Description

An EX4100 managed by Mist was configured for wired MAB with Mist Access Assurance. A non-802.1X endpoint connected to an access port was unable to authenticate using its MAC address, even though the port profile and Mist auth policy appeared to be correct.

Symptoms

  • The endpoint failed to authenticate through MAB
  • Mist switch events repeatedly showed log entries like:

DOT1XD_USR_SESSION_HELD: MAC-RADIUS User <mac-address> session with MacAddress <mac-address> interface ge-0/0/45.0 vlan (null) is held due to reason <Unknown>


  • The dot1x trace showed that MAC authentication was launched, but the session later failed and moved to a held state, for example: 

PnacAuthAsmInitMacRadius Intf ge-0/0/45.0: Launch MACAUTH.

ASIF: Transferring Server-data to Auth Server for the user, <mac-address>.

Queuing message to auth client to validate mac address <mac-address>, user <mac-address> on interface ge-0/0/45.0

ASIF: Tx of Server-data to Auth Server succeeded


and later:


Error response from authentication client. authd reply code 2 for mac <mac-address> on port 601

Code = 4

BSM Called with Event: AFAIL_RCVD, and State: Response

ASM Called with Event: BKEND_AUTHFAIL in State: Authenticating for Port:601 MAC: <mac-address>

PnacAuthAsmMakeHeld Session <mac-address> Authentication mode: Mac-Radius

ASM moved to state: HELD for Port:601 MAC:<mac-address>


  • The MAC did not appear in NAC Events
  • The wired MAB auth policy in Mist showed no hits
  • The port itself appeared correctly configured for MAB, with output such as:

Role: Authenticator

Mac Radius: Enabled

Mac Radius Restrict: Enabled

Mac Radius Authentication Protocol: PAP


Solution

Review any custom commands configured under rule-base CLI commands in Mist.

In this case, the issue was resolved by removing this command:


delete access profile dot1x authentication-order radius


After removing that command, the endpoint was able to authenticate successfully using its MAC address. This command was overriding the expected authentication behavior on the switch and was preventing the MAB flow from completing successfully.

Modification History

2026-04-01 : Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-mac-auth-wired-devices.html