Mist NAC is failing to authenticate users when the option "Wired" is used in any of the matching policies. 

While using MIST NAC, and when a wired device is doing EAP-TLS, the following policy is put in place:

Wired + EAP-TLS + Site = fails with a "NAC client Access Denied" and thus, dot1x authentication fails and the client ends up in held state.

Nonetheless, removing 'Wired' from the matching criteria, matches resulting in a "NAC Client Access Allowed", so dot1x authenticates successfully.

Same behavior occurs with MAB Authentication.

Seems in the versions without the fix, the EX/QFX switches will send the access-request packets without the NAS-Port-Type attribute, which is required to specify the type of port of the subscriber.

This issue is fixed via the following PR:

https://prsearch.juniper.net/problemreport/PR1822101