On the other hand, I think I've narrowed down my choices for NAC. I will look further into UNI-FY, but right now I think my best option, without having to go to open-wrt or whatever, with some version of chilli (or derivative) integration, is looking like ZeroShell:
Apparently, it can be configured to use a remote Radius server for AAA. I'm just noticing that chilli based AAA has limitations which I don't want to deal with.
I don't want to use a router with firmware update because I'd like more options and don't want to deal with "vendor lock-in". And from what I can see, zeroshell offers a lot of extra, low-level control. As mentioned in another part of this thread, being able to manage office users using WISPr-Bandwidth and similar controls, allowing me to aggregate all bandwidth with a single point of authentication which is what I'm looking at. My own "cloud", if you will.
Have you actually found somewhere that ZeroShell can use that attribute? I had a quick look at front and radius page and I would have some serious doubts. "The previous tuning can be applied on Ethernet Interfaces, VPNs, bridges and VPN bondings." I don't think that per user settings that you can pass with radius are supported. You can probably just fix the setting that will be the same for everybody. Ivan Kalik Kalik Informatika ISP