Hi, I'm currently using a NPS server to mab auth our devices (mainly for the ability to preform dynamic vlan assignment). It works great but I am running into a problem with auth-ing our Wireless access points. The NPS policy is sending the "device-traffic-class=switch" radius attribute as well as the other standard RADIUS attributes (tunnel-medium-type, tunnel-pvt-group & tunnel type).
The problem is that the APs need native access to vlan 100 (specifically designated for AP management). They also need tagged access to vlan 200 & 300 as these feed the SSID's. So sending the "device-traffic-class=switch" works because it tags vlan 200/300 down to the AP which is good. BUT the only way I can get vlan 100 to become the native vlan is by setting it as the access vlan (so when the port gets the radius class=switch attribute it converts vlan 100 from the access vlan to the native vlan). This isn't great as then I need to set all of the interfaces to use vlan 100 as the access vlan. Normally this wouldn't be a big deal because NPS/MAB would just dynamically change it on the fly. But we've had a lot of success just leaving the access vlan as our general user vlan (847) so if the l2l goes down or connectivity back to the NPS server goes down, then we've listed "none" as the backup authentication method -- if there's no connectivity then the switch just times out and dumps the port into the general user vlan -- which is safe for us.
Has anyone ever ran into this problem before or found a way to dynamically set a native vlan using radius attributes?
Thanks for your help
