We have implemented a basic 802.1x wired EAP-TLS configuration. Now, only domain workstations with a valid certificate gets access to our internal network; this is working perfect.
However, we want to extend this configuration with dynamic VLAN assignment based on an active directory group anuser is member of. Is this possible? As far as I understand the 802.1x authentication is finished before the user logs on so the concerning user authentication is handled by the domain controller instead of the NPS server. If possible anyway, can someone point me in the right direction how to set this up? I can't find much on this specific scenario.
Our environment uses Windows 7 clients, Windows 2012 R2 servers and Cisco network devices.
However, we want to extend this configuration with dynamic VLAN assignment based on an active directory group anuser is member of. Is this possible? As far as I understand the 802.1x authentication is finished before the user logs on so the concerning user authentication is handled by the domain controller instead of the NPS server. If possible anyway, can someone point me in the right direction how to set this up? I can't find much on this specific scenario.
Our environment uses Windows 7 clients, Windows 2012 R2 servers and Cisco network devices.