In the situation where you use 802.1X for switches and AP's they will just use their management IP (or the optional secondary management IP) as source for the radius requests. However with a physicial MX for Client VPN where the Radius server is over a site to site VPN it will use an internal VLAN IP address. We had tested this once a few years back where I doubted that this setup would work since the MX normally uses the interface closest to the radius server as source. But it actually did work. So you would be looking at any VLAN interface on the MX of a subnet that is allowed over the VPN that is the possible source. The best thing you could do is just to see the logs in your radius solutions just to see where the actual request is coming from. In case of AutoVPN you can just use the dashboard capture to see what's happening.
... View more