This is done by setting RADIUS Attributes [64], [65], and [81] on a RADIUS Server. Here's an example:
[64] Tunnel-Type – “VLAN” (13)
[65] Tunnel-Medium-Type – “802” (6)
[81] Tunnel-Private-Group-ID - or
Here are specifics for an AP:
Before 802.1x, the AP authenticates the client using the auth-type configured for the SSID the client associated with.
*Option1: After authorization by 802.1x, and IF RADIUS specifies the VLAN, the AP can assign the VLAN supplied by [81] (regardless of the SSID to VLAN mapping configured on the AP). NOTE: If no VLAN was supplied by the RADIUS server, the AP assigns the default SSID to VLAN mapping.
*Option2: After authorization by 802.1x, and IF RADIUS specifies the SSID (with a VSA --> [026\009\001]), the AP can use this info to check that the SSID RADIUS specified matches the SSID the client used to associate. If != SSID, disassociate. If = SSID, then map the VLAN.
NOTE: If either the AP or switch receive a VLAN assignment from the RADIUS that doesn't match a valid VLAN on that switch or AP then the client is disassociated.
Hope this helps.
