University clients pass 802.1X and land in the wrong VLAN. The WLAN and the policy profile are correct when ISE is bypassed. Which platform is assigning the VLAN they actually receive?
Select an answer to reveal the explanation.
Short Explanation
When you bypass ISE, the VLAN comes back to what you built. ISE is handing back an authorization result that puts your clients somewhere else. The RF tag does not read a signal and pick a VLAN.
Full Explanation
With 802.1X, ISE can return an authorization result that includes the VLAN, an ACL, or a similar policy, and the controller applies that result. Bypassing ISE restores the VLAN the WLAN was built to use, and the live sessions take a different VLAN from the authorization result. That places the assignment on ISE. An RF tag binds radio profiles. It does not select a client VLAN from RSSI or SNR. Sniffer mode captures frames. It does not write a VLAN into beacons, and these clients are completing 802.1X on a serving access point, not on a sniffer. A DHCP server leases an address on the VLAN it was asked to serve. It does not move the client to a different VLAN after the lease. If the VLAN tag is wrong before DHCP, the server never had a chance to choose it. Exam caveat: an authorization result of 'use the WLAN VLAN' looks different from an explicit VLAN push. Read the result attributes, not only the authentication success. Operational check: in the ISE live log for one client, read the authorization profile and the VLAN it returns, then match that VLAN to the session on the controller.