Configuring authorization attributes for an ISP domain

The device supports the following authorization attributes:

• ACL—The device restricts authenticated users to access only the network resources permitted by the ACL.

• CAR action—The attribute controls the traffic flow of authenticated users.

• Maximum number of multicast groups—The attribute restricts the maximum number of multicast groups that an authenticated user can join concurrently.

• IPv4 address pool—The device assigns IPv4 addresses from the pool to authenticated users in the domain.

• IPv6 address pool—The device assigns IPv6 addresses from the pool to authenticated users in the domain.

• Redirect URL—The device redirects users in the domain to the URL after they pass authentication.

• User group—Authenticated users in the domain obtain all attributes of the user group.

• User profile—The device restricts the user's behavior based on the user profile.

The device assigns the authorization attributes in the ISP domain to the authenticated users that do not receive these attributes from the server.

1. Enter system view.

   system-view

2. Enter ISP domain view.

   domain isp-name

3. Configure authorization attributes for authenticated users in the ISP domain.

   authorization-attribute { acl acl-number | car inbound cir committed-information-rate [ pir peak-information-rate ] outbound cir committed-information-rate [ pir peak-information-rate ] | igmp max-access-number max-access-number | ip-pool ipv4-pool-name | ipv6-pool ipv6-pool-name | mld max-access-number max-access-number | url url-string | user-group user-group-name | user-profile profile-name }

   The default settings are as follows:

   • An IPv4 user can concurrently join a maximum of four IGMP multicast groups.

   • An IPv6 user can concurrently join a maximum of four MLD multicast groups.

   • No other authorization attributes exist.