Wireless Access

I am wanting to validate that my understanding is correct.

My assumption is that a matched authstring would not be load balanced since it is caught by the match rule. 

I have specific users authenticating against a different radius server and the rest of the users authetnicate against a pair of auth servers. 

For initial or continued authentication?  A user will "stick" with whatever authentication server they first authenticated with unless that specific server is impaired.

Both initial and continued.

I have a lab domain, that I catch in authstring. So the users tied to that domain will always authenticate agaisnt the lab auth server. 

But other users would need to auth against our standard production auth servers that we use the load balance option for. 

Does that make sense?

What is the match-authstring configuration?