Firstly: "FreeRADIUS Version 3.0.16, for host x86_64-pc-linux-gnu" We are using MsCHAPv2 over TLS. I've been trying to get the inner-tunnel username and module failure message back to the "outer" session similar to this situation: http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074994.... or this: http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074961.... I have read a lot of the archived posts but am still not sure what's the "right" way of doing it. I have got most of it working except when the user is rejected by the inner tunnel. To be clearer, we want the inner-tunnel username to be available for the linelog and to go in to the postauth table. Is there some sort of definitive howto for this? It seems to be a common situation.