Hi list, I have a FreeRADIUS 3.0.3 proxy which forward all Cisco WAPs Wireless-802.11 authentication requests to a Windows NPS server. Clients use PEAP to authenticate. What I'm seeing is that the Access-Challenge from the NPS is forwarded without any AVPs, and of course the WAP silently drops it. Please find below the debug output and the relevant configuration files attached. Couldn't find really anything helpful in the ML archive. Could you please give me any suggestion of what could be wrong? Please let me know if further information is needed. Thank you in advance for your kind assistance. - leonardo Received Access-Request Id 111 from 10.97.6.140:1645 to 10.97.63.5:1812 length 216 User-Name = 'mbianchi' Framed-MTU = 1400 Called-Station-Id = 'DC-A5-F4-FE-BE-71:WRES-DEV' Calling-Station-Id = 'ac22.0ba5.9688' Cisco-AVPair = 'ssid=WRES-DEV' Service-Type = Login-User Cisco-AVPair = 'service-type=Login' Message-Authenticator = 0x98e4b1c896994939e0de6e25c17b96a0 EAP-Message = 0x0201000b016c6172656e61 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = '374' NAS-Port = 374 NAS-Port-Id = '374' NAS-IP-Address = 10.97.6.140 NAS-Identifier = 'dev-rto004-r1-ap-1' (1) # Executing section authorize from file /etc/raddb/sites-enabled/default-bsn (1) authorize { (1) [preprocess] = ok (1) linelog_auth : EXPAND /var/log/radius/linelog_auth.log (1) linelog_auth : --> /var/log/radius/linelog_auth.log (1) linelog_auth : EXPAND %S, %{User-Name}, %{NAS-Identifier}(%{NAS-IP-Address}):%{NAS-Port-Id}, Calling-Station-Id: %{Calling-Station-Id}, Packet-Type: %{Packet-Type}, Service-Type: %{Service-Type} (1) linelog_auth : --> 2015-09-10 13:44:55, mbianchi, dev-rto004-r1-ap-1(10.97.6.140):374, Calling-Station-Id: ac22.0ba5.9688, Packet-Type: Access-Request, Service-Type: Login-User (1) [linelog_auth] = ok (1) suffix : No '@' in User-Name = "mbianchi", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) if (!updated) (1) if (!updated) -> TRUE (1) if (!updated) { (1) if (NAS-Port-Type == Wireless-802.11) (1) if (NAS-Port-Type == Wireless-802.11) -> TRUE (1) if (NAS-Port-Type == Wireless-802.11) { (1) update control { (1) &Proxy-To-Realm := 'my.domain.org' (1) } # update control = noop (1) } # if (NAS-Port-Type == Wireless-802.11) = noop (1) ... skipping else for request 1: Preceding "if" was taken (1) } # if (!updated) = noop (1) } # authorize = ok (1) Proxying request to home server 10.44.16.110 port 1812 Sending Access-Request Id 226 from 0.0.0.0:46821 to 10.44.16.110:1812 User-Name = 'mbianchi' Framed-MTU = 1400 Called-Station-Id = 'DC-A5-F4-FE-BE-71:WRES-DEV' Calling-Station-Id = 'ac22.0ba5.9688' Cisco-AVPair = 'ssid=WRES-DEV' Service-Type = Login-User Cisco-AVPair = 'service-type=Login' Message-Authenticator = 0x98e4b1c896994939e0de6e25c17b96a0 EAP-Message = 0x0201000b016c6172656e61 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = '374' NAS-Port = 374 NAS-Port-Id = '374' NAS-IP-Address = 10.97.6.140 NAS-Identifier = 'dev-rto004-r1-ap-1' Proxy-State = 0x313131 Waking up in 0.3 seconds. Waking up in 0.4 seconds. Received Access-Challenge Id 226 from 10.44.16.110:1812 to 10.97.63.5:46821 length 95 Proxy-State = 0x313131 Session-Timeout = 30 EAP-Message = 0x010200061920 State = 0x1c5503ba00000137000102000a2c106e0000000000000000000000000000000c6d95d8e4 Message-Authenticator = 0xe5ba33c9fca2c5534a4e1302650ae8ca Sending Access-Challenge Id 111 from 10.97.63.5:1812 to 10.97.6.140:1645 (1) Finished request Waking up in 0.3 seconds. Waking up in 3.0 seconds. (0) Cleaning up request packet ID 110 with timestamp +12 Waking up in 1.6 seconds.