NPS

[Pedro Kei]

We have the following wireless VLANS in the company.

Main Office

VLAN 20- Sales
VLAN 30 - Managers
VLAN 40 - Other Staff

Branch Offices

VLAN 40 Other Staff
VLAN 50 - Warehouse

We have a main office and 4 branch offices. The sales staff mostly work in the Head Office but some times do go to Branch offices. When the Sales staff is in the Head Office, I would like them to always connect to VLAN 20 but when travelling to Branch Offices, I want them connecting to VLAN 40 but not when they are at the Head Office. I am planning to authenticate wireless users using Windows NPS and I am trying to see if there is a way to do this using Tunnel-Pvt-Group-ID where Sales is assigned to VLAN 20 while at Head Office and VLAN 40 while at Branch offices.

[Scott Fella]

You best bet is to look at the logs when they connect in the main office and see what variables are available to use.  That way you can differentiate between the main office and the branch office.  Of course there is more setup required because you have to send the vlans back and validate that its working. There are some good Windows NPS docs, blogs and videos that folks have done way back when.  That is were I would start... I stoped using NPS a very long time ago.

https://mikepembo.wordpress.com/2016/11/07/dynamic-vlan-assignment-cisco-and-nps/

[Pedro Kei]

I don't think this answers or points me in the direction I want to go.

[Scott Fella]

You are using NPS, correct?  If you want to be able to have one controller and dictate what SSID is mapped to what vlan, then you need to look at dynamic vlan.  Unless you have a controller in each site, then you just set the SSID to the vlan you want.

Keep in mind, you never mentioned what equipment you have and your design.

[Pedro Kei]

Let me add a few details for more clarity. We are using Meraki APs in all the locations. Doing MAC based authentication on a single SSID and the NPS Radius server is set up and working good. My only dilemma is the situation I stated above. Is there a way to resolve that?

[Scott Fella]

Since you are using Meraki, what I can say is you can create templates for each site where an SSID is mapped to a vlan.  If you want to use dynamic vlans, then you need to look at this:
https://documentation.meraki.com/General_Administration/Cross-Platform_Content/VLAN_Profiles

[Pedro Kei]

I dont think this answers or points me in the direction I want to go.