Hello All,
I have an Instant network setup and the client would like two different dot 1x networks to authenticate to the same NPS server. The two networks should provide authorization based upon group membership. One WLAN is for admins, it should filter based upon the domain admins group and be unrestricted. The other WLAN will be for other employees, it should filter upon the domain users group and have some restrictions applied. I have created both networks in the Instant cluster, applied application firewall rules and I have created two differenet network policies in NPS where I have set the conditions based upon the applicable windows groups. Authentication works fine, my problem is with authorization. With the way NPS works, any user can connect to either network, as if one network policy fails it will try the next. In the security logs I see user authentications hitting my different policies so that piece of the design is working as intended. I need, or rather, is there a way to, stop it and somehow let one WLAN use one and only one network policy in NPS so it fails and doesn't try subsequent policies (particularly applicable for the admin network)? I've done this with ClearPass for other clients without issue, but for this client they didn't want to spend the $$$ on CPPM (it's a 6 IAP-205 shop, pretty small) and decided on NPS instead. I'm just not sure if I can do this on Instant without a second NPS server. I will also at this point freely admit that my NPS knowledge is enough to get by, but I'm not an expert by any means. Thanks for the long read. Any help appreciated.