Customer is configuring 802.1x authentication on a Juniper switch with a dynamic ACL defined in Cisco ISE. The dynamic ACL is defined with multiple Juniper-Switching-Filter--[48] VSA Match Conditions
Access Type = ACCESS_ACCEPT Juniper-Switching-Filter = match source-port 68 destination-port 67 action allow Juniper-Switching-Filter = match destination-port 53 action allow Juniper-Switching-Filter = match destination-ip 10.140.5.100/32 action allow Juniper-Switching-Filter = match destination-ip 10.219.248.112/32 action allow Juniper-Switching-Filter = match destination-ip 10.219.248.111/32 action allow Juniper-Switching-Filter = match destination-ip 10.192.100.100/32 action allow Juniper-Switching-Filter = match destination-ip 10.104.1.175/32 action allow Juniper-Switching-Filter = match destination-ip 10.85.254.68/32 action allow Juniper-Switching-Filter = match destination-ip 10.142.100.161/32 action allow Juniper-Switching-Filter = match destination-ip 10.104.5.20/32 action allow Juniper-Switching-Filter = match destination-ip 10.104.5.42/32 action allow Juniper-Switching-Filter = match destination-ip 10.85.254.4/32 action allow Juniper-Switching-Filter = match destination-ip 10.85.254.20/32 action allow Juniper-Switching-Filter = match destination-ip 10.85.254.52/32 action allow Juniper-Switching-Filter = match destination-ip 172.16.219.133/32 action allow Juniper-Switching-Filter = match destination-ip 172.16.219.212/32 action allow Juniper-Switching-Filter = match destination-ip 172.16.219.134/32 action allow Juniper-Switching-Filter = match destination-ip 10.164.255.215/32 action allow Juniper-Switching-Filter = match destination-ip 10.223.10.63/32 action allow Juniper-Switching-Filter = match destination-ip 172.16.4.142/32 action allow Juniper-Switching-Filter = match destination-ip 172.16.223.72/32 action allow Juniper-Switching-Filter = match destination-ip 10.6.40.233/32 action allow Juniper-Switching-Filter = match destination-ip 10.6.40.234/32 action allow Juniper-Switching-Filter = match destination-ip 10.6.40.133/32 action allow Juniper-Switching-Filter = match destination-ip 10.214.49.137/32 action allow Juniper-Switching-Filter = match destination-ip 10.214.50.238/32 action allow Juniper-Switching-Filter = match destination-ip 172.16.221.151/32 action allow Juniper-Switching-Filter = match destination-ip 10.2.10.139/32 action allow Juniper-Switching-Filter = match destination-ip 172.16.221.20/32 action allow Juniper-Switching-Filter = match destination-ip 10.61.212.110/32 action allow Juniper-Switching-Filter = match destination-ip 10.61.212.111/32 action allow Juniper-Switching-Filter = match destination-ip 10.61.212.50/32 action allow Juniper-Switching-Filter = match destination-ip 10.61.212.59/32 action allow Juniper-Switching-Filter = match destination-ip 10.40.246.10/32 action allow Juniper-Switching-Filter = match destination-ip 10.61.212.20/32 action allow Juniper-Switching-Filter = match destination-ip 10.61.214.200/32 action allow Juniper-Switching-Filter = match destination-ip 10.61.214.205/32 action allow Juniper-Switching-Filter = match destination-ip 172.29.224.140/32 action allow Juniper-Switching-Filter = match destination-ip 172.29.206.60/32 action allow Juniper-Switching-Filter = match destination-ip 172.29.206.9/32 action allow Juniper-Switching-Filter = match destination-ip 192.168.40.229/32 action allow Juniper-Switching-Filter = match destination-ip 172.16.76.191/32 action allow
Customer gets an error in the dynamic Dot1x filter "Held state Reason: Error tokenizing switching-filter"
Customer has the dACL working as expected with one match condition per VSA line as follows:
Below are the attributes for the full dACL: if only 20lines the filter is installed correctly
Looking at the documentation: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/user-access-radius-authentication.html#id-juniper-networks-vendor-specific-radius-attributes "The 4000 character limit is subject to supported MTU on both the RADIUS server and the Juniper device, and the number of other RADIUS attributes used" But the customer seems to be below this limit.
mist@switch > show dot1x interface ge-0/0/0 detail ge-0/0/0.0 Role: Authenticator Administrative state: Auto Supplicant mode: Multiple Number of retries: 3 Quiet period: 2 seconds Transmit period: 2 seconds Mac Radius: Enabled Mac Radius Restrict: Disabled Mac Radius Authentication Protocol: EAP-MD5 Reauthentication: Enabled Reauthentication interval: 3600 seconds Supplicant timeout: 10 seconds Server timeout: 30 seconds Maximum EAPOL requests: 3 Guest VLAN : not configured Last Mac-Learn Request: xx:xx:xx:xx:xx:xx Last Mac-Learn Time: 2025-12-10 10:33:06.815085 Number of connected supplicants: 1 Supplicant: xxxxxxxxxxxx, x:x:x:x:x:x Operational state: Held Held state Reason: Error tokenizing switching-filter <<<<<<<<<< error Backend Authentication state: Idle Authentication method: Mac Radius Session Reauth interval: 0 seconds Reauthentication due in 0 seconds Session Accounting Interim Interval: 600 seconds Accounting Update due in 0 seconds Eapol-Block: Not In Effect Domain: Data
You can use multiple instances of the Juniper-switching-filter attribute with a maximum limit of 20 match conditions and a maximum total size of 4000 characters, The maximum length of any radius attribute is 253 characters, so each line of the "Juniper-switching-filter" attribute should also be less than 253 characters.
Also, attributes can be reconfigured, reconfigure the attributes using shorter characters descriptors:
destination-mac / dst-mac
destination-port / dst-port
destination-ip / dst
source-ip / src
ip-protocol / ip-proto
source-port / src-port
...
"For longer switching-filters, use multiple instances of the Juniper-switching-filter attribute with a maximum limit of 20 match conditions and a maximum total size of 4000 characters. The maximum length of any radius attribute is 253 characters, so each line of the "Juniper-switching-filter" attribute should also be less than 253 characters."
Check for more details here:
https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/802-1x-authentication-switching-devices.html