters. The binding parameters in this area take effect only when they are selected in the Authentication Binding Information area of the selected services. For example, the Device IP parameter is effective to the services only with the Bind Access Device IP option selected.

If you select a binding option for a service but do not specify any value for the parameter in the access device binding information, UAM automatically learns the binding information for the service when the user first passes authentication.

To pass authentication, the LDAP user must meet all requirements of the access device bindings and terminal bindings.

¡ Device SN—Enter the sequence number of the access device bound to the LDAP user. An LDAP user can pass authentication only when the sequence number of the access device matches this parameter value.

¡ Port—Enter the port number of the access device to which an LDAP user is bound. A user can pass the authentication only when connected port (of any access device) matches the bound port. UAM uses the last portion of an interface number to match access ports. For example, if you specify port 3, both interface number 1/0/3 and interface number 2/0/3 match the port.

¡ Outer VLAN ID—Enter the outer VLAN ID bound to the LDAP user. An LDAP user can pass the authentication only when the VLAN tag of the packets sent by the user matches the bound outer VLAN tag.

¡ VLAN ID/Inner VLAN ID—Enter the VLAN ID or inner VLAN ID bound to the LDAP user. An LDAP user can pass the authentication only when the VLAN tag of the packets sent by the user matches the bound VLAN tag.

¡ User SSID—Enter the SSID bound to the LDAP user when the user uses wireless access. An LDAP user can pass authentication only when the used SSID is on the User SSID list.

Modify terminal binding information

Set the values for terminal binding parameters. The binding parameters in this area take effect only when they are selected in the Authentication Binding Information area of the selected services. For example, the Computer Name parameter is effective to the services only when the Bind Computer Name option is selected.

If you select a binding option for a service but do not specify any value for the parameter in the terminal binding information, UAM automatically acquires the binding information for the service when the user first passes authentication.

To pass authentication, the LDAP user must meet all requirements of the listed access device bindings and terminal bindings.

¡ Computer Name—Enter the name of the computer bound to the LDAP user. An LDAP user can pass the authentication only when the computer name of the user matches the bound computer name.

¡ IMSI—Enter the IMSI number bound to the LDAP user. An LDAP user can pass the authentication only when the IMSI of the endpoint matches the bound IMSI.

¡ Windows Domain—Enter the name of the Windows domain name bound to the LDAP user. A user can pass authentication only after the computer joins or logs in to domain.

¡ Terminal IP Address—Enter a list of IPv4 addresses or IPv4 address ranges bound to the LDAP user. An LDAP user can pass authentication only by using an endpoint with a bound IPv4 address or an IPv4 address in the bound IPv4 address ranges.

¡ Terminal MAC Address—Enter a list of MAC addresses bound to the LDAP user. An LDAP user can pass authentication only by using an endpoint with a bound MAC address.

¡ Terminal IPv6 Address—Enter a list of IPv6 addresses bound to the LDAP user. An LDAP user can pass authentication only by using an endpoint with a bound IPv6 address.

¡ IMEI—Enter the IMEI number bound to the LDAP user. An LDAP user can pass the authentication only when the IMEI of the endpoint matches the bound IMEI.