NPS and multiple RADIUS clients, Policies and other questions about them

i have been having problem wireless connectivity nps led me question nps , best practices , how connection policies , network policies work (or they). 

i have multiple radius clients: cisco asa accepting vpn connections , aruba wireless ap's. in nps each client there corresponding radius client entry , connection policy. these correspond each other because reference each other. when vpn client tries connect appropriate connection policy applied. 

how associate network policies? have read system runs through each network policy until finds match having network policy each radius client may not right thing do. in case have vpn users group , allowed access vpn. allow domain users access wireless. users members of both second rule redundant. seem if system reads through policies , john member of allowed users in wireless policy, not vpn policy still able access vpn because system see him in @ least 1 of allowed groups under network policies. 

what point of connection policies setting in 3rd tab being able override network policy? 

i wonder if better practice have separate nps servers separate network services. 

john,

thanks answer. think accidentally pasted in wrong link network policies. here correct one https://msdn.microsoft.com/en-us/library/cc754107(v=ws.11).aspx

i still don't understand how server possibly know network policy apply. if have 2 connection policies , 2 network policies client (vpn or wireless in case) going validated against both network policies , allowed in. either system uses policies in order or uses most/least restrictive. according network policies document acts ordered set of rules placement critical if using multiple policies. 

hello,

in connection request policies have nas port type condition.

it wireless - ieee 802.11 (radius clients) or virtual vpn (vpn clients) defined.

radek

Windows Server  >  Windows Server 2012 General