AuthHound

RADIUS attribute 64 · type integer

Tunnel-Type

Tunnel-Type (attribute 64) names the tunnelling method for a session. In 802.1X the only value that matters is 13 (VLAN) — the first of the three attributes dynamic VLAN assignment needs.

Also searched as: Tunnel-Type 13, VLAN tunnel type. Defined in RFC 2868.

What it means

Tunnel-Type was defined for VPN/tunnelling (PPTP, L2TP, and friends), but on switches and access points its job is narrow: value 13 = VLAN declares that this Access-Accept is assigning a VLAN. It has to appear together with Tunnel-Medium-Type = 6 and Tunnel-Private-Group-Id = the VLAN. Any other Tunnel-Type value is irrelevant to 802.1X and is usually a copy-paste error.

How it's used

For dynamic VLAN, return the integer 13 (or the name "VLAN"). Some servers also emit an RFC 2868 tag byte to group the three tunnel attributes together; keep the tags consistent across all three or the switch may not correlate them.

Values

  • 13 — VLAN — the value used for 802.1X dynamic VLAN assignment.
  • 3 — L2TP — a VPN tunnelling method, not used for switch VLANs.

Common gotchas

  • Sending Tunnel-Private-Group-Id without Tunnel-Type = 13 is the classic "VLAN attribute present, VLAN never applied" failure.
  • Mismatched RFC 2868 tag bytes across the three tunnel attributes can make a switch treat them as unrelated and ignore the VLAN.

Read the Access-Accept from the client side: the open-source authhound-probe prints the authorization attributes the server returned and asserts the VLAN — --expect-vlan turns a wrong or missing VLAN into a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-vlan 20

Recipe: verify users land on the right VLAN

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer — it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.