Alan, I can see from debug that freeradius is proxying only acct-requests to fortigate as it should: Sending Accounting-Request of id 237 to 192.x port 1813 Acct-Session-Id = "5419E16643C100" User-Name = "calena" Acct-Status-Type = Stop Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS Acct-Session-Time = 19018 Acct-Output-Octets = 1259331153 Acct-Input-Octets = 37100064 Acct-Output-Packets = 970288 Acct-Input-Packets = 366792 Calling-Station-Id = "9C:D6:43:D5:37:75" NAS-Port-Type = Async Acct-Terminate-Cause = User-Request Framed-IP-Address = x.x.x.x NAS-IP-Address = y.y.y.y NAS-Port = 481 Acct-Delay-Time = 0 Proxy-State = 0x323436 Proxying request 125 to home server 192.x port 1813 Sending Accounting-Request of id 237 to 192.x port 1813 Is there a way to proxy those packets *only* if contains the Class attribute or Acct-Status-Type = Stop? How can I "filter" that?