I'm looking at testing WPA/WPA2 Enterprise encryption, using IAS (Radius) on a W2K3 DC. How do I setup Radius, etc. to allow some domain users access to one SSID, and some to another? Is there a way to assign by Group?
It should be possible to use the NAS-ID in the radius request for that. At the moment the APs will use a default NAS-ID but that should be different for different SSIDs (I guess it was something like "RalinkAP0" for ssid1, "RalinkAP1" for ssid2 etc.).
Btw. the NAS-ID per SSID should be the same on all APs. So you don't have to care about all APs.
For clarification: The APs will send a NAS-Identifier tag with the access request. Right now, the tags look like this: "RalinkAP0", "RalinkAP1" etc. This is misleading since the tags refer to a network (SSID), not an Access Point.
So you can use per-SSID RADIUS auth right now, you just have to find out which tag relates to which SSID.
We'll change this in GA, so the NAS-ID tag will actually be the SSID.