Dynamic VLAN Assignment with RADIUS: Segmenting Users by Role

Welcome to the Purple Technical Briefing. I'm your host, and today we are diving into a critical architecture topic for multi-venue operators: Dynamic VLAN Assignment with RADIUS. If you're managing networks across hotels, retail chains, or large public venues, you know the pain of manual network segmentation. You've got staff devices, guest devices, and an ever-growing army of IoT sensors. Putting them all on a flat network is a security nightmare, but manually assigning static VLANs per port or SSID doesn't scale. That's where RADIUS comes in. By leveraging 802.1X authentication and RADIUS attributes, specifically Tunnel-Private-Group-ID, you can automatically assign users and devices to the correct VLAN at the exact moment they authenticate. Let's break down the technical mechanics. When a device associates with an access point, it initiates an EAP exchange. The authenticator—usually your AP or switch—forwards this to your RADIUS server. If the credentials are valid, the RADIUS server sends back an Access-Accept message. But here is the magic: inside that Access-Accept packet, you configure the RADIUS server to include three specific IETF standard attributes. First, Tunnel-Type set to VLAN, which is value 13. Second, Tunnel-Medium-Type set to IEEE-802, value 6. And third, Tunnel-Private-Group-ID, which contains the actual VLAN ID string, like "10" for Staff or "20" for Guests. When the access point receives this, it dynamically tags the user's traffic with that VLAN ID. The result? A single SSID can securely serve multiple distinct user groups, dropping them into isolated network segments with their own firewall rules and bandwidth limits. Let's talk implementation. Whether you're using Cisco Catalyst, Aruba ClearPass, or Ubiquiti UniFi, the core principles remain the same, though the exact syntax varies. In a hospitality scenario, for example, a front desk agent logs in and gets dropped into the secure Staff VLAN with access to the property management system. A guest connects via the captive portal and gets placed on an isolated Guest VLAN with client isolation enabled. Meanwhile, smart thermostats authenticate via MAC Authentication Bypass, or MAB, and are assigned to a locked-down IoT VLAN that can only reach specific control servers. This architecture isn't just about convenience; it's about risk mitigation and compliance. If you process payments, PCI DSS requires strict segmentation of your point-of-sale terminals. Dynamic VLANs ensure that even if a POS device is moved to a different port, it remains securely segmented. But what are the pitfalls? The most common failure mode is RADIUS unavailability. If your access points can't reach the RADIUS server, devices can't authenticate. You must configure fallback mechanisms. Most enterprise APs support a "critical VLAN" or "fallback VLAN" setting. If RADIUS times out, the AP drops the device into a restricted VLAN that perhaps only allows internet access, keeping the business running without compromising internal security. Another pitfall is inconsistent VLAN naming across sites. If VLAN 10 is "Staff" at site A but "Guest" at site B, dynamic assignment will cause chaos. Standardise your VLAN IDs globally before implementing this. To summarise: Dynamic VLAN assignment via RADIUS transforms network access from a manual chore into an automated, scalable security policy. It reduces SSID bloat, enforces role-based access control, and simplifies compliance. Thanks for joining this technical briefing. For more deep dives into enterprise WiFi architecture, check out the guides section on the Purple website.