Hello, recently, RFC4284 was brought to my attention, which speaks of ways to notify EAP peers that there is no service for them - with a displayable message as EAP-Notification in a Access-Challenge before the final EAP-Failure in a Reject. Is this in any way doable with FreeRADIUS? I'm thinking of two scenarios primarily: * FreeRADIUS proxy can't reach home server, so writes "Sorry, your home server is unreachable" in a Challenge+EAP-Notification and after the next Request then crafts Reject. * FreeRADIUS sees the realm, figures that it's not wanted, so writes "We don't serve that realm here." and then after the subsequent Request sends Access-Reject. I could also imagine that it could signal its own module failures as reason; e.g. if an rlm_sql doesn't work, instead of an immediate reject or do_not_reply it could send an extra round with "Unable to authenticate you: rlm_sql failed. Try again later"; and only then the Reject. I have no clue how to configure such a behaviour. Is it possible at all? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66