Where can you set the client's broadcast domain when configuring an ArubaOS firewall role?

In ArubaOS, a firewall role is a collection of policies applied to a user post-authentication. A primary function of a role is to segment users into different network segments or broadcast domains. This is achieved by assigning a specific VLAN ID to the role. When a client is assigned this role, the controller or AP places the client's traffic onto the specified VLAN, effectively overriding any default VLAN configured on the Virtual AP (VAP) profile or switch port. This mechanism is fundamental for dynamic network segmentation based on user identity or device type.

A. WLAN Settings: WLAN settings (specifically the Virtual AP profile) define the default VLAN for all users on that SSID, not a role-specific broadcast domain override.
B. Bandwidth Controls: This section within a role is used to configure Quality of Service (QoS) policies, such as rate limiting, not for assigning a client's VLAN or broadcast domain.
C. Access Control Rules: These are Layer 3/4 firewall policies (ACLs) within a role that permit or deny traffic based on protocols and addresses, but they do not define the Layer 2 broadcast domain.

ArubaOS 8.10.0.0 User Guide: In the section "Firewall Policies

" it details the components of a user role. It states

"A user role is a set of policies that can be applied to a user upon the completion of authentication. These policies can include a QoS profile

an ACL

a captive portal profile

or a specific VLAN ID." (See Chapter: "Firewall Policies"

Section: "Configuring User Roles"). This confirms that the VLAN ID

which defines the broadcast domain

is set within the role.

ArubaOS 8.6.0.0 User Guide: The section on "VLANs" describes VLAN derivation rules. It explains

"You can also assign a user to a specific VLAN based on the user role assigned to the user." This directly supports the concept of a role-based VLAN override to set the client's broadcast domain. (See Chapter: "Layer-2/Layer-3 Redundancy and VLANs"

Section: "VLANs").