In the UI, you can select:
Association: MAC-based access control
Splash page: Click through
It accepts this and all is okay (I know you can't use sign on with RADIUS and MAC-based access control together)
However, how does this work in practice?
I would expect, that is the RADIUS server replies with an Access-Reject, the end user will then be redirected to the configured click through splash URL, and if Access-Accept, the end user will be straight online without any splash authentication required.
But, it seems to not work like this. If you do Access-Reject, it doesn't allow the device even to associate. If you do Access-Accept, the user is connected with no click through splash redirect and has full Internet. So, how do you actually get it to redirect someone to the splash page?