Cloud clients are not timing out and showing the incorrect Roles
Clients that are connected to a Cloud Access Point will show an old Role if they change networks, or if a new Role is assigned as the Default Role to the network.This creates some confusion on whether the Role is applied correctly, and what filters are applied to the user.
This is being caused by the fact that the users are not timing out from the Cloud Access Point. When they leave to another Network and Role, they still have an active session and are receiving the old Role. This is currently under investigation for a fix.
Updated - This is fixed in Cloud release 3.11.03
To workaround this, you can force a disassociation on the client by disabling/enabling
Rebooting the AP would clear this and connect the client to the correct Role.
We expect a fix for this in a future version as well as a method of disassociating users to create a new session. Currently, you can try to blacklist the user and delete the blacklist entry as well.