1. Click VNS Tab > WLAN Services > select WLAN Service in question > WLAN Services Tab > Advanced button > Under Unauthenticated Behavior, ensure the Radio box is set to Discard Unauthenticated Traffic.
2. Disable Change of Authorization on NAC if we are relying on the NAC to disconnect the client rather than send an RFC3576 COA packet. From NAC manager click Tools > management and configuration > Advanced configuration > Global and appliance Settings > Appliance Settings > Default > double click on SysObjectID: 184.108.40.206.4.1.43220.127.116.11 - RFC3576 - Extreme Identifi Wireless > Manage RFC 3576 Configurations button > double click on Extreme IdentiFi Wireless > Uncheck the box "Supports Change of Authorization > Click OK / Save, then enforce NAC appliances