For EX and QFX switches supported in Mist.
Users may report one or more of the following symptoms:
Wired 802.1X authentication intermittently succeeds and fails.
Endpoints repeatedly connect and disconnect.
Authentication completes successfully, but connectivity is later lost.
EAP-TEAP authentication works with other switch vendors but behaves inconsistently on EX switches.
Authentication traces show repeated Access-Challenge exchanges.
Authentication eventually times out or receives an Access-Reject.
The issue is more likely when the RADIUS server is reachable through tunnels or intermediate devices.
Environment:
Juniper EX4400 Virtual Chassis
Junos OS 23.x
802.1X authentication
EAP-TEAP authentication method
RADIUS-based NAC solution
User and machine certificate authentication
RADIUS server reachable across a routed network path or tunnel
Problem Statement:
Clients were intermittently unable to complete EAP-TEAP authentication.
During failure scenarios:
The EX switch successfully exchanged EAPOL frames with the supplicant.
The switch successfully communicated with the RADIUS server.
Multiple Access-Challenge messages were received.
The authentication process stalled before completion.
The switch eventually reported host timeout events.
The RADIUS server returned Access-Reject.
The endpoint was moved to a failed authentication state.
During successful scenarios:
Authentication completed normally.
Access-Accept messages were received.
Clients became authorized.
Accounting messages started successfully.
Investigation:
Switch Analysis
Review of:
Dot1x traces
Authentication service traces
Packet captures
AAA statistics
showed the EX4400 correctly performing:
EAPOL processing
RADIUS communication
Access-Challenge handling
Access-Accept processing
VLAN assignment
Session authorization
No evidence was found indicating:
Incorrect EX configuration
VLAN assignment failure
Dot1x state machine malfunction
Unexpected EAP-Failure generation by the EX switch
Authentication Flow During Failure
Observed sequence:
1Access-Challenge
2Access-Challenge
3Access-Challenge
4...
5No Response From Host
6Host Timeout
7Access-Reject
8EAP-Failure
Authentication Flow During Success
5Access-Accept
6EAP-Success
7Authorized State
MTU Findings
Investigation revealed:
Large EAP-TEAP packets were exchanged during TLS negotiation.
Packet captures contained Access-Challenge packets exceeding 1,100 bytes.
Authentication traversed a path containing non-Juniper devices and tunnel infrastructure.
Earlier troubleshooting indicated packet corruption across an intermediate tunnel.
The failure only occurred after authentication had already progressed substantially.
These observations pointed toward fragmentation, packet loss, or MTU-related transport issues affecting large TLS/EAP payloads.
The issue was resolved after reducing the MTU value on the management path used for RADIUS communication.
The customer reported successful and stable authentication after decreasing the MTU on the MGMT vlan to 1380
In environments using EAP-TEAP, certificate-based authentication generates large TLS payloads. When RADIUS communication traverses tunnels, firewalls, VPNs, WAN links, or other intermediate devices, MTU limitations can interrupt the exchange and cause intermittent authentication failures.
If EX switches successfully exchange RADIUS challenges but authentication ultimately fails because the endpoint stops responding, verify:
In this case, no Juniper software defect or EX4400 configuration issue was identified. Authentication failures were caused by transport-path MTU constraints, and reducing the MTU resolved the issue.