After upgrading to 21.4R3-S10, QFX5100 fails to authenticate users logging in using MFA with two prompts (username and password in one, token or code in the other); this article outlines a possible cause for this issue and the available workarounds

• MFA RADIUS not working
• Non MFA RADIUS will work
• Message authenticator received
• Access chanllenge received after access request

By capturing traffic of the RADIUS process, we found that the switch calculates a different state value when responding to the access challenge, causing the connection to the server to fail.

Response from the switch

This is reported under https://prsearch.juniper.net/problemreport/PR1862203

Resolved In

As an alternative workaround for devices reaching the LSV and EOE, we could use the push option and [password,code] using only one prompt