Dynamic VLAN assignment via 802.1X (RADIUS) for MS Switches

It may be necessary to perform dynamic VLAN assignment on a per computer or per user basis. This can be done on your wired network via 802.1x authentication (RADIUS). In order to do so, the following RADIUS attributes must be configured and passed in the RADIUS Access-Accept message from the RADIUS server.

• Tunnel-Medium-Type: Choose 802 (Includes all 802 media plus Ethernet canonical format) for the Attribute value Commonly used for 802.1X. 

• Tunnel-Pvt-Group-ID: Choose String and enter the VLAN desired (ex. "500"). This string will specify the VLAN ID 500.

• Tunnel-Type: Choose  Attribute value Commonly used for 802.1X and select Virtual LANs (VLANs).

Once these attributes are configured on the RADIUS server, client devices can receive their VLAN assignment dynamically.

For more information on how to configure with NPS, visit Microsoft's article on Configuring a Network Policy for VLANs.