> For the complete documentation index, see [llms.txt](https://docs.radiusaas.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.radiusaas.com/admin-portal/access-and-rules/rules/general-structure.md).

# General Structure

Rules allow further restrictions

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FuqYqmbOeQMm3Kt6sqOCd%2Fimage.png?alt=media&amp;token=46329c49-8f32-417c-821f-b913b11c5526" alt=""><figcaption></figcaption></figure>

## Rule Collection

{% hint style="info" %}
We recommend providing descriptive names for your rules, as this will allow them to be clearly identifiable in the Insight [Logs](/admin-portal/insights/log.md).
{% endhint %}

Every Rule can have a **Name, Description** and is specified for a specific authentication type.\
Currently you can define a rule for **Wi-Fi**, **LAN** and **VPN**. Furthermore, you can **Enable** or **Disable** each rule.

The Rules tab lists every configured rule, its position, its type (Wi-Fi, LAN, VPN or Generic Allow), its **name** and **description**, the **authentication method** it accepts, the **filters** it applies to, what it **grants**, and whether it is enabled.

## Creating a Rule

Clicking **Add rule** lets you pick a medium: Generic Allow, Wi-Fi, LAN, or VPN.

Choosing **Wi-Fi**, **LAN** or **VPN** opens a guided four-step wizard. A live "in plain words" summary at the bottom of the dialog rephrases the rule in plain language as it is built, for example:

> **IN PLAIN WORDS**
>
> A Wi-Fi request authenticating with certificate only from CN=SCEPman-SaaS-CA,O=Contoso matching Cert Subject (DN) matches OU=Printers is granted VLAN 16 (static).

The following steps show the rule editor with a simple example of the above description:

{% stepper %}
{% step %}

### Identity

Just a **Name**, an optional **Description**, and an enable/disable toggle. The medium and authentication method are configured in later steps, so the name only needs to describe intent, e.g. "Corporate Wi-Fi Access" rather than encoding the SSID or VLAN into the name.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F6Tn0vpMOXCp1JcPRlfN6%2Fimage.png?alt=media&amp;token=d9e7629e-c5ee-41ca-b0ec-950615ef5675" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Who may authenticate (Authentication Methods)

Turn on Certificate-based and/or Username/Password-based authentication; at least one must be enabled. Enabling certificates reveals an optional **Restrict root certificates** toggle, which narrows the rule down to specific Trusted Roots instead of accepting any certificate trusted by the platform.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FSWdFFR7MVVHQa2YihETQ%2Fimage.png?alt=media&amp;token=be6cb085-f598-4379-8266-589da4ffb053" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Where it applies (Filters)

Filters narrow the rule down and are combined with AND, meaning a request must satisfy every filter listed; leaving this step empty means the rule applies everywhere. The filters on offer depend on the medium, and each filter can take individual values or reference a reusable Group. See the Wi-Fi, LAN and VPN sections below for the specific filters each medium offers and a worked example.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FoAXR3DnBtKqws4WDsMBX%2Fimage.png?alt=media&amp;token=d1e4b0d0-dceb-459b-9881-82af78edda3a" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### What it grants (Assignments)

Defines the access returned when the rule matches: a VLAN and/or additional RADIUS attributes, each either **Static** (a fixed value) or **Dynamic**. Dynamic assignment reads a value out of the certificate, from its Issuer, SAN, DN, or a custom Extension, applies a regex pattern to it, and maps the result to the value that gets granted. This same regex mechanism is also used for Certificate Attribute filters in Step 3. You can also define what happens if no pattern matches: reject the request, or fall back to a default value.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F76FxD3SSjW9CjxRucRqv%2Fimage.png?alt=media&amp;token=a00c2935-d390-4e42-a7f5-a2683b6f3b5f" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

***

## Authentication Methods

The authentication methods you can define in "Who may authenticate" restricts the technical medium an authentication needs to use to be accepted.

#### Certificate-based authentication

You can either enable CBA alone to match all such authentications or further limit authentications for certificates signed by specific CAs.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F8uj6FaXx1Y9wnjJI3r4N%2Fimage.png?alt=media&amp;token=b52dbab5-8b10-49c2-863f-ca8d78727a32" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
You can further restrict CBA using filters to match on the issuer, SAN, DN or extensions of the certificate used.
{% endhint %}

#### Username/Password-based authentication

Enable this method to allow authentications that do not use certificate-based authentication.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FXds3gWHKjuVLrtEk4ejG%2Fimage.png?alt=media&amp;token=f2472c65-0893-41f7-995d-85683c51b7de" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
You can further restrict username/password-based authentication using filters to match on usernames or owners.
{% endhint %}

***

## Filters

Filters can be used to build granular rules that match only under certain circumstances. There are multiple available filters that can be used in different situations:

#### Available for all Rules

* Client IPs
* Certificate Attributes
* Username/Password
* Intune IDs

#### Available for specific Rules

* SSIDs (Wi-Fi Rules)
* Switch MACs (LAN Rules)
* NAS Identitfiers (VPN Rules)
* NAS IPs (VPN Rules)

### Client IPs

Use the Client IPs filter to match a rule on the WAN-IP address of the authentications. You can use single addresses, CIDRs or a defined group.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FE3pAICCrGZGSXmW390KP%2Fimage.png?alt=media&amp;token=89fd3dc1-978f-4865-9748-78406221ba26" alt=""><figcaption></figcaption></figure>

### Certificate Attributes

Use this filter type to match a rule only if a presented client certificate contains the required information. You can filter for the following attributes:

* Issuer
* SAN (Subject Alternative Name)
* DN (Distinguished Name)
* Extension

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2Fm6Unp9GxJi66ve2Sx07b%2Fimage.png?alt=media&amp;token=21ba8b61-da02-4dcf-bd2a-78515b744d29" alt=""><figcaption></figcaption></figure>

#### Examples:

* Use a SAN filter `.*-ext@contoso\.com$` to match `john.smith-ext@contoso.com` → contractor identity cert, VLAN 10.
* Use a DN `OU=Printers` to match the subject `CN=PRINTER07,OU=Printers,O=Contoso` → assign VLAN 16 (printers).
* Use a DN `OU=Finance` to match the subject `CN=jdoe,OU=Finance,O=Contoso` → VLAN 30 (Finance).
* Use a SAN filter `^platform:windows$` to match specific platforms. Use an URI SAN with value of `platform:windows` to match this.

{% hint style="info" %}
Note: The rule engine matches values case-sensitively. `OU=Printers` will not match `OU=printers`
{% endhint %}

### Username/Password

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FHh9k0z7W2eLiQYiS2KF0%2Fimage.png?alt=media&amp;token=77f318e2-6959-49f8-97ff-25dd688827d4" alt=""><figcaption></figcaption></figure>

#### Examples:

* Username `^ext-.*` matches `ext-jsmith` → VLAN 50 (contractor)
* Owner `IT-AssetPool` matches shared/kiosk device tag → Filter-Id `kiosk-acl`

### SSIDs

{% hint style="info" %}
This filter type is only available on Wi-Fi rules
{% endhint %}

To filter for SSIDs, you can choose to match single SSIDs per entry or add a defined group of SSIDs.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FIE4wj6NbEtM2RQvoN8bW%2Fimage.png?alt=media&amp;token=8df3bca5-11e6-4f1c-8249-9ec1ee732be2" alt=""><figcaption></figcaption></figure>

### Switch MACs

{% hint style="info" %}
This filter type is only available on LAN rules
{% endhint %}

To filter for Switch MACs, you can choose to match single address per entry or add a defined group of Switch MACs.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FiC3J7Jch7WMVcNeh1WLQ%2Fimage.png?alt=media&amp;token=f358bc05-5ce7-4de1-86c8-3864ed2d5cb9" alt=""><figcaption></figcaption></figure>

### NAS-Identifiers

{% hint style="info" %}
This filter type is only available on VPN rules
{% endhint %}

Similar to other filters, you can choose to match single NAS-Identifiers per entry or add a defined group of NAS-Identifiers.

### NAS IPs

{% hint style="info" %}
This filter type is only available on VPN rules
{% endhint %}

Similar to other filters, you can choose to match single NAS-IPs per entry or add a defined group of NAS-IPs.

### Intune IDs

This is a historical filter. If your clients are authenticating with certificates that your clients received during the AAD-Join, you want to filter for your Intune Tenant ID.

In case you have entered your Tenant IDs as described [here](https://docs.radiusaas.com/admin-portal/settings/trusted-roots#intune-id), the default behaviour of RADIUSaaS is that only machines presenting a certificate with extension OID **1.2.840.113556.5.14** and a whitelisted value for the Tenant ID will get access to the network. With the rule engine, you now have the option to further restrict the access to specific Intune IDs for a specific rule or to ignore the certificate extension. This allows you to have a multi-deployment setup, where some clients come with certificates providing the respective OID and some do not.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FRwLK1xhjETI3bbmPQKPZ%2Fimage.png?alt=media&amp;token=6853e911-db5a-427b-ace7-6152a7da4a0b" alt=""><figcaption></figcaption></figure>

***

## Assignments

If an authentication is valid and matches a rule, the returned Access-Accept packet can contain specific information to give further instructions to the authenticator.

### VLAN

A VLAN ID can be assigned statically, meaning that all matching authentications will receive this VLAN ID, or dynamically by extracting the desired value from either a certificate attribute or the username/owner.

#### By Certificate Subject (DN)

* You can also assign VLAN IDs based on properties in the Subject Name of your certificate
* Therefore, specify in which property the VLAN ID is stored
* Then, configure which string the VLAN ID is prefixed with
* The VLAN ID is not required to have a prefix. However, it can be required to use a prefix in case your Subject Name carries the same attribute more than once (e.g. several CN's are quite common).

As an example, the following assignment will match the DN attribute of the client certificate using the regex pattern `OU=vlan-(\d+)` and use the first matching group as resulting value.

For a certificate subject (DN) of `CN=CLIENT01,OU=vlan-15` this result in a VLAN assignment of **15**.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FDHD7alAihmloa8O1XEt6%2Fimage.png?alt=media&amp;token=e5989ef7-01f2-4130-97f0-a9fb293b65b2" alt=""><figcaption></figcaption></figure>

#### By Certificate Extension

{% hint style="info" %}
Currently it is not supported to add custom certificate extensions to SCEP profiles in many MDM systems, including Microsoft Intune and JAMF.

We therefore recommend to use the subject of the certificate instead to add a VLAN assignment.
{% endhint %}

* Select one of your created Certificate Extensions
* Choose a regex pattern to get the desired value

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FN9UlNW9yIpgbinlP5A3z%2Fimage.png?alt=media&amp;token=a4d9dafd-ecca-4365-979d-126a3c1b2373" alt=""><figcaption></figcaption></figure>

### Attributes

RADIUS return attributes allow network administrators to define specific settings for individual users or groups.

For example,

* For User Profile Configuration, an attribute can specify the maximum session duration, allowed services (such as VPN or Wi-Fi), and IP address assignment method.
* For Dynamic IP Address Assignment, an attribute might specify that the user should receive a static IP address or use DHCP for dynamic assignment.
* For Access Control and Authorization, an attribute determines the user’s access level (e.g., guest, employee, administrator) and any restrictions (e.g., time limits).
* For Session Management, an attribute can specify session timeout (how long the user can stay connected), idle timeout (disconnect after inactivity), and maximum simultaneous logins.
* For Quality of Service (QoS), an attribute might prioritize voice traffic over data traffic for a specific user.

Vendors can create their own custom attributes (vendor-specific attributes or VSAs). These allow for additional functionality beyond the standard IETF attributes. VSAs are encapsulated within the standard attribute 26.

In the same manner of VLAN assignments, attributes can be returned either statically or dynamically.

You can choose from different return attributes and extend them in the attribute catalogue:

{% content-ref url="/pages/nr8htn2giI38d0uKa82w" %}
[Attribute Catalogue](/admin-portal/access-and-rules/rules/attribute-catalogue.md)
{% endcontent-ref %}

#### Example:

Dynamically assign the value of the certificates RDN L to the the return attribute Filter-Id

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F5FXdUmoCWhUkTLLIX77v%2Fimage.png?alt=media&amp;token=bb33b7b7-e9b3-4d67-a5e5-a9c2a50e465f" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.radiusaas.com/admin-portal/access-and-rules/rules/general-structure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.