Okay, the how...
MT RB2011 (NO WIFI):
MT RB2011 (WAN facing) is radius client for 'ppp (VPN)' and 'dot1x (Ether)' NPS (Windows 2012 Server)
vlan trunk configured (vlan ids 7,8,9) MT RB2011 is the DHCP server for all.
Bridge vlan filtering enabled - Yes..
Three dhcp servers running on RB2011 one for each vlan interface etc.. Again no dhcp server is configured for radius, also I am NOT using dhcp checkbox in radius client configuration
MT hAP ac^2 (MT wifi router (2.4/5))
LAN facing radius client for 'wireless' only to NPS (Windows 2012 Server)
This one is hard wired into ether 7 of the RB2011 router
No dhcp servers are configured on MT hAP ac^2
3 vlans setup (vlan ids 7,8,9) (All ports bridged with vlan filtering enabled - Yes..
one wireless AP setup to use tag of master vlan id 1
3 virtual wireless bridges setup to use tag of 7,8,9...
So now.. when the user connects to the wifi-ap-bridge; the MT hAP ac^2 sends a wireless radius request to the NPS radius server..
The NPS radius server sends a response back to the MT hAP ac^2 with the access aproval and vlan id assigment attribute..
With the returned attribute the user connects to the corresponding wifi-bridge; at which point a dhcp broadcast is sent from the
authenticated client device; this dhcp request is passed ONTO the MT RB2011 since no dhcp server is configured on MT hAP ac^2
and there is a link between the two MT routers. The client device is authorized so the MT RB2011 gives out an IP address from the vlan-dhcp-server based on the
client connections vlan id.. and that is about it... so as we can now see; you do not need to use dhcp in your radius config
to get a dhcp assignment from a radius request and response... sound about right