What is the 802.1x dynamic ACL assignment from Microsoft NPS?

@BangorUni hi,
here is an example http://support.huawei.com/hedex/hdx.do?docid=EDOC1000005733&lang=en
path: CLI-based configuration > configuration guide - security > MAC configuration > configuration 802.1x authentication > (option)conguring a user group

Sorry I don't understand. Where does RADIUS fit in with user-groups? Maybe I should have been more specific, it's not just users but devices too. At the moment I'm working on authenticating Windows 10 PC's which have Microsoft Certificates installed. This works with Cisco switches using the attribute above. How does the Huawei switch know that my Windows 10 PC is a member of a user-group? Is this user-group the same name as the Microsoft Active Directory Group?

I'm confused.

what I understand is that you want to assign the dynamic acl to the users to limit them when authenticate failed, and permit them to access the services when authenticate success. Am I right?

if I understand right, maybe the example will help you, https://support.huawei.com/enterprise/en/doc/EDOC1000114001/eceec2e8/delivering-vlans-or-acls-to-successfully-authenticated-users-on-cisco-ise

Thank you but I've seen that document previously and it doesn't help with the RADIUS configuration, we are using Microsoft NPS as our RADIUS and I need to know how to configure the vendor specific attributes for downloadable ACL's.

To make it more clear I'll explain our Cisco setup which we want to replicate on Huawei switches:

RADIUS Server is Microsoft NPS.
Cisco switches have 802.1x configured.

The vendor-ID for Huawei is 2011 and the specific attribute for the downloadable ACL from the RADIUS server to the users is 26-82.

@BangorUni by the way,
it's recommended to use the RADIUS standard attribute filter-ID to announce the ACL.

Thanks, we are getting closer but the host still cannot access the internet after authentication. Please see stripped down config of our switch. We have a Pre-Auth-ACL on the port limiting access to one subnet. Once authenticated we want the ACL specified in RADIUS using Filter-Id (ACL 3001) to overwrite the Pre-Auth-ACL. I have included a display result at the end:

radius-server template dot1xauth
radius-server shared-key cipher *********
radius-server authentication 10.2.3.3 1812 weight 80
radius-server accounting 10.2.3.3 1813 weight 80

acl number 3001
rule 10 permit ip
acl name Pre-Auth-ACL 3999
rule 10 permit ip destination 10.3.0.0 0.0.255.255
rule 20 deny ip

aaa
authentication-scheme radius
authentication-mode radius local
accounting-scheme default
accounting-scheme dot1xacc
accounting-mode radius
domain dot1xauth
authentication-scheme radius
accounting-scheme dot1xacc
radius-server dot1xauth

interface GigabitEthernet0/0/2
description AMTTEST2
port link-type access
port default vlan 5
traffic-filter inbound acl name Pre-Auth-ACL
dot1x domain dot1xauth
dot1x enable
dot1x max-user 1
dot1x port-method port
dot1x reauthenticate
dot1x authentication-method eap

[HUAWEI-GigabitEthernet0/0/2]dis access-user user 106

Basic:
User ID : 106
User name : host/AMTTEST2.test.com
Domain-name : dot1xauth
User MAC : 7054-d2c4-3fcb
User IP address : 10.3.5.42
User vpn-instance : -
User IPv6 address : -
User access Interface : GigabitEthernet0/0/2
User vlan event : Success
QinQVlan/UserVlan : 0/5
User vlan source : server vlan
User access time : 2019/04/05 10:06:10 DST
User accounting session ID : HUAWEI00002000000005527625000006a
Option82 information : -
User access type : 802.1x
Terminal Device Type : Data Terminal
Dynamic VLAN ID : 5
Dynamic ACL number(Effective) : 3001
Session Timeout : 3600(s), Remaining: 3596(s)
Termination Action : RE-AUTHENTICATION

AAA:
User authentication type : 802.1x authentication
Current authentication method : RADIUS
Current authorization method : -
Current accounting method : RADIUS