FortiNAC 7.4 - guest redirect - radius fail post auth

Hello,

I have configured FortiNAC-F 7.4.1 to use a guest captive portal for self registration. A FortiGate is configured using radius locally on FNAC. This is successfull in the FGT UI.

On FNAC I have role based access enabled for the SSID, and the dynamic VLANs. The Guest modelling config also has registration set to enforced.

My problem is that any client trying to connect to the SSID doesn't appear to be authorized to register. Has someone come across this issue before and could point me in the right direction?

The error is Registration - Access Deny (Post-Auth) and the client will not be redirected to the captive portal.