The NAS device is the final arbiter of allowing access. Even if the authentication succeeds, there may be other things about the connection and the NAS policies that are not met by the port user. Best to check the error log on the NAS. Dave. Quoting Stijn D'haese <maillist@stijn-dhaese.be>:
Hi,
I'm trying to do MAC based authentication on our switches, but for some strange reason the port doesn't want to authenticate, even though the radius server sends an Access-Accept package to the port. I did a capture on the port and the Access-Accept package is received by the port, but it port status stays unauthorized.
I'm running FreeRADIUS Version 2.2.0 and the switch is an Allied Telesis AT-9000/28
Any ideas where I need to start looking?
Regards
Stijn - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html