Hello Joel, We've implemented the identical structure. We use the Microsoft NPS server as the Radius server. We've created several policies there, which the server processes from top to bottom. As you can see, the Meraki VoIP policy comes first. It also includes the attribute for the switch, indicating that it's a VoIP device. I'm attaching a few screenshots for you. We use MAB for the VoIP phones and EAP TLS for the domain computers. Users are then authenticated via EAP TLS based on their domain user certificate. For this purpose, we've created groups in our AD to determine which user belongs to which VLAN. We query these groups under the conditions in the NPS server. It's also important not to check the "Fast Authentication" box in the Meraki dashboard; this causes massive problems for us. I hope this is now a little clearer for you.     ... View more

  Hello,   we have the same Problem. If i set vlan and voice vlan on the same setting my configuration works fine.   Then i set vlan to 1 the setting does not work. The Meraki switch does not use the cisco-av.pair setting from the Windows Network policy server.     The Port is beeing autheticated correctly  but from the av pair setting is nothing in the log.   May 17 12:42:04 NLT-1   00:1a:e8:64:c2:ca RADIUS MAB authentication resp: accept May 17 12:42:04 NLT-1 Port 21 00:1a:e8:64:c2:ca 802.1X RADIUS response port: 21, rtt: 0.000 ms May 17 12:42:04 NLT-1 Port 21 00:1a:e8:64:c2:ca 802.1X 802.1X deauthentication port: 21 May 17 12:42:03 NLT-1 Port 21   Spanning Tree Port RSTP role change Port 21 disabled→designated May 17 12:42:03 NLT-1 Port 21   Switch port Port status change port: 21, old: down, new: 1Gfdx     ... View more