AuthHound

RADIUS attribute 61 · type integer

NAS-Port-Type

NAS-Port-Type (attribute 61) reports how the device connected, Ethernet (15) or Wireless-802.11 (19), which is how a single RADIUS policy tells wired ports from Wi-Fi.

Also searched as: NAS-Port-Type Ethernet, NAS-Port-Type Wireless-802.11. Defined in RFC 2865.

What it means

NAS-Port-Type distinguishes the physical media behind a request. When one NPS or FreeRADIUS server backs both the wired switches and the wireless controllers, this attribute is what your connection-request and network policies key on to apply different rules (different VLANs, different EAP requirements) to wired versus wireless.

How it's used

Read it in the request as a policy condition. Ethernet = 15 for switch ports, Wireless-802.11 = 19 for Wi-Fi, Virtual = 5 for VPN concentrators.

Values

  • 15: Ethernet, a wired switch port.
  • 19: Wireless-802.11 (Wi-Fi).
  • 5: Virtual, VPN / tunnelled access.

Common gotchas

  • Some access points send Wireless-Other or a vendor value instead of 19; test with your real hardware before writing a strict equals condition.

Test the policy without waiting for a device: the open-source authhound-probe sends a real request with the method and NAS-Port-Type your conditions key on, so a policy change is verified in seconds, and it prints the attributes the Accept returned. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server nps.corp.local --peap alice --nas-port-type wireless

Recipe: test a Windows NPS server end to end

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer; it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return. Early access:

No spam, no sharing: one email when it's ready, and you can reply to be removed anytime.