Ruckus ICX - 802.1x - is mac-vlan member of 2 vlans in single-untagged mode

!
spanning-tree single
!
vlan 1 name DEFAULT-VLAN by port
 no untagged ethe 1/1/1 to 1/1/2
 spanning-tree
 management-vlan
 default-gateway  172.30.1.1 1 dynamic
!
vlan 3 name Test3 by port
 tagged ethe 1/2/2
 spanning-tree
!
vlan 10 name Test10 by port
 tagged ethe 1/2/2
 spanning-tree
!
vlan 20 name Test20 by port
 tagged ethe 1/2/2
 spanning-tree
!
spanning-tree single 802-1w
!
!
authentication
  auth-default-vlan 3
  restricted-vlan 20
  auth-fail-action restricted-vlan
  dot1x enable
  dot1x enable ethe 1/1/1 to 1/1/2
  dot1x port-control auto ethe 1/1/1 to 1/1/2
  dot1x macauth-override
  mac-authentication enable
  mac-authentication enable ethe 1/1/1 to 1/1/2
!
aaa authentication web-server default local
aaa authentication dot1x default radius
aaa authentication login default local
aaa authentication login privilege-mode
enable telnet authentication
enable super-user-password .....
enable aaa console
enable user password-masking
ip address 172.30.1.108 255.255.255.0 dynamic
ip dns domain-list testnetz.home.arpa dynamic
ip dns server-address 172.30.1.1(dynamic)
ip multicast passive
ip multicast version 3
!
telnet server enable vlan 1
username admin password .....
!
radius-server host 172.30.1.109 auth-port 1812 acct-port 1813 authentication-only key 2 $b24tbz1nIlp8OA== dot1x mac-auth (no-login)
!
clock summer-time
clock timezone europe CET
!
ntp
 server ntp1.fau.de
! 

(9) Received Access-Request Id 82 from 172.30.1.108:1070 to 172.30.1.109:1812 length 188
(9)   User-Name = "vlan10"
(9)   Service-Type = Framed-User
(9)   Framed-MTU = 1500
(9)   NAS-IP-Address = 172.30.1.108
(9)   NAS-Port-Type = Ethernet
(9)   NAS-Port = 2
(9)   NAS-Port-Id = "1/1/2"
(9)   NAS-Identifier = "ICX7150-C12 Switch"
(9)   Calling-Station-Id = "56-55-CA-25-4B-BB"

(9) eap_peap: Success
(9) eap_peap: Using saved attributes from the original Access-Accept
(9) eap_peap:   Tunnel-Type = VLAN
(9) eap_peap:   Tunnel-Medium-Type = IEEE-802
(9) eap_peap:   Tunnel-Private-Group-Id = "10"
(9) eap_peap:   User-Name = "vlan10"
(9) eap: Sending EAP Success (code 3) ID 10 length 4

(9) Sent Access-Accept Id 82 from 172.30.1.109:1812 to 172.30.1.108:1070 length 0
(9)   Tunnel-Type = VLAN
(9)   Tunnel-Medium-Type = IEEE-802
(9)   Tunnel-Private-Group-Id = "10"
(9)   User-Name = "vlan10"
(9)   MS-MPPE-Recv-Key = 0x46a19385969812d4c4074f1c81e000d853f5cfc40ae5eb0cae6f8c233020d413
(9) Finished request 

(49) Received Access-Request Id 71 from 172.30.1.108:1068 to 172.30.1.109:1812 length 188
(49)   User-Name = "blabla"
(49)   Service-Type = Framed-User
(49)   Framed-MTU = 1500
(49)   NAS-IP-Address = 172.30.1.108
(49)   NAS-Port-Type = Ethernet
(49)   NAS-Port = 2
(49)   NAS-Port-Id = "1/1/2"
(49)   NAS-Identifier = "ICX7150-C12 Switch"
(49)   Calling-Station-Id = "52-55-CA-25-4B-BB"

(49) eap: Peer sent EAP Response (code 2) ID 9 length 46
(49) eap: Continuing tunnel setup
(49)     [eap] = ok
(49)   } # authorize = ok
(49) Found Auth-Type = eap
(49) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(49)   authenticate {

(49)   } # authenticate = invalid
(49) Failed to authenticate the user
(49) Using Post-Auth-Type Reject

(49) Sent Access-Reject Id 71 from 172.30.1.109:1812 to 172.30.1.108:1068 length 44

(50) Received Access-Request Id 72 from 172.30.1.108:1069 to 172.30.1.109:1812 length 128
(50)   User-Name = "5255ca254bbb"
(50)   User-Password = "5255ca254bb"
(50)   Service-Type = Call-Check
(50)   Framed-MTU = 1500
(50)   NAS-IP-Address = 172.30.1.108
(50)   NAS-Port-Type = Ethernet
(50)   NAS-Port = 2
(50)   NAS-Port-Id = "1/1/2"
(50)   NAS-Identifier = "ICX7150-C12 Switch"
(50)   Calling-Station-Id = "52-55-CA-25-4B-BB"

(50) Sent Access-Accept Id 72 from 172.30.1.109:1812 to 172.30.1.108:1069 length 0
(50)   Tunnel-Type = VLAN
(50)   Tunnel-Medium-Type = IEEE-802
(50)   Tunnel-Private-Group-Id = "10"
(50) Finished request