AuthHound

Aruba VSA · attr 2 · type integer

Aruba-User-Vlan

Aruba-User-Vlan is an integer VSA (vendor 14823, attribute 2) that assigns a VLAN on Aruba controllers in one attribute — no Tunnel-Type/Tunnel-Medium-Type trio required.

Also searched as: Aruba VLAN attribute, Aruba-User-Vlan VSA. Defined in Aruba vendor dictionary (vendor 14823).

What it means

Where the RFC way needs three attributes (Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = VLAN), Aruba lets you send the VLAN as one integer VSA. It's simpler on all-Aruba deployments, but it's Aruba-only — a non-Aruba NAS won't understand it, so mixed fleets usually standardise on the RFC trio instead.

How it's used

Return the numeric VLAN ID. On an all-Aruba estate this is the least error-prone VLAN method; on a mixed estate prefer Tunnel-Private-Group-Id so one policy works everywhere.

Common gotchas

  • Sending both Aruba-User-Vlan and the RFC tunnel trio can conflict; pick one method per policy.
  • Only Aruba NAS devices honour it — don't reach for it if any non-Aruba switches share the policy.

Prove what the server actually returned: the open-source authhound-probe prints every authorization attribute in the Access-Accept and asserts the one you care about — a silently ignored attribute becomes a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-attr Filter-Id=staff

Recipe: assert returned attributes with --expect-vlan / --expect-attr

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer — it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.