uctutor1

We have similar requirements. What I have done is set up 8021x auth using Active Directory as the Auth Server. Then in Aerohive I have one SSID with two users profiles. The profiles are assigned based on AD group membership. The AD NPS server passes back the pvt-tunnel-Group-ID attribute back to Aerohive to facilitate user policy assignment. In the Aerohive student user profile there is an IP firewall policy that only allows traffic to and from port 80 and 443 and well as DNS and DHCP.