AuthHound

RADIUS attribute 11 · type string

Filter-Id

Filter-Id (attribute 11) returns the name of a filter or ACL that must already exist on the NAS; RADIUS is selecting it by name, not sending the rules.

Also searched as: dynamic ACL name, named ACL attribute. Defined in RFC 2865.

What it means

Filter-Id lets the RADIUS policy pick which locally-defined ACL or filter the switch, firewall, or VPN applies to the session. The string has to match an ACL name that already exists on that device — RADIUS never carries the rule content, only the label. This is the standard alternative to a vendor's downloadable-ACL VSAs when you want to keep the rules on the box.

How it's used

Return the exact ACL name as configured on the NAS. A trailing ".in" / ".out" convention is common on some platforms to pick direction; check the vendor's docs, because the matching is literal.

Common gotchas

  • If the named filter doesn't exist on the NAS, behaviour is vendor-specific — some deny all traffic, some ignore it. Either way the session "authenticated fine" and connectivity is still broken.
  • The name match is exact and case-sensitive on many platforms.

Prove what the server actually returned: the open-source authhound-probe prints every authorization attribute in the Access-Accept and asserts the one you care about — a silently ignored attribute becomes a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-attr Filter-Id=staff

Recipe: assert returned attributes with --expect-vlan / --expect-attr

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer — it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.