Home > Wireless LAN > Client Addressing and Bridging > RADIUS Override

RADIUS Override

Table of contents
No headers

A RADIUS server has the ability to send VLAN information to the AP in RADIUS Access Accept messages. To send VLAN information, three required RADIUS attributes must be configured in your RADIUS policy:

  • Tunnel-Type: Choose  Attribute value Commonly used for 802.1X and select Virtual LANs (VLANs).
  • Tunnel-Medium-Type: Choose 802 (Includes all 802 media plus Ethernet canonical format) for the Attribute value Commonly used for 802.1X.  
  • Tunnel-Private-Group-ID: Choose String and enter the VLAN desired (ex. "500")This string will specify the VLAN ID 500.


Sample FreeRADIUS user configuration (/etc/freeradius/3.0/users):

Tunnel-Type = "VLAN",
Tunnel-Medium-Type = "IEEE-802",
Tunnel-Private-Group-ID = "500"

Check your RADIUS vendor-specific documentation for the appropriate values.


Sample FreeRADIUS EAP configuration (/etc/freeradius/3.0/mods-enabled/eap):

use_tunneled_reply = yes

When configuring the Tunnel parameters under the EAP configuration, FreeRADIUS will not inject these parameters into the final Access-Accept unless the EAP configuration is changed from 'use_tunneled_reply = no' (Default) to 'use_tunneled_reply=yes'.


To configure the AP to accept the VLAN information sent from by the RADIUS server, navigate to Wireless > Configure > Access Control and see the Addressing and Traffic section. Enable set "Radius Override" to "RADIUS Response Can Override VLAN tag." This setting can override the configured SSID VLAN or apply a VLAN if one is not specified:


Note: RADIUS override can only be used with WPA2-Enterprise or MAC-based access control.

Last modified



This page has no classifications.

Explore the Product

Click to Learn More

Article ID

ID: 1642

Explore Meraki

You can find out more about Cisco Meraki on our main site, including information on products, contacting sales and finding a vendor.

Explore Meraki

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case

Ask the Community

In the Meraki Community, you can keep track of the latest announcements, find answers provided by fellow Meraki users and ask questions of your own.

Visit the Community