Dynamic VLAN Assignment with WPA2-PSK WLAN

[xiqa]

We have an XIQ-SE and an XIQ-C instance and would like to mix some forms of dynamic VLAN assignment. Here's what we'd like to achieve: 

1. The AP should be assigned it's management port in a VLAN untagged based on its MAC address. 

2. The clients using EAP-TLS should be placed in a VLAN tagged according to their role in XIQ-SE. 

3. The clients using WPA2-PSK should placed in a VLAN tagged according to the XIQ-C configuration. 

Here's a diagram that should illustrate what I'd like to accomplish: 

Is something like this possible? How would I "dynamically" assign the VLANs for the networks in the third authentication variant? 

We'd like to be able to plug in the AP's like any other client, so that the port is configured using the correct VLANs, without having to manually assign them.

It's an environment with only extreme switches, access points, NAC, WLC, etc., no other vendors. 

Thanks. 

[James_A]

No, you'd create a rule and role for APs with AP aware/MHSA enabled (you have to create a custom thing to send Extreme-Dynamic-MHSA for VOSS/Fabric Engine). For the clients you just send the appropriate profile/role/policy mapping and the AP places it in the appropriate VLAN. IE you don't authenticate the clients on the switch, only at the AP, because the switch doesn't know anything about the client's use of EAP-TLS or PSK on wifi.

[xiqa]

Hi James

thank you for your reply. I still haven't figured out how to get it to work. 

These are the steps that I have applied: 

1. Created a role with the AP aware function active and VLAN egress with the VLANs, that should be allowed implicitely: 

2. VLAN

The VLANs have only the Names and VID's configured. None of the other options. 

3. End-System Group

My EndPoint System Group looks like this: 

4. My Access Control Profile looks like this: 

5. My Policy Mapping looks like this: 

6. And finally my rule looks like this: 

I've tried to set the Default Action of the Access Control to "permit traffic", but then the AP is placed in the default VLAN and not the VLAN that I set as Untagged in the Egress VLAN list. 

Do you have an idea what I might have done wrong? 

Edit: And my access switches are all EXOS, so no VOSS/Fabric Engine that I could configure.