| 1 | User-Name | String | ≤253 | STA identity sent in EAP-Response/Identity. Format: user@realm (NAI, RFC 7542). Used for RADIUS routing and user lookup. | RFC 2865 §5.1
RFC 7542 (NAI) | Realm portion routes to correct RADIUS server in proxy chain. |
| 2 | User-Password | String | ≤128 | Encrypted password (PAP). XOR with shared secret + MD5. NOT used in 802.1X (EAP used instead). Legacy RADIUS only. | RFC 2865 §5.2 | Never use PAP for Wi-Fi. MD5-based encryption is weak. |
| 4 | NAS-IP-Address | IP Addr | 6 | IP address of the NAS (AP or WLC) sending the request. Used by RADIUS server to identify the authenticator. | RFC 2865 §5.4 | Must match RADIUS client config on server. Common source of auth failures. |
| 5 | NAS-Port | Integer | 6 | Physical port number. For Wi-Fi: often AID or logical port ID. Less meaningful than NAS-Port-Id (87). | RFC 2865 §5.5 | |
| 6 | Service-Type | Integer | 6 | Indicates service requested. Value 8 = Authenticate Only (EAP). Value 2 = Framed (data service). | RFC 2865 §5.6 | |
| 11 | Filter-Id | String | ≤253 | Name of access control filter to apply to STA. Used for per-user ACL policy from RADIUS server. | RFC 2865 §5.11 | Vendor-specific interpretation. Some APs use this for VLAN or QoS policy name. |
| 18 | Reply-Message | String | ≤253 | Human-readable message from RADIUS server. Shown to user in captive portal or 802.1X client on failure. | RFC 2865 §5.18 | |
| 24 | State | String | ≤253 | State token passed between Access-Challenge and Access-Request. Maintains EAP session state across multi-round exchanges. | RFC 2865 §5.24 | Critical for multi-message EAP (TLS handshake). Must be echoed back exactly. |
| 25 | Class | String | ≤253 | Opaque token for accounting correlation. Echoed in Accounting-Request. Used to link auth and accounting records. | RFC 2865 §5.25 | |
| 26 | Vendor-Specific (VSA) | String | ≤247 | Container for vendor extensions. Sub-attributes identified by Vendor-ID (PEN). Common for Cisco, Aruba, Ruckus AP policy VSAs. | RFC 2865 §5.26
IANA PEN registry | Cisco VSA (Vendor-ID=9): cisco-av-pair for ACL/VLAN. Aruba VSA (Vendor-ID=14823). |
| 27 | Session-Timeout | Integer | 6 | Maximum session duration in seconds. After expiry, STA must re-authenticate. Sent in Access-Accept. | RFC 2865 §5.27 | Common value: 3600-86400 s. Short sessions = more re-auth load. Long = stale auth risk. |
| 30 | Called-Station-Id | String | ≤253 | For Wi-Fi: AP MAC address + SSID. Format: 'AA-BB-CC-DD-EE-FF:SSID'. Used for per-SSID policy in RADIUS. | RFC 2865 §5.30
Wi-Fi Alliance Passpoint | SSID portion allows RADIUS to apply different policy per SSID on same AP. |
| 31 | Calling-Station-Id | String | ≤253 | Client (STA) MAC address. Format: 'AA-BB-CC-DD-EE-FF'. Used for device-based policy (MAB, device allowlist/blocklist). | RFC 2865 §5.31 | MAC randomization (iOS 14+, Android 10+) breaks MAC-based policy. Use identity-based auth. |
| 32 | NAS-Identifier | String | ≤253 | Human-readable NAS name. Alternative to NAS-IP-Address (attr 4). Used in cloud RADIUS with NATted APs. | RFC 2865 §5.32 | Important when AP is behind NAT and IP address changes. Stable identifier. |
| 40 | Acct-Status-Type | Integer | 6 | Accounting: Start(1), Stop(2), Interim-Update(3), Accounting-On(7), Accounting-Off(8). | RFC 2866 §5.1 | |
| 44 | Acct-Session-Id | String | ≤253 | Unique ID for accounting session. Must match across Start/Interim/Stop records. | RFC 2866 §5.5 | |
| 61 | NAS-Port-Type | Integer | 6 | Type of port. Value 19 = Wireless-802.11. Sent in all Wi-Fi auth requests. | RFC 2865 §5.41 | RADIUS server can use this to apply Wi-Fi-specific policies. |
| 64 | Tunnel-Type | Integer | 6 | Tunnel type for VLAN assignment. Value 13 = VLAN. Must be sent with attrs 65+81 for VLAN assignment. | RFC 2868 §3.1 | Triple of attrs 64+65+81 = dynamic VLAN assignment from RADIUS. |
| 65 | Tunnel-Medium-Type | Integer | 6 | Medium for tunnel. Value 6 = 802 (IEEE 802 / Ethernet) - required for VLAN assignment. | RFC 2868 §3.2 | |
| 79 | EAP-Message | String | ≤253 | Contains EAP packet (fragmented across multiple attrs if >253B). Core of 802.1X pass-through. | RFC 3579 §3.1 | AP/WLC acts as EAP pass-through between STA and RADIUS. AP does not process EAP - just tunnels. |
| 80 | Message-Authenticator | String | 16 | HMAC-MD5 of entire RADIUS packet. Mandatory in all 802.1X exchanges (EAP). Prevents spoofing of RADIUS packets. | RFC 3579 §3.2 | Without this attr, RADIUS auth responses could be spoofed. Always enforce. |
| 81 | Tunnel-Private-Group-Id | String | ≤253 | VLAN ID for dynamic VLAN assignment (e.g. '100' or 'VLAN-Sales'). AP maps to 802.1Q tag on wired side. | RFC 2868 §3.3 | Most important attr for enterprise Wi-Fi segmentation. Per-user VLAN from RADIUS. |
| 85 | Acct-Interim-Interval | Integer | 6 | How often (seconds) AP sends Interim-Update accounting records. Typical: 300-600 s. | RFC 2869 §5.6 | |
| 87 | NAS-Port-Id | String | ≤253 | Text identifier of NAS port. For Wi-Fi: typically 'ssid SSIDNAME' or 'ap-group:APname'. More descriptive than NAS-Port. | RFC 2869 §5.8 | |
| 95 | NAS-IPv6-Address | IPv6 | 18 | IPv6 address of NAS. Used when AP/WLC has IPv6 management address. | RFC 3162 §2.1 | |
| 101 | Error-Cause | Integer | 6 | Reason for Disconnect-NAK or CoA-NAK in RFC 5176 messages. E.g. 507=Missing Attribute, 508=Invalid Attribute. | RFC 5176 §3.1 | |