Just spent the last few hours scratching my head about why something was working fine with a different Radius provider and not with FreeRadius. It seems the standard dictionary.erx doesn't include the has_tag for a number of VSAs. As per: https://www.juniper.net/techpubs/software/junos/junos114/radius-dictionary/u... # please note that tunnel attributes (8, 9, 33, 35, 39 - 41) # and service attributes (65 - 69) may be tagged I'm just wondering with 3.0.x has the ERX dictionary in it, without the has_tags on VSA 8 & 9 https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/share/dictionary... Yet the Unisphere dictionary in 3.1.x does: https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/share/dictionary... ATTRIBUTE Unisphere-Tunnel-Virtual-Router 8 string has_tag ATTRIBUTE Unisphere-Tunnel-Password 9 string has_tag Serves me right for not going for 3.1.. :/