You can assign VLANs in various ways. From your question, I could not be certain of how you are doing it vs. how you want to do it.
- Assign a default VLAN in the virtual AP profile (this will be the default for the SSID)
- Assign a VLAN as part of a user role (this will override the default VLAN in the virtual AP)
- Assign a VLAN based on an Aruba VSA from RADIUS (RADIUS makes a decision and assigns an appropriate VLAN by returning attributes to the controller)
- Define user or server derived rules on the controller to set a VLAN for specific devices
You can also run the following command to determine how/why the client was assigned a particular VLAN:
show user ip x.x.x.x
Look for the VLAN Derivation field.