AuthHound

RADIUS attribute 11 · type string

Filter-Id

Filter-Id (attribute 11) returns the name of a filter or ACL that must already exist on the NAS; RADIUS is selecting it by name, not sending the rules.

Also searched as: dynamic ACL name, named ACL attribute. Defined in RFC 2865.

What it means

Filter-Id lets the RADIUS policy pick which locally-defined ACL or filter the switch, firewall, or VPN applies to the session. The string has to match an ACL name that already exists on that device. RADIUS never carries the rule content, only the label. This is the standard alternative to a vendor's downloadable-ACL VSAs when you want to keep the rules on the box.

How it's used

Return the exact ACL name as configured on the NAS. A trailing ".in" / ".out" convention is common on some platforms to pick direction; check the vendor's docs, because the matching is literal.

Common gotchas

  • If the named filter doesn't exist on the NAS, behaviour is vendor-specific: some deny all traffic, some ignore it. Either way the session "authenticated fine" and connectivity is still broken.
  • The name match is exact and case-sensitive on many platforms.

Prove what the server actually returned: the open-source authhound-probe prints every authorization attribute in the Access-Accept and asserts the one you care about, so a silently ignored attribute becomes a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-attr Filter-Id=staff

Recipe: assert returned attributes with --expect-vlan / --expect-attr

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer; it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return. Early access:

No spam, no sharing: one email when it's ready, and you can reply to be removed anytime.