I'm not sure it would be part of the RADIUS standard to dynamically switch a port from access to trunk or vice-versa, but that is really the same problem I'm trying to solve too. Have the network adjust to an AP that does local switching (be it Cisco, Meraki, or other), so I can get to a single port "configuration" for all the ports on my switch. ... View more

My thought is I would like to apply a filter (probably MAC address wildcard) to the native VLAN to recognize the AP in ISE.  If ISE could profile the WAP even better before permitting.  None of my end-users would end up on that native management VLAN so I'd only have the 1 client on the native VLAN, and still run DHCP with zero-touch for my AP deployment.  So in Meraki terms I could apply an "access policy" to the native VLAN of a trunk port and still run RADIUS on the client requests connected to the AP. ... View more