How to make a network BEFORE AD in Mikrotik?

Question

Active Directory

Hello!
Actually, the question is in the title :))
Make two levels of the network:
1. Welcom network, without Internet access, from where you can only log in to AD
2. After authorization in AD, the computer is already in another vlan, where all the necessary routing settings are already, etc. .
To be honest, I can only imagine how it's done. But I'm sure there are already examples of implementation. Thank you!

Answer 1

I'm not an expert, but I've used similar technology.
As far as I know, the network device needs to support the 802.1x protocol.
A simple scheme looks like this:
- the client connects an ethernet cable to his laptop and tries to log in using 802.1x
- the radius server processes the request on its own, or by contacting AD
- the radius server gives a response to the network device about the success (failure) of authorization
- the network device redirects the client to one or another vlan