Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently working on a Microsoft NPS solution to provide 802.1x MAC authentication for wired and wireless clients along with providing a VLAN for the clients to be moved to.

It currently works perfect with our Wireless APs and switches, however we would like the NPS/RADIUS server to response with an Access-Accept even if the MAC address fails to authenticate which in turn would place the client in a guest/registration VLAN.

Is it possible to create a policy or rule on the NPS server that would have the effect of authorising MAC addresses that are not in the database and providing a relevant VLAN tag?

We already use the vlan/tunnel-id field to vlan tagging for the authorised users and its great.


share|improve this question

Sometimes the authenticator (depending on vendor) can act on an access-reject by design to place the end device in a holding VLAN. It might be called authentication failure vlan by some but each vendor who implements a feature like this has a slightly different naming.

I have yet to find anything within NPS that can provide the same result.

Juniper calls it the server-reject-vlan -

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.