Discover our products
Try for free
enen
DeutschGermanDEEnglishEnglishENEspañolSpanishESFrançaisFrenchFRSvenskaSwedishSVSuomiFinnishFIDanskDanishDA한국어KoreanKONederlandsDutchNLItalianoItalianITÍslenskaIcelandicISNorskNorwegianNO日本語JapaneseJA

Written in English, translated by Claude. Something lost in translation? Please tell us.

RULE ENGINE

Your rules decide who gets in and into which VLAN

Each rule names a network, a sign-in method and the conditions that must hold, and returns the VLAN and attributes your switches and access points expect. RADIUSaaS goes through your rules from the top for every request, and a request no rule takes is rejected.

  • First match wins
  • 7 kinds of groups
  • VLANs from certificate fields
  • Backup and restore
Try RADIUSaaS nowTry the playground
First match wins. Example data.

First match wins

RADIUSaaS checks a request against the first rule, then the second, and so on. The first rule whose network, sign-in method and filters all fit decides what the device gets, and the rules below it never see that request. A disabled rule keeps its place in the list and is skipped. If no rule fits, the request is rejected, and the log says so in so many words: No rule matched the request.
  • Filters within a rule are combined with AND: every one has to fit
  • A rule without filters applies everywhere its network type does
  • A catch-all rule allows whatever reaches it, so RADIUSaaS always saves it last
Insights › LogsExample data.
Engine-Decision: acceptApplied-Rule: Corp Wi-Fi – laptops   Assigned-VLAN: 20Engine-Decision: rejectReject-Description: No rule matched the request
TRY IT

Try an example rule set

Five rules for a fictional office. Pick the network, where the device connects and what it presents. Switch rules off, turn the fallback VLAN off, and see which rule takes the request, or why none does.

Network
Connects to

The SSID the device joins.

Presents
Change the rules
  1. 1
    Printers on floor 3LANUsername & password

    A LAN request authenticating with username and password matching switch group Floor 3 switches and username ^prn- is granted VLAN 30.

    Skipped: this is a LAN rule.

  2. 2
    Corp Wi-Fi – laptopsWi-FiCertificate only

    A Wi-Fi request authenticating with a certificate from Contoso Device CA matching SSID group Corp is granted a VLAN from the certificate's OU, or VLAN 10 if no pattern matches.

    Matched.

  3. 3
    Remote accessVPNCertificate only

    A VPN request authenticating with a certificate matching NAS identifier vpn-gw-* is granted Filter-Id = remote-staff.

    Not reached.

  4. 4
    GuestsWi-FiUsername & password

    A Wi-Fi request authenticating with username and password matching SSID Contoso-Guest and owner .*@contoso\.com is granted VLAN 99.

    Not reached.

  5. 5
    Catch-allGeneric allowDisabled

    Any request that reaches this rule is allowed, and nothing is returned.

    Not reached.

Decision
Accept
Returned
VLAN 20
In plain words
A Wi-Fi request authenticating with a certificate from Contoso Device CA matching SSID group Corp is granted a VLAN from the certificate's OU, or VLAN 10 if no pattern matches.
Logabridged
Engine-Decision: acceptApplied-Rule: Corp Wi-Fi – laptopsAssigned-VLAN: 20

Example data. The evaluation follows RADIUSaaS's rule order; the log lines are abridged.

FILTERS

Where a rule applies

Each rule belongs to one kind of network, and each kind brings the filters that make sense for it. Values or groups, any number of each.

Filters per rule type
FilterWi-FiLANVPN
SSID✓——
Access point MAC✓——
Switch MAC—✓—
NAS identifier——✓
NAS IP——✓
Client IP✓✓✓
Accepted root CAs✓✓✓
Certificate fields (issuer, SAN, subject, extensions)✓✓✓
Intune ID in the certificate✓✓✓
Username or owner pattern✓✓✓

A catch-all rule has no filters and matches requests from any network.

GROUPS

Groups every rule can use

A group is a named list of SSIDs, switches, access points, gateways, address ranges or Intune IDs that any rule can use. Add a new floor's switches to the group, and every rule that names it applies there too. The portal shows how many rules use each group, so you know what a change touches before you save.
  • 7 kinds: SSID, access point MAC, switch MAC, NAS identifier, NAS IP, client IP, Intune ID
  • End an entry with * for a prefix match: Corp-*, a whole MAC vendor prefix, nas-branch-*
  • MAC addresses in any notation; RADIUSaaS normalizes them
  • Paste a list straight from your controller export; duplicates are skipped
  • IPv4 and IPv6, single addresses or CIDR ranges
Example data.
ASSIGNMENTS

VLANs from the certificate

A rule can hand out a fixed VLAN, or read it from the request. Point it at a certificate field (the issuer, a SAN, the subject or an extension you registered) or at the username or the account's owner, give it patterns, and each pattern names the VLAN or attribute value it leads to. If no pattern matches, the fallback applies; without a fallback, the request is rejected. One rule can then put Sales, Engineering and everyone else in three different VLANs.
  • Register private extensions by OID, or standard fields like subject CN, OU, SAN DNS name and UPN
  • RADIUS attributes are assigned the same way as VLANs
  • Several values for the same attribute in one answer
Dynamic assignmentExample data.
Read from   Subject (DN) · OUPattern     ^Sales$        →  VLAN 20Pattern     ^Engineering$  →  VLAN 40Fallback                   →  VLAN 10
ATTRIBUTES

The attributes your hardware understands

  • VLAN attributes

    The standard RADIUS tunnel attributes for VLANs, plus the vendor-specific spellings some switches and access points insist on. Keep the ones your hardware understands; the rest stay out of the rule editor.

  • Other RADIUS attributes

    Filter IDs, group names, vendor pairs: search the RADIUS dictionary in the portal and add what your rules may return. The catalogue shows which rules use each one.

SAFETY

Safeguards for changing rules

  • In plain words

    Every rule shows a sentence that says what it does: which network, which sign-in, which conditions, what it grants.

  • Issues before you save

    The rule list has an issues column. Errors block saving; warnings let you save and stay listed until you fix them.

  • Switch a rule off without losing it

    Switch a rule off to test without it. It keeps its position and its settings.

  • Duplicate a rule

    Copy a working rule and change the one thing that differs.

  • Backup and restore

    Download the whole rule set, with groups and certificate extensions, as a file. Restoring replaces everything, after you confirm it.

  • The catch-all rule stays last

    A generic allow rule is saved at the bottom, where it can't hide the rules below it.

OLD DEVICES

Devices that can't do 802.1X

Some devices know nothing about 802.1X. If your switch or access point supports MAB-to-EAP, it authenticates on the device's behalf over PEAP-MSCHAPv2 or EAP-TTLS-PAP, with the device's MAC address as username and password. Create those accounts in RADIUSaaS, or import them in bulk, and add a rule that puts them in a fallback VLAN with minimal access, so a spoofed MAC address doesn't open your network. Classic MAB over PAP or CHAP doesn't work with RADIUSaaS.

MAC authentication bypass in the documentation

Example data.

Write your first rule in the trial

Start a trial, connect one access point and let a rule put your test laptop in its own VLAN.

Try RADIUSaaS nowRead the rule documentation