Hierarchy for Applying Policies by Device Type

[FlyingFrames]

If mac auth is being used and the RADIUS server returns, "group policy X" for "client A".

But the SSID has "group policy by device type" set to "group policy Y" for "client A".

Which group policy finally takes precedence for client A? Is it X or Y?

Is there a CoA involved in this?

Ref: https://documentation.meraki.com/MR/Group_Policies_and_Block_Lists/Applying_Policies_by_Device_Type

[GiacomoS · Accepted solution]

Hey @FlyingFrames !

Great question this one!

A policy by device type will override a RADIUS policy. 

The policy by device type reads the HTTP GET packet that is sent by a client, to then apply the policy. This cannot happen until RADIUS authentication has completed, so the client would likely receive a RADIUS policy first, and once we read the HTTP GET, we'll then be able to apply the by device type policy. 

There is no CoA, as the prioritisation of the policies is handled within the AP. 

Hope this helps!

Giac