Thanks Tim for your quick response,
As mentioned I'm trying that in my lab, and my scenario is
Guest will connect after that guest should complete one onguard check, [condition= firewall is on]
If the guest pass the check, he will get guest roll,If failed then denyall rule.