Modify your configuration in Task2 so that the user role is derived from the RADIUS accept message. You will need to add the appropriate Authentication Server Rule for this. Detailed Network Requirements: All requirements from the previous tasks Server Rule: set role to value of Filter-Id Dot1x default role: authenticated Post-authentication role from server rule: employee (case sensitive) employee Role Policies: block icmp from a user to the web server at 10.254.1.21 . use the default allow policy