Authenticated user not getting vlan assignment in tunneled SSID mode

Hi,

I am looking for some input in to what I might be doing wrong in our new Fortinet setup. We are migrating from another vendor to a full Fortinet access-network consisting of Fortigates, Fortiswitches and FortiAP:s. The config is coming along nicely and we are almost ready to start testing this new network on a larger group of users. 

We have 2 VDOMs and Global, 7 VRFs and use OSPF to route traffic to the rest of the corporate network. Setting up wired access was a breeze with fortilink and the WIFI for corporate users (using Cisco ISE as Radius) is ready to be tested across the company. 

However I am having some issues with what I feel should be the easiest WIFI SSID to get up and running. The SSID intended for Guest. 

We have 4 SSID:s, one for corporate users having several VLANS attached to the SSID interface, each vlan belonging to different VRFs. One IOT SSID and one SSID for developers doing testing and lastly the SSID for Guest. They are all tunneled SSID:s. 

I have assigned the guest-vlan to the Guest-SSID. I have verified that the guest-vlan can reach the DHCP-relay server. I use WPA2 PSK for authentication (so ISE is not involved here) and the test-users gets authenticated without any issues, but for some reason they don't get a VLAN ID assignment and hence, no DHCP IP Address. 

I face similar issues at the start but that was because the user-vlan was placed under the fortilink-interface and not under the SSID-interface. A simple error from my part.

One major detail that differs the guest-vlan from the corporate vlans is that it is on global (vrf=0). But we verified that global has routing and access to the network services needed.

We have the same type of firewall policy that the corporate vlan has that allows traffic from the vlan-out.

I can see in Wireless Clients that the user gets authenticated and I see all the user data, except VLAN and DHCP-info. However, we see no traffic in the logs and the user gets a APIPA address.

I was thinking about doing a TAC case but I thought I would give the forum a chance as I am starting to believe I have missed something very basic but I can not figure out what.

Any hints and input that might put me in the right direction is greatly appreciated.