Default Device Group
The single auto-created Group on a Radius Proxy Context. Its only operational purpose is to carry an Attribute Profile so every proxied authentication gets a consistent RADIUS response to your WLAN — usually a VLAN assignment for visiting users.
A Radius Proxy Context has exactly one Group — the Default Device Group, auto-created when the Context is provisioned. Unlike the other three EntryPoint variants, the Group isn’t where you organise audiences, delegate to teams, or manage membership. It’s the single place to attach an Attribute Profile that shapes the RADIUS response for every authentication that flows through the proxy.
Why a Group exists on a proxy at all
Section titled “Why a Group exists on a proxy at all”The upstream RADIUS server — an eduroam federation tier, a peer Organization’s RADIUS — decides who gets in. But the upstream’s Access-Accept might not include the RADIUS attributes your WLAN needs:
- A specific VLAN ID your network engineers require for visitors.
- A Security Group Tag to drive ACLs on your campus fabric.
- A tunnel-private-group-ID that’s specific to your network design.
The Default Device Group’s Attribute Profile lets you add, override, or ensure those attributes are present on every proxied response — regardless of what the upstream sent back. The upstream makes the authorization decision; your Attribute Profile shapes the response to match your network.
Configuring the Default Device Group
Section titled “Configuring the Default Device Group”-
Open the Context's Basic Configuration tab
On the tab, a card refers to the Default Attribute Group — that’s the same Default Device Group, under its UI label.
-
Click the Default Device Group link
Lands on the Group detail page. The Group shows a Statistics card with live Devices and Online counters, a Usage graph of registered and online devices over time, a Connected Devices list, and a Settings area. No user membership is tracked here — identities belong to the upstream federation — but devices that authenticate through the proxy are auto-added to this Group and listed.
-
Attach an Attribute Profile
On Group Settings, attach a Profile from the dropdown. If no Profile exists yet, create one at Context → Configuration → Attribute Profiles first. See Attribute Profiles.
-
Save
From this point, every proxied Access-Accept carries the Profile’s attributes.
Typical Attribute Profile shapes
Section titled “Typical Attribute Profile shapes”- Visitor VLAN. Three tunnel attributes that assign a dedicated guest VLAN to eduroam visitors — common VLAN choices are 800, 900, or a federated-visitor-specific ID. Exactly what you’d do on a Dot1x Group, with the difference being that the upstream federation is the authorization authority.
- SGT for egress ACL. A Cisco AV-pair setting the Security Group Tag that your campus fabric uses to apply egress restrictions. Useful when visitors share physical infrastructure with internal users.
- URL redirect / splash page. A Cisco AV-pair that redirects authenticated visitors to a welcome page. Optional — many eduroam deployments skip this in favour of letting visitors’ own supplicant configurations drive their connection.
A single Profile can stack multiple attributes — one Profile can set the VLAN, an SGT, and a URL redirect in one go.
Why you don’t manage membership here
Section titled “Why you don’t manage membership here”The Default Device Group has no Users tab and carries no Self-Service portal. It does list the devices that authenticate through the proxy (they’re auto-added on each forwarded authentication), but you don’t manage membership here. Deliberately:
- Users aren’t yours. They’re federation identities; attribution lives upstream.
- Devices aren’t enrolled. Visiting students’ laptops come and go; EntryPoint records them for monitoring as they authenticate, but doesn’t enrol or provision them.
- Delegation doesn’t apply. Nobody is a “Group Administrator” on eduroam — the federation itself is the authority.
The Users tab simply isn’t shown on a Radius Proxy Context. That’s not an oversight — it’s the variant’s shape.
Compared with the Dot1x and iPSK variants
Section titled “Compared with the Dot1x and iPSK variants”For a quick mental check:
| Dot1x (PEAP / EAP-TLS) | iPSK | Radius Proxy | |
|---|---|---|---|
| Number of Groups | Many (one per audience) | Many (one per device class) | Exactly one (Default Device Group) |
| Group membership | Local accounts, Entra mapping, cert lookups | MAC lists | Devices auto-listed for monitoring; identity lives upstream |
| Self-Service portal | Yes (PEAP users) | Yes (Group admins + PSK admins + users) | No |
| Attribute Profile attachment | Per Group | Per Group | On the Default Device Group only |
Day-to-day operations
Section titled “Day-to-day operations”- Edit the Attribute Profile when your VLAN / SGT strategy changes on the campus side.
- Swap the attached Profile if you want to change the VLAN treatment without editing the existing Profile (some Organizations prefer to keep Profiles immutable and swap them at the Group).
- Nothing else. The proxy runs itself; maintenance happens on Remote Radius Server (upstream changes) and on RADIUS clients (your WLAN side).