DHCP address enforcement ensures that clients who connect must complete the DHCP process to obtain an IP address. Otherwise they are disconnected from the SSID. This prevents access from users using static addresses which may conflict with the DHCP address scheme, or users that fail to obtain DHCP IP assignment.
config wireless-controller vap
set ssid "test-tunnel"
set passphrase ********
set schedule "always"
set dhcp-address-enforcement enable