RADIUS attribute & VSA reference

Acct-Status-Type (attribute 40) says what an accounting record is: Start (1) when a session begins, Stop (2) when it ends, Interim-Update (3) for periodic usage snapshots.

Called-Station-Id (attribute 30) identifies what the device connected to. On Wi-Fi it's the AP's MAC address plus the SSID, so you can write per-SSID RADIUS policy.

Calling-Station-Id (attribute 31) is the MAC address of the device that's connecting. It's how you identify endpoints for MAB — and its inconsistent formatting is why MAB matches break.

Class (attribute 25) is an opaque token the RADIUS server sets on accept and the NAS returns verbatim in accounting. It's the intended way to tie a login to its accounting and session records.

Filter-Id (attribute 11) returns the name of a filter or ACL that must already exist on the NAS; RADIUS is selecting it by name, not sending the rules.

Framed-IP-Address (attribute 8) is the IPv4 address RADIUS assigns to a session, most often on VPN and PPP access rather than 802.1X.

NAS-Port-Type (attribute 61) reports how the device connected — Ethernet (15) or Wireless-802.11 (19) — which is how a single RADIUS policy tells wired ports from Wi-Fi.

Reply-Message (attribute 18) is free-text the RADIUS server sends back with an accept or reject — the message a user might see, and a place servers stash a reason for a denial.

Service-Type (attribute 6) tells the RADIUS server what the NAS is asking for. On switches the useful values are Framed (2) for 802.1X and Call-Check (10) for MAC Authentication Bypass.

Session-Timeout (attribute 27) is the number of seconds a session may last. With Termination-Action = RADIUS-Request it drives periodic reauthentication instead of disconnecting the user.

Tunnel-Medium-Type (attribute 65) states the medium a tunnel runs over. For 802.1X VLAN assignment it must be 6 (IEEE-802) — the second of the three attributes the switch needs.

Tunnel-Private-Group-Id (attribute 81) is the RADIUS attribute that tells the switch or access point which VLAN to put an authenticated device on. It is the payload of dynamic VLAN assignment.

Tunnel-Type (attribute 64) names the tunnelling method for a session. In 802.1X the only value that matters is 13 (VLAN) — the first of the three attributes dynamic VLAN assignment needs.

Aruba-User-Role is a string VSA (vendor 14823, attribute 1) that puts a session into a named Aruba role. Like Filter-Id, it selects policy by name — the role has to exist on the controller.

Aruba-User-Vlan is an integer VSA (vendor 14823, attribute 2) that assigns a VLAN on Aruba controllers in one attribute — no Tunnel-Type/Tunnel-Medium-Type trio required.

Cisco-AVPair is a string VSA (vendor 9, attribute 1) that carries Cisco features as "attribute=value" pairs — the vehicle for dACLs, URL redirects, and privilege levels that no standard RADIUS attribute expresses.

MS-MPPE-Recv-Key is an encrypted-key VSA (vendor 311, attribute 17) the RADIUS server returns so the NAS can key the session. If a proxy strips it, WPA2-Enterprise Wi-Fi fails after a "successful" auth.

MS-MPPE-Send-Key is an encrypted-key VSA (vendor 311, attribute 16) paired with MS-MPPE-Recv-Key; together they carry the session keys from the RADIUS server to the access point.