We have company-issued laptops that users can log into using smart cards. Using the Tunnel-PVT-Groupd-ID RADIUS element, we can assign the machine to a VLAN based on the authenticated user. However, we only certain machines to be able to be placed on that VLAN when that user logs in.

Is there a way to assign a machine to a VLAN based on both the certificate installed on the machine for machine authentication and the logged in user using NPS?

closed as off-topic by Ron Maupin Jun 21 '18 at 7:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You need to give us more information. What is your network topology, network device model, and network device configurations. Whether or not you can do this is dependent on the information you provide. – Ron Maupin Jan 26 '18 at 23:37

you’ll want to use EAP chaining by using EAP-FAST which allows you to link the user and machine authentications.

Not the answer you're looking for? Browse other questions tagged or ask your own question.