Juniper Mist RADIUS Attributes

The NAS-IP-Address attribute is forwarded in the Access-Request and indicates the IP Address of the AP requesting user authentication.

You can configure this attribute in the RADIUS settings for a WLAN. All APs on a WLAN send the configured value.

The NAS-Identifier attribute is forwarded in the Access-Request. You can configure this attribute in the RADIUS settings for a WLAN. All access points on a WLAN send the configured value.

You can use variables to send the device name, model, MAC address, and site name. The variables are:

{{DEVICE_NAME}}

{{DEVICE_MODEL}}

{{DEVICE_MAC}}

{{SITE_NAME}}

The Tunnel-Private-Group-ID attribute is forwarded in the Access-Accept and indicates the numerical VLAN ID to be assigned to the authenticating user. The attribute value must be set to a numerical value between 1 and 4094 or a string representing a named VLAN.

The Airespace-Interface-Name attribute may be forwarded in the Access-Accept to indicate the dynamic VLAN membership of an 802.1X or RADIUS MAC authenticated user. Returned attribute value is always a string formatted name of the VLAN. VLAN Name to VLAN ID translation must be configured under WLAN using VLAN IDs or Variables.

Format: VLAN-Name

Example: employee-vlan

The Airespace-ACL-Name attribute may be forwarded in the Access-Accept and indicates user role client will be associated with. User Groups are used by Mist WxLAN policy framework to assign granular network resource restrictions.

Format: Group-Name

Example: employee

The Aruba-User-Role attribute may be forwarded in the Access-Accept and indicates user role client will be associated with. User Groups are used by Mist WxLAN policy framework to assign granular network resource restrictions.

Format: Group-Name

Example: employee

The Cisco-AVPair attribute may be forwarded in the Access-Accept to indicate to the Mist Access Point that a client needs to be redirected for portal authentication and specify the redirect-URL location. This attribute is typically used for Guest Access integrations with Cisco ISE or Aruba Clearpass RADIUS servers or to enable Posture Redirect functionality for 802.1X/EAP users.

AVPair URL Redirect

Format: url-redirect=<URL value>

Example: url-redirect=https://ise28.89mistilbs.org:8443/portal/gateway?sessionId=0a004b1c/Jtf4peiJ5A8nPreloHRRITWvmhDCbnH3qXQ8MngtoA&portal=71984f36-f55e-4439-ba6e-903d9f77c216&action=cwa&token=1f7dca2cc907b1ad56ee4880e1cfa1ae

AVPair PSK

The Cisco-AVPair attribute may also contain PSK attribute, indicating to the Mist Access Point which passphrase is assigned to a certain client. Note that to provide a PSK value to the AP, two Cisco AVPair attributes must be sent simultaneously, one indicating that PSK will be sent in ASCII format and another AVPair providing the actual Pre-Shared Key value.

Format:

psk-mode=ascii

&

psk=<passphrase>

The Eleven-Authentication-Find-Key attribute is used to supply additional information to the supported RADIUS servers to simplify wireless client PSK lookup via RADIUS, removing the need to pre-associate a wireless client MAC with a particular PSK ahead of time. This attribute is a TLV according to the RFC6929 that contains multiple sub-attributes inside.