**Answer**
I wound up realizing that MAC-based VLANs isn't really what I wanted, and that Group-based VLANs are actually much more flexible. From here on out, the information will regard to accomplishing VLAN assignment based on group membership.
**Bench Test**
I followed [this really great guide][1] published by Meraki. It is 99% generic so if you're not a Meraki shop don't worry. There were just 2-3 settings to change in the Meraki and you can probably translate that into your system easily enough.
- Windows Server 2012 R2 (in VMware Workstation)
- Domain Controller
- DHCP
- 192.168.3.1 /24 (primary scope)
- 192.168.4.1 /24 (scope will be used for VLAN 400)
- 192.168.5.1 /24 (scope will be used for VLAN 500)
- Option 3 (Router) set to point to Aruba switch (192.198.3.6)
- DNS (standard setup)
- Certificate Services
- (I followed [this guide](https://technet.microsoft.com/en-us/library/cc772393%28WS.10%29.aspx). Skip the part where they have you test revoking a cert. It made a bit of extra work)
- NAP
- Connected to port 1 on the switch
- L3 Aruba 2920-24G Switch
- Configured for routing inside test network (but not out to the Internet)
- Don't forget IP helpers
- sho config listed below for reference
- Cisco Meraki MR18 WAP
- Connected to port 3 on the switch
- Configured to use RADIUS (link in comments...I'm new to this stackexchange network and I can't post more than 2 in the body)
- 2x Lenovo ThinkPad 11e Laptops (wireless clients to test with)
- Joined to domain
- Named "WIRELESSLAPTOP" and "WIRELESSLAPTOP2"
- AD Structure
- OU: "Test Machines" containing both laptops
- OU: "VLAN Assignment Groups"
- Group: "VLAN 400" with member "WIRELESSLAPTOP2"
- Group: "VLAN 500" with member "WIRELESSLAPTOP"
**Result**
Following the guide and then expanding a little, I wound up with three network policies. There is a VLAN 400 Policy which injects the VLANID 400 into the RADIUS-ACCEPT packet, and there's a VLAN 500 Policy which works the same way. There is also a required default policy of sorts (explained in the guide). Each of these policies has a "Conditions" list, and that is where you assign that policy to a group. Just stick your computers in that group and they'll be good to go.
**Now when I connect these two laptops to the network, one lands on the 400 VLAN and gets a 4.x address, and the other lands on the 500 VLAN and gets a 5.x address. These assignments can be changed as easily as group membership.**
I believe this will be a pretty robust solution for us moving forward. Note to the reader, this is a complex solution so while the manageability is nice, be sure it's something you'll need and use before introducing several new layers of complexity into your environment.
----------
sho config placed here for reference
; J9727A Configuration Editor; Created on release #WB.16.03.0004
; Ver #10:08.3f.f3.b8.ee.34.79.3c.29.eb.9f.fc.f3.ff.37.ef:86
hostname "HP-2920-24G-PoEP"
module 1 type j9727a
gvrp
ip route 0.0.0.0 0.0.0.0 10.1.30.1 (config for routing to the production
network)
ip routing
snmp-server community <removed> unrestricted
oobm
ip address dhcp-bootp
exit
vlan 1
name "DEFAULT_VLAN"
no untagged 5,15
untagged 1-4,6-14,16-24
ip address dhcp-bootp
exit
vlan 300
name "aovlan"
untagged 5 (this is an uplink to our production environment. Not currently
in use)
ip address 10.1.30.100 255.255.255.0
exit
vlan 400
name "TestA"
tagged 3 (this is where the AP lives)
ip address 192.168.4.1 255.255.255.0
ip helper-address 192.168.3.1
exit
vlan 500
name "TestB"
untagged 15 (port 15 was used in previous testing...not really important
here)
tagged 3 (this is where the AP lives)
ip address 192.168.5.1 255.255.255.0
ip helper-address 192.168.3.1
exit
device-profile name "default-ap-profile"
cos 0
exit
activate software-update disable
activate provision disable
----------
[1]: https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise