When the switch sends a RADIUS authentication request to the RADIUS server, it doesn't send the "NAS-Port-Type" attribute to the RADIUS Server. Normally, an Ethernet switch should be sending "NAS-Port-Type: Ethernet" to the RADIUS server.

The NAS-Port-Type attribute is missing from Access-Request packet sent to radius server. On 22.4R3.25 build, the attribute is present in Access-Request but missing on 23.4R2 and recent DCB builds.

Root cause:

As part of this fix, we had started sending the NAS_IDENTIFIER attribute as TLV towards authd as part of Access and Accounting Request. Due to this change, authd has a handling that if this attribute is received from dot1xd, authd will also not send NAS_PORT_TYPE on its own.

Affected release: 23.4R2 24.1R1 23.4R2-EVO 24.2R1 24.1R1-EVO 24.2R1-EVO

Resolved In release: evo:23.4R2-S1-EVO evo:24.2R1-S2-EVO evo:24.2R2-EVO evo:24.3R1-EVO junos:23.4R2-S1 junos:24.2R1-S1 junos:24.2R2 junos:24.3R1 junos:24.4R1

For further reference, please review the following documentation:
PR1822101 - The RADIUS attribute NAS-Port-Type is missing from Access-Request packets
https://prsearch.juniper.net/problemreport/PR1822101

2025-02-14: Categories modified as per PR

2024-08-13 : Article Created