AuthHound

RADIUS attribute 65 · type integer

Tunnel-Medium-Type

Tunnel-Medium-Type (attribute 65) states the medium a tunnel runs over. For 802.1X VLAN assignment it must be 6 (IEEE-802) — the second of the three attributes the switch needs.

Also searched as: Tunnel-Medium-Type 6, IEEE-802 tunnel medium. Defined in RFC 2868.

What it means

Tunnel-Medium-Type tells the NAS what kind of network the tunnel uses. For dynamic VLAN the answer is always 6, IEEE-802 (the family that covers Ethernet and 802.11). It completes the trio with Tunnel-Type = 13 and Tunnel-Private-Group-Id = the VLAN. Values like 1 (IPv4) belong to VPN scenarios and will not produce a VLAN on a switch port.

How it's used

Return the integer 6 (or the name "IEEE-802") for every VLAN assignment, tagged consistently with the other two tunnel attributes.

Values

  • 6 — IEEE-802 — required for 802.1X VLAN assignment.
  • 1 — IPv4 — a VPN/tunnel medium, not used for switch VLANs.

Common gotchas

  • A frequent mistake is returning Tunnel-Medium-Type = 1 (IPv4) copied from a VPN example; the switch then ignores the VLAN.

Read the Access-Accept from the client side: the open-source authhound-probe prints the authorization attributes the server returned and asserts the VLAN — --expect-vlan turns a wrong or missing VLAN into a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-vlan 20

Recipe: verify users land on the right VLAN

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer — it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.