RADIUS attribute 6 · type integer
Service-Type
Service-Type (attribute 6) tells the RADIUS server what the NAS is asking for. On switches the useful values are Framed (2) for 802.1X and Call-Check (10) for MAC Authentication Bypass.
Also searched as: Service-Type Call-Check, Service-Type Framed. Defined in RFC 2865.
What it means
Service-Type lets policy branch on the kind of access. A switch doing 802.1X typically sends Framed (2); a switch doing MAC Auth Bypass sends Call-Check (10) with the device MAC as both username and Calling-Station-Id. Matching on Service-Type = Call-Check is the clean way to write a separate MAB policy so printers and cameras don't fall through your 802.1X user rules.
How it's used
Read it in the request to route the auth; return it in the accept only when a device needs a specific service class. Administrative (6) and NAS-Prompt (7) are for device-admin login, not network access.
Values
2— Framed — typical for 802.1X port access.10— Call-Check — used for MAC Authentication Bypass (MAB).6— Administrative — device-administration login, not network access.
Common gotchas
- If MAB requests arrive as Call-Check but your policy only matches user Service-Types, every non-802.1X device is rejected or mis-VLANed.
FAQ
What Service-Type does MAC Authentication Bypass use?
MAB requests are usually sent with Service-Type = Call-Check (10), and the device MAC address appears as both the username and the Calling-Station-Id. Match on Call-Check to give MAB devices their own policy separate from 802.1X users.