October 2025 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

rediswho and Simultaneous-Use
by Nitzan Tzelniker 17 Nov '25

17 Nov '25

I’m working on implementing a Simultaneous-Use check using the rediswho module in the FreeRADIUS 3.2 branch. The approach is inspired by the blog post “Preventing Fraudulent Logins with a Session Database” (which unfortunately appears to be offline). At this stage, I’m successfully writing accounting records into Redis through rediswho. However, I haven’t found any documentation or examples describing how to query Redis for Simultaneous-Use checking and verification — specifically, the equivalent of the simul_count_query and simul_verify_query mechanisms used in the SQL module If anyone has implemented this or can provide guidance on best practices for performing Simultaneous-Use checks with rediswho, I would appreciate any insights or references. Additionally, I noticed that the default rediswho configuration in both versions 3.2 and 4.0 uses the same insert operation for all Acct-Status-Type values. As a result, when querying the Redis, it’s not possible to distinguish between sessions that have terminated with an Acct-Status-Type = Stop and those that are still active. Nitzan

2 3

dhcp with multiple dhcp-relay routers
by mjones＠mnsi.net 30 Oct '25

30 Oct '25

Good morning We have a setup with clients behind two routers doing VRRP for their gateway. Both of these routers are also doing DHCP relay to a single freeradius 3.0 server acting as a dhcp server. So when a client initates the dhcp process after booting up, both routers see the request and relay it to the server. Both requests arrives at the server at almost the same time. The only difference in the two requests is the giaddr or gatewau ip addr. The dhcp server processes each request separately as it should. The first one to get the reply back to the client is the one that it uses. All this is a expected and normal. The situation we are having is in the sqlippool. When the process for each request looks up to see if the client has an active lease only one of the requests will match the previous lease as it is comparing the giaddr and not just the key. So depending on which response gets back to the client first they either get the ip they had or a new ip. We see a few possible solutions to this from our perspective. 1. Some how ignore or modify the giaddr to be the VRRP address instead of the fixed ip. We have already tried doing this on the roiuters and there is no support for this. 2. Delay the responses for one of the relay routers so it is only used if the primary router has failed. There maybe something completely obvious we are missing here, any help would be appreciated. Mark Jones Operations Managed Network Systems Windsor Desk 519-258-2333 x8417 Cell 226-340-1254

3 6

Server verification when proxying
by Stephen Mellor 29 Oct '25

29 Oct '25

Freeradius 3.2, Windows 11 clients, EAP-TLS server verification. We're using EAP-TLS successfully, authenticating locally for our machines, but proxying out to another organisations Cisco ISE servers where we detect that the username is one of their machines. The other organisation say that their users are sometimes prompted to continue with the connection. Our users are not - their machines just connect. Assuming that wifi profiles for both organisations include the option to verify the authentication server, does that initial verification get proxied for the other organisation, or are they attempting to verify our servers? I'm using radiusd -X but I'm finding the logfiles very difficult to parse - from what I can tell the process hangs later in the communications, presumably where the machine is waiting for user input. What I don't understand is why they say that their users are only prompted 'sometimes', not always. Apologies for the lack of detail, I'm still trying to work my way through various logs... Steve M -------------------------------------------------------------------------------------------------------------------------------------------------------- This email is intended for the named recipient only. If you have received it by mistake, please (i) contact the sender by email reply; (ii) delete the email from your system; . and (iii) do not copy the email or disclose its contents to anyone. --------------------------------------------------------------------------------------------------------------------------------------------------------

4 4

Understanding pam module
by Marco Miglietta 17 Oct '25

17 Oct '25

Hello everyone. I'm getting an error when attempting PAM authentication. I'd like to understand what PAM expects, how it expects the password, and how it expects the OTP. The debugging step is below: (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" SHA-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) update request { (0) EXPAND %{Tmp-String-0}%{Tmp-String-1} (0) --> password123456 (0) User-Password := password123456 (0) } # update request = noop (0) pam: Using pamauth string "radiusd" for pam.conf lookup (0) pam: ERROR: pam_authenticate failed: Authentication failure (0) [pam] = reject I use Google Authenticator. Thanks. Marco. --

2 1

how to get module reply attributes in authenticate module
by bryan xiang 16 Oct '25

16 Oct '25

Hello Experts: I am testing customized rlm_jradius work with rlm_tacacs, the work flow is auth request go to rlm_jradius module firstly, if return the user should go to tacacs, then request will go to rlm_tacacs. below is the site config: server default { namespace = radius listen local{ type = Access-Request type = Status-Server transport = udp udp { ipaddr = 127.0.0.1 port = 1812 } } listen internal{ type = Access-Request type = Status-Server transport = udp udp { ipaddr = 169.254.195.0 port = 1812 } } listen external{ type = Access-Request type = Status-Server transport = udp udp { ipaddr = 10.76.56.89 port = 1812 } } authenticate JRADIUS { jradius if( ! ok && reply.Vendor-Specific.Lucent-VID.IsTacacsUser == "TRUE" ) { subrequest @tacacs::Authentication-Start { User-Name := parent.request.User-Name #User-Password := parent.request.User-Password Data := parent.request.User-Password Packet.Version-Major := 0xC Packet.Version-Minor := 0x1 Packet.Packet-Type := "Authentication" Packet.Sequence-Number := 1 Packet.Flags := "None" Packet.Session-Id := parent.request.Acct-Session-Id Packet.Length := 0 Authentication-Type := "PAP" Action := "Login" Authentication-Service := "Login" tacacs if (reply.Authentication-Status == "Pass") { parent.control.Auth-Type := "Accept" } else { parent.control.Auth-Type := "Reject" } } } } recv Access-Request { control.Auth-Type := ::JRADIUS } } The question is I want to get some reply attributes from jradius and decide if we should go to the subrequest for tacacs module, I tried some methods, but the reply is null. logs: (5) Thu Oct 16 09:56:15 2025 : Debug : Time tracking started in yielded state (5) Thu Oct 16 09:56:15 2025 : Debug : Request resuming (5) Thu Oct 16 09:56:15 2025 : Debug : default { (5) Thu Oct 16 09:56:15 2025 : Debug : Received Access-Request ID 125 from 169.254.131.0:38924 to 169.254.195.0:1812 via int0 (5) Thu Oct 16 09:56:15 2025 : Debug : User-Name = "bryantest" (5) Thu Oct 16 09:56:15 2025 : Debug : NAS-Identifier = "LCP_CLI" (5) Thu Oct 16 09:56:15 2025 : Debug : Service-Type = Authenticate-Only (5) Thu Oct 16 09:56:15 2025 : Debug : Calling-Station-Id = "10.76.89.53" (5) Thu Oct 16 09:56:15 2025 : Debug : NAS-IP-Address = 169.254.64.1 (5) Thu Oct 16 09:56:15 2025 : Debug : NAS-Port = 4021429 (5) Thu Oct 16 09:56:15 2025 : Debug : NAS-Port-Type = Virtual (5) Thu Oct 16 09:56:15 2025 : Debug : User-Password = "testpass" (5) Thu Oct 16 09:56:15 2025 : Debug : Net { (5) Thu Oct 16 09:56:15 2025 : Debug : Src { (5) Thu Oct 16 09:56:15 2025 : Debug : IP = 169.254.131.0 (5) Thu Oct 16 09:56:15 2025 : Debug : Port = 38924 (5) Thu Oct 16 09:56:15 2025 : Debug : } (5) Thu Oct 16 09:56:15 2025 : Debug : Dst { (5) Thu Oct 16 09:56:15 2025 : Debug : IP = 169.254.195.0 (5) Thu Oct 16 09:56:15 2025 : Debug : Port = 1812 (5) Thu Oct 16 09:56:15 2025 : Debug : } (5) Thu Oct 16 09:56:15 2025 : Debug : Timestamp = "2025-10-16T01:56:15Z" (5) Thu Oct 16 09:56:15 2025 : Debug : } (5) Thu Oct 16 09:56:15 2025 : Debug : Packet-Type = Access-Request (5) Thu Oct 16 09:56:15 2025 : Debug : No request.State attribute, can't restore session-state (5) Thu Oct 16 09:56:15 2025 : Debug : Running 'recv Access-Request' from file /etc/opt/LU3Pfreeradius-server/sites-cpm/cpm_radius_config (5) Thu Oct 16 09:56:15 2025 : WARN : Module default returned 3-7 (5) Thu Oct 16 09:56:15 2025 : Debug : recv Access-Request { (5) Thu Oct 16 09:56:15 2025 : Debug : control.Auth-Type := JRADIUS (5) Thu Oct 16 09:56:15 2025 : Debug : } # recv Access-Request (noop) (5) Thu Oct 16 09:56:15 2025 : Debug : Running 'authenticate JRADIUS' from file /etc/opt/LU3Pfreeradius-server/sites-cpm/cpm_radius_config (5) Thu Oct 16 09:56:15 2025 : Debug : authenticate JRADIUS { 2025-10-16T09:56:15.721544+08:00: Debug : rlm_jradius: mod_jradius_call: 0x7f3da0fcbb80, 0x1210d10, 0x15cc590, 0x172f060 2025-10-16T09:56:15.721580+08:00: Debug : rlm_jradius: Reserving JRadius socket id: 7 2025-10-16T09:56:15.721596+08:00: Debug : rlm_jradius: Got attribute User-Name (vendor: 0, id: 1; len: 9, type: 1) 2025-10-16T09:56:15.721609+08:00: Debug : rlm_jradius: Packing attribute User-Name (vendor: 0, id: 1; len: 9, type: 1) 2025-10-16T09:56:15.721664+08:00: Debug : rlm_jradius: Got attribute NAS-Port (vendor: 0, id: 5; len: 0, type: 14) 2025-10-16T09:56:15.721670+08:00: Debug : rlm_jradius: Packing attribute NAS-Port (vendor: 0, id: 5; len: 0, type: 14) 2025-10-16T09:56:15.721675+08:00: Debug : rlm_jradius: Got attribute NAS-Port-Type (vendor: 0, id: 61; len: 0, type: 14) 2025-10-16T09:56:15.721680+08:00: Debug : rlm_jradius: Packing attribute NAS-Port-Type (vendor: 0, id: 61; len: 0, type: 14) 2025-10-16T09:56:15.721685+08:00: Debug : rlm_jradius: Got attribute User-Password (vendor: 0, id: 2; len: 8, type: 1) 2025-10-16T09:56:15.721690+08:00: Debug : rlm_jradius: Packing attribute User-Password (vendor: 0, id: 2; len: 8, type: 1) 2025-10-16T09:56:15.721695+08:00: Debug : rlm_jradius: Got attribute Net (vendor: 0, id: 60; len: 0, type: 25) 2025-10-16T09:56:15.721700+08:00: Debug : rlm_jradius: Got attribute Packet-Type (vendor: 0, id: 1000; len: 0, type: 14) 2025-10-16T09:56:15.721705+08:00: Debug : rlm_jradius: packing packet with code: 1 (attr length: 147) 2025-10-16T09:56:15.721717+08:00: Debug : rlm_jradius: packing packet with code: 0 (attr length: 0) 2025-10-16T09:56:15.721722+08:00: Debug : rlm_jradius: Got attribute Auth-Type (vendor: 0, id: 12; len: 0, type: 14) 2025-10-16T09:56:15.721727+08:00: Debug : rlm_jradius: sending 192 bytes to socket 7 2025-10-16T09:56:15.790878+08:00: Debug : rlm_jradius: read 230 bytes at once 2025-10-16T09:56:15.790919+08:00: Debug : rlm_jradius: return code 8; receiving 2 packets 2025-10-16T09:56:15.790926+08:00: Debug : rlm_jradius: reading packet: code=1 len=147 2025-10-16T09:56:15.790939+08:00: Debug : rlm_jradius: reading attribute: type=1; len=9 2025-10-16T09:56:15.790955+08:00: Debug : rlm_jradius: attribute from dict: vendor=0; id=1, name=User-Name, type=1, vp_ptr=(nil) 2025-10-16T09:56:15.790971+08:00: Debug : rlm_jradius: attribute after strndup: vendor=0; id=1, name=User-Name, type=1, vp_ptr=0x7f3d88094dd0, buff=0x7f3da0fbb970 2025-10-16T09:56:15.790979+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d88091f18, vp=0x7f3d88099410 2025-10-16T09:56:15.790984+08:00: Debug : rlm_jradius: reading attribute: type=32; len=7 2025-10-16T09:56:15.791020+08:00: Debug : rlm_jradius: attribute from dict: vendor=0; id=32, name=NAS-Identifier, type=1, vp_ptr=(nil) 2025-10-16T09:56:15.791029+08:00: Debug : rlm_jradius: attribute after strndup: vendor=0; id=32, name=NAS-Identifier, type=1, vp_ptr=0x7f3d88098800, buff=0x7f3da0fbb970 2025-10-16T09:56:15.791152+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d88091f18, vp=0x7f3d88097fb0 2025-10-16T09:56:15.791157+08:00: Debug : rlm_jradius: reading packet: code=3 len=37 2025-10-16T09:56:15.791161+08:00: Info : rlm_jradius: changing packet code from 0 to 3 2025-10-16T09:56:15.791166+08:00: Debug : rlm_jradius: reading attribute: type=244383759; len=4 2025-10-16T09:56:15.791191+08:00: Debug : rlm_jradius: attribute from dict: vendor=3729; id=15, name=*IsTacacsUser*, type=1, vp_ptr=(nil) 2025-10-16T09:56:15.791199+08:00: Debug : rlm_jradius: attribute after strndup: vendor=3729; id=15, name=IsTacacsUser, type=1, vp_ptr=0x7f3d88097740, buff=0x7f3da0fbb970 2025-10-16T09:56:15.791205+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d88092008, vp=0x7f3d880980b0 2025-10-16T09:56:15.791210+08:00: Debug : rlm_jradius: reading attribute: type=244383760; len=9 2025-10-16T09:56:15.791215+08:00: Debug : rlm_jradius: attribute from dict: vendor=3729; id=16, name=TacacsUserName, type=1, vp_ptr=(nil) 2025-10-16T09:56:15.791221+08:00: Debug : rlm_jradius: attribute after strndup: vendor=3729; id=16, name=TacacsUserName, type=1, vp_ptr=0x7f3d880385b0, buff=0x7f3da0fbb970 2025-10-16T09:56:15.791227+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d88092008, vp=0x7f3d88097340 2025-10-16T09:56:15.791231+08:00: Debug : rlm_jradius: reading request: config_item: len=16 2025-10-16T09:56:15.791237+08:00: Debug : rlm_jradius: reading attribute: type=1000; len=4 2025-10-16T09:56:15.791242+08:00: Debug : rlm_jradius: attribute from dict: vendor=0; id=1000, name=Packet-Type, type=14, vp_ptr=(nil) 2025-10-16T09:56:15.791248+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d880920f8, vp=0x7f3d88098870 2025-10-16T09:56:15.791252+08:00: Debug : rlm_jradius: Auth-type received - 4 2025-10-16T09:56:15.791270+08:00: Debug : rlm_jradius: Released JRadius socket id: 7 2025-10-16T09:56:15.791323+08:00: Debug : rlm_jradius: rejected: p_result=1, rcode=2 (5) Thu Oct 16 09:56:15 2025 : WARN : jradius - Module jradius returned 2-1 (5) Thu Oct 16 09:56:15 2025 : Debug : jradius (fail) (5) Thu Oct 16 09:56:15 2025 : Debug : if ( ! ok && reply.Vendor-Specific.Lucent-VID.IsTacacsUser == "TRUE" ) { (5) Thu Oct 16 09:56:15 2025 : Debug : | && (5) Thu Oct 16 09:56:15 2025 : Debug : | ! (5) Thu Oct 16 09:56:15 2025 : Debug : | %logical_and() (5) Thu Oct 16 09:56:15 2025 : Debug : | -- UNLANG (5) Thu Oct 16 09:56:15 2025 : Debug : | ok (5) Thu Oct 16 09:56:15 2025 : Debug : Request rcode is 'reject' (5) Thu Oct 16 09:56:15 2025 : Debug : | %expr.rcode() (5) Thu Oct 16 09:56:15 2025 : Debug : | --> false (5) Thu Oct 16 09:56:15 2025 : Debug : | %unary_not({false}) (5) Thu Oct 16 09:56:15 2025 : Debug : | --> true (5) Thu Oct 16 09:56:15 2025 : Debug : | == (5) Thu Oct 16 09:56:15 2025 : Debug : | %logical_and(...) (5) Thu Oct 16 09:56:15 2025 : Debug : | reply.Vendor-Specific.Lucent-VID.IsTacacsUser (5) Thu Oct 16 09:56:15 2025 : Debug : | %{reply.Vendor-Specific.Lucent-VID.IsTacacsUser} (5) Thu Oct 16 09:56:15 2025 : Debug : * (null)* (5) Thu Oct 16 09:56:15 2025 : Debug : | %cmp_eq({}{TRUE}) (5) Thu Oct 16 09:56:15 2025 : Debug : | --> false (5) Thu Oct 16 09:56:15 2025 : Debug : | %logical_and(...) (5) Thu Oct 16 09:56:15 2025 : Debug : | --> (null) (5) Thu Oct 16 09:56:15 2025 : Debug : ... (5) Thu Oct 16 09:56:15 2025 : Debug : } (5) Thu Oct 16 09:56:15 2025 : Debug : } # authenticate JRADIUS (noop) (5) Thu Oct 16 09:56:15 2025 : Debug : rcode: 7 (5) Thu Oct 16 09:56:15 2025 : Debug : Failed to authenticate the user 3 (5) Thu Oct 16 09:56:15 2025 : Debug : default (ok) (5) Thu Oct 16 09:56:15 2025 : Debug : Setting rcode to 'ok' (5) Thu Oct 16 09:56:15 2025 : Debug : } # default (ok) (5) Thu Oct 16 09:56:15 2025 : Debug : Setting rcode to 'ok' (5) Thu Oct 16 09:56:15 2025 : Debug : Enter unlang_interpret_request_done, typpe=0 (5) Thu Oct 16 09:56:15 2025 : Debug : Done request (5) Thu Oct 16 09:56:15 2025 : Debug : Time tracking ended (5) Thu Oct 16 09:56:15 2025 : Debug : XXXXXXXXXX (5) Thu Oct 16 09:56:15 2025 : Debug : Vendor-Specific.Lucent-VID.*IsTacacsUser *= "TRUE" (5) Thu Oct 16 09:56:15 2025 : Debug : Vendor-Specific.Lucent-VID.TacacsUserName = "bryantest" (5) Thu Oct 16 09:56:15 2025 : Debug : Packet-Type = Access-Reject so my subrequest for tacacs did not run, could you help me how to get the jradius replied attributes? regards, Bryan

2 1

Utterly confused about realms/proxies
by Stephen Mellor 05 Oct '25

05 Oct '25

A decade ago I setup up separate pairs of freeradius servers for wifi and for 802.1x switch port authentication (including VLAN switching), and they've worked very well - so well in fact that I've rarely had to make any changes and I've forgotten pretty much everything that I learned about radius at the time. But now we have a major change - another part of the organisation moving into our buildings, on our infrastructure, and we need to proxy out authentication for them to their Cisco ISE servers. I'm sure it's not difficult but I'm really struggling to achieve this (admittedly I have little time, and no dev/test system so I'm working on the live system out of hours). So let's say that using EAP-TLS I'm currently getting user-name in the form of host/device.US.example.com and host/device.THEM.example.com, how can I differentiate between US.example.com and THEM.example.com so that we continue to authenticate US, but proxy out to their Cisco ISE to authenticate THEM? Post-auth isn't a problem, I know how to switch VLANs and/or accept/reject according to wifi SSID and user-name domain. I'm not looking for someone else to do this for me, but I'm reading the configs and getting nowhere - a hint would be much appreciated (is realms even the correct thing to use?), or a link to any place where there are examples of similar configurations (google is failing me, but then I'm not sure what terms to use, "multi-tenant" or similar?). Thanks! -------------------------------------------------------------------------------------------------------------------------------------------------------- This email is intended for the named recipient only. If you have received it by mistake, please (i) contact the sender by email reply; (ii) delete the email from your system; . and (iii) do not copy the email or disclose its contents to anyone. --------------------------------------------------------------------------------------------------------------------------------------------------------

2 2

WiFi EAP authentication and iOS device setup options?
by Franta Hanzlík 04 Oct '25

04 Oct '25

I finally managed to set up very basic EAP-PEAP and EAP-TTLS MSCHAP2 authentication in a Freeradius + Mikrotik MT network (users and their passwords in cleartext in text file), with a Let's Encrypt certificate in the eap{tls-config tls-common {}} section). Connecting from a Linux NTB and Android (v9 and v11) phone is without problems for both TTLS and PEAP, in the WiFi network settings I can choose a whole range of parameters (EAP method, phase 2 authentication method, certificate selection, CRL usage, domain, identity and anonymous identity,...). And now I tried connecting an iOS (v15) tablet - and this device only requires a username and password. Then it asks if the user trusts Let's Encrypt certificate (which it says is untrusted), and then it connects to the network without any problems. Please excuse the possibly stupid questions, but I have no experience with Apple iOS devices at all - so I would like to ask for an explanation - is this normal with iOS? : - that you can't set basically any WiFi network parameters (after connecting, you can set automatic connection to the network, and randomization of the MAC address - but that's probably all) - when I used a certificate generated by the resources in raddb/certs/ instead of the Lets Encrypt certificate, both Linux and Android clients connected to the network, but the iOS tablet ended up with the error aka "Cannot connect to this network." - is that why? - why does marks the Let's Encrypt certificate as untrustworthy? -- Thanks again, Franta Hanzlik

3 4

which nas_type for Mikrotik WiFi AP NAS ?
by Franta Hanzlík 03 Oct '25

03 Oct '25

Hello, I'm trying FreeRadius with Mikrotik WiFi AP and EAP-PEAP/MSCHAPv2 authentication, so far with a user in mods-config/files/authorize and a cleartext password. So far unsuccessfully, I probably have more errors in the configuration that I'm trying to fix. One specific ambiguity: which NAS type should be listed in the NAS specification in clients.conf - "other", "mikrotik" or "mikrotik_snmp"? The original clients.conf template in the paragraph "The nas_type tells 'checkrad.pl' which NAS-specific method to use to query the NAS for simultaneous use. Permitted NAS types are" lists 13 types incl. "other", "mikrotik" is not among them. But the checkrad man page lists 25 types, including "mikrotik_snmp" and "mikrotik". From this it seems to me that nas_type should not be "other", but "mikrotik" or "mikrotik_snmp". Can anyone advise which one and what is the difference between them? -- Thanks in advance, Franta Hanzlik

3 5

EAP-TTLS/PAP failing: client NAKs and requests MSCHAPv2 inside inner-tunnel
by Arifia Hapsari 01 Oct '25

01 Oct '25

Hello, I am trying to configure FreeRADIUS for guest Wi-Fi authentication using *EAP-TTLS/PAP*. My backend is a custom REST API that validates the username and plain-text password. The Phase 1 TLS tunnel is established successfully, but the inner authentication (Phase 2) always fails. The debug log shows that my inner-tunnel server rejects the user. Here is the part of my debug log: (7) server inner-tunnel { (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authorize { (7) eap: Peer sent EAP Response (code 2) ID 1 length 6 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Peer sent packet with method EAP NAK (3) (7) eap: Peer NAK'd asking for unsupported EAP type MSCHAPv2 (26), skipping... (7) eap: ERROR: No mutually acceptable types found (7) [eap] = invalid (7) } # authenticate = invalid (7) Failed to authenticate the user ... (7) eap_ttls: Got tunneled Access-Reject (7) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed My eap.conf is configured to use default_eap_type = "pap" inside the ttls section. *My questions are:* 1. Does the log line Peer NAK'd asking for unsupported EAP type MSCHAPv2 definitively mean that client requests MSCHAPv2 but the server is only configured to accept EAP-TTLS/PAP? 2. What is the recommended best practice to solve this for a guest network? Should I focus on forcing the client devices to use PAP, or is it more reliable to reconfigure my server and REST API to support MSCHAPv2 (by providing the NT-Password hash)? Thank you for your help

2 3