topic ExtremeControl & XIQ Controller - Policy Role - "Bridged@AP" VLAN in ExtremeCloud IQ Controller

ExtremeControl & XIQ Controller - Policy Role - "Bridged@AP" VLAN

Guilhem_Lejeune — Wed, 12 Nov 2025 19:07:20 GMT

Hi everyone,

I want to take advantage of pushing Policy Role (and only this) to XIQ Controller upon authentication.
My idea is :

Role with "Contain to VLAN X".
Accept Policy with my role only (no VLAN)
XIQ Controller as RADIUS client with "Extreme IdentiFi Wireless" in "RADIUS Attributes to Send".

I have noticed that, after Policy Enforce, VLAN (configured in XIQ SE/ExtremeControl in "Policy > Roles" menu) are pushed to XIQ Controller in "Bridged@AC" mode.

As expected, there was issue when testing 😄

Is there a way to have these VLAN being pushed with "Bridged@AP" mode ?

Kind regards,

Re: ExtremeControl & XIQ Controller - Policy Role - "Bridged@AP" VLAN

Doug — Thu, 13 Nov 2025 16:57:52 GMT

Are you using Filter-ID=<role name> to push the role (which should have a topology mapping)

Re: ExtremeControl & XIQ Controller - Policy Role - "Bridged@AP" VLAN

Guilhem_Lejeune — Thu, 13 Nov 2025 17:02:17 GMT

Hi,

Yes. The preview shows me this :

Filter-Id=Enterasys:version=1:policy=<role_name>

Kind regards,

Re: ExtremeControl & XIQ Controller - Policy Role - "Bridged@AP" VLAN

Doug — Thu, 13 Nov 2025 17:09:19 GMT

So the user gets the correct role assigned (not the default one), but is not in the correct topology? (check the end system report in XIQ-SE/Control (NAC))

Re: ExtremeControl & XIQ Controller - Policy Role - "Bridged@AP" VLAN

Guilhem_Lejeune — Thu, 13 Nov 2025 17:10:19 GMT

I will check again tomorrow and keep you in touch.

Thanks,

Re: ExtremeControl & XIQ Controller - Policy Role - "Bridged@AP" VLAN

iDavidHere — Mon, 29 Jun 2026 13:35:01 GMT

Hi, your approach makes sense but in ExtremeCloud IQ the VLAN assignment is usually controlled by the forwarding mode, not just the policy role. In many cases the VLAN will still land in Bridged @ AC unless it’s defined directly at the SSID or AP template level. You might want to check if the AP profile allows VLAN override from RADIUS. That usually solves the mismatch in Bridged@AP behavior.

Re: ExtremeControl & XIQ Controller - Policy Role - "Bridged@AP" VLAN

Goldy-chicken — Mon, 29 Jun 2026 13:47:27 GMT

The system doesn’t automatically switch to Bridged@AP just based on role assignment. To get Bridged@AP working, you usually need to define VLAN behavior directly in the SSID or AP profile so the AP takes control. Also check if any RADIUS attributes Morse Code Translator or controller policies are overriding what you’re trying to enforce from ExtremeControl.