Access-policy - Can you return a "Filter-id" (Group policy name) on access-reject + guest ?

[thomasthomsen]

Behind the subject is the thought: If I return a group policy (filter-id) in the access-reject message from my radius server will the switch honor this, and apply the GP to the client ?

The thought is to apply a GP, with additional ACLs, to clients being placed in the guest network for an access-policy.

Thanks

/Thomas

[Ryan_Miles]

Reject or accept? On accept yes it can apply a GP by using filter-ID https://documentation.meraki.com/MS/Access_Control/Meraki_MS_Group_Policy_Access_Control_Lists#Confi...

[thomasthomsen]

So the answer is no. It can only apply GP on accept.

[alemabrahao]

It does not make any sense but ok.

[GreenMan]

If an access-reject is sent, the switch won't permit access, so I'm not sure how applying a group policy would help?

[thomasthomsen]

Well the though was that when you utilize Guest VLAN, then the client would be put into that VLAN on an access-reject. And I would just like to return some more config to that Guest access.

https://documentation.meraki.com/@api/deki/files/3974/MS_802.1X_auth_flow_chart.png?revision=1&size=...