EXOS VSA 211 untagged not working

[netjradm]

Hi,

i'm trying to authenticate client via dot1x (EAP-TLS), RADIUS and netlogin.
Our Radius Server is sending the VSA211 Attribute in the Accept Message but the EXOS Switch does not put the Client in the specified VLAN.

Radius Attribut:
Extreme-Netlogin-Extended-Vlan=U5

Wireshark Capture:

exos debug

when i configure the radius server to send the vlan via Tunnel-Group-ID the end device is moved to the correct vlan.

wireshark capture

netlogin debug

Switch Config: 

configure radius netlogin primary server XXX.XXX.XXX.XXX 1812 client-ip XXX.XXX.XXX.XXX vr VR-Default
configure radius netlogin primary shared-secret encrypted "secret"
configure radius netlogin secondary server XXX.XXX.XXX.XXX 1812 client-ip XXX.XXX.XXX.XXX vr VR-Default
configure radius netlogin secondary shared-secret encrypted "secret"
configure radius dynamic-authorization 1 server XXX.XXX.XXX.XXX client-ip XXX.XXX.XXX.XXX vr VR-Default shared-secret encrypted "secret"
configure radius dynamic-authorization 2 server XXX.XXX.XXX.XXX client-ip XXX.XXX.XXX.XXX vr VR-Default shared-secret encrypted "secret"
enable radius
disable radius mgmt-access
enable radius netlogin
enable radius dynamic-authorization
enable netlogin dot1x
enable netlogin ports 3-8 dot1x

[OscarK]

yes., but as you can assign vlans through the policy itself (pvid) you don't need VSA 211. Checkout table 114 in the userguide for vsa's supported with OnePolicy enabled.

 Table 114: Supported Access-Accept Attributes for ONEPolicy

[netjradm]

yes i have configured one policy for the ap's ( Tagging multiple vlans and activate auth override)
So the VSA211 only works when there is no policy on the switch?

[OscarK · Accepted solution]

Have you enabled policy (I assume so as you have dynamic authorization enabled) ?

If so, then EXOS does not honor VSA211, only the attributes mentioned in the userguide for policy and only if you enable maptable response both and vlanauthorization.