i want to make a windows server radius

Question

i want to make a windows server radius and we have many branches and some times vlans are different

for example
HQ : HR VLAN 10
staff vlan 20

in branch
HQ vlan 30
staff vlan 60

so i want to know how to solve this problem and i can not make them same vlans

Answer 1

Hello,

In your scenario, the challenge is that VLAN IDs differ between HQ and branch sites, but you still want a consistent RADIUS authentication experience. The good news is that RADIUS itself does not depend on VLAN numbers; what matters is how your switches or wireless controllers handle VLAN assignment after authentication. The RADIUS server (Windows Server NPS) can return attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Pvt-Group-ID to instruct the network device which VLAN to place the authenticated session into.

For example, you can configure NPS policies so that HR users receive a RADIUS response with Tunnel-Pvt-Group-ID = 10 at HQ, but Tunnel-Pvt-Group-ID = 30 at the branch. The policy conditions can be based on NAS-IP-Address or NAS-Identifier, which uniquely identify the site or device sending the request. That way, the same user group can be mapped to different VLAN IDs depending on the originating site, without requiring VLAN numbers to be identical across all branches.

To verify, check the NPS logs under %SystemRoot%\System32\LogFiles and confirm that the RADIUS attributes are being returned correctly. Also ensure that your switches or wireless controllers are configured to honor those attributes; otherwise, the VLAN assignment will fail even if NPS sends the correct response.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.