During boot time operation dot1xd may try to authenticate clients before network protocols have fully converged, hence traffic does not reach the NAC server.

dot1xd[11635]: DOT1XD_MAJOR_EXCEPTION_LOG: Authentication client could not contact RADIUS servers

> show dot1x interface ge-x/y/z.0 detail

Operational state: Authenticated

     Backend Authentication state: Idle

     Authentication method: Server-Fail Vlan. ---- > ***

     Authenticated VLAN: Auth_Fail

     Session Reauth interval: 65000 seconds --- > ***

     Reauthentication due in 54778 seconds

The problem is a timing conflict during the switch boot process. The Dot1x daemon attempts to reach the RADIUS server before the network processes have fully converged. Because the server is initially marked unreachable, end devices are placed into the Server-Fail VLAN. Since reauthentication is configured for 65,000 seconds (18 hours), the devices remain stuck there until the port is manually bounced an authentication is triggered.

To resolve this, we suggest enabling the RADIUS reachability query:

 radius-reachability {

  query-period seconds;

 }

set protocols dot1x authenticator radius-reachability query-period 60.  

This setting allows the authenticator to proactively check for the server and reauthenticate sessions in a fail state as soon as connectivity is restored, rather than waiting for the 18-hour timer to expire.

The authenticator checks for reachability by triggering reauthentication for one of the authentications sessions that previously failed to reach the server.

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/protocols-dot1x-authenticator-radius-reachability.html