What's the reason we need the remove the IPDT policy with the command: no device-tracking attach-policy IPDT_POLICYIs it for roaming?Do you also need to enable the Intra-Subnet Routing?  

For closed authentication with dynamic vlan Cisco recommends the following:Use EEM script to set the dynamic vlan as switchport acces vlan on the port. That way your silent host will stay in the vlan if it shutdown so you can use wake on lan. Also in...

Hello Richard, I know it's some time ago but I had the same issue. You get the "Block scep enrollment as the traffic does not come from network device" if the device ip is not known in the network devices list. Just add the ip of the device or MDM in...