<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:14pt"><P>When I did the upgrade I had just copied-pasted my old configuration and it worked without issue, so I completely missed the inner-tunnel.</P>
<P> </P>
<P>Making those changes helped alot and reduced the LDAP calls to 3 - Thanks!! I would like to drop this further, as it seems that 2 of them are from the authorize section. I can't seem to remove it from the authorize section, though, as doing so pisses off mschap (can't find NT-password) and removing mschap pisses off FR (no auth-type defined). Also, I use a LDAP huntgroup, where users in an LDAP group are allowed to attached to a special SSID, which i think is part of the authorization process....</P>
<P> </P>
<P>So here is my new configuration, perhaps someone can spot something i'm missing? (tried looking through documentation, can't seem to find my error).</P>
<P> </P>
<P>default file:</P>
<P> </P>
<P>authorize {</P>
<P> preprocess</P>
<P> auth_log</P>
<P> mschap</P>
<P> suffix</P>
<P> ntdomain</P>
<P> eap {</P>
<P> ok = return</P>
<P> }</P>
<P> files {</P>
<P> notfound = reject</P>
<P> noop = reject</P>
<P> fail = reject</P>
<P> }</P>
<P> expiration</P>
<P> logintime</P>
<P>}</P>
<P> </P>
<P>authenticate {</P>
<P> eap</P>
<P>}</P>
<P> </P>
<P> </P>
<P>and inner-tunnel:</P>
<P> </P>
<P>authorize {</P>
<P> unix</P>
<P> suffix</P>
<P> ntdomain</P>
<P> update control {</P>
<P> Proxy-To-Realm := LOCAL</P>
<P> }</P>
<P> eap {</P>
<P> ok = return</P>
<P> }</P>
<P> files</P>
<P> redundant-load-balance {</P>
<P> LDAPsvr1</P>
<P> LDAPsvr2</P>
<P> }</P>
<P> expiration</P>
<P> logintime</P>
<P>}</P>
<P> </P>
<P>authenticate {</P>
<P> Auth-Type LDAP {</P>
<P> redundant-load-balance {</P>
<P> LDAPsvr1</P>
<P> LDAPsvr2</P>
<P> }</P>
<P> }</P>
<P> unix</P>
<P> eap</P>
<P>}</P>
<P> </P>
<P>>Hi,<BR>>> I will need to do some more research on inner-tunnels, as i'm not too familiar with them. How would I add the ldap components? as >part of the peap module itself?<BR>><BR>>no - you simply configure the required part of the inner-tunnel virtual server - inner-tunnel<BR>>virtual server gets called as part of the EAP config - and _only_ as part of EAP with default config - check the default raddb config <BR><BR>>alan<BR></P>
<DIV></DIV></div><br>
</body></html>