Alan,

I can see from debug that freeradius is proxying only acct-requests to fortigate as it should:

Sending Accounting-Request of id 237 to 192.x port 1813

        Acct-Session-Id = "5419E16643C100"

        User-Name = "calena"

        Acct-Status-Type = Stop

        Service-Type = Framed-User

        Framed-Protocol = PPP

        Acct-Authentic = RADIUS

        Acct-Session-Time = 19018

        Acct-Output-Octets = 1259331153

        Acct-Input-Octets = 37100064

        Acct-Output-Packets = 970288

        Acct-Input-Packets = 366792

        Calling-Station-Id = "9C:D6:43:D5:37:75"

        NAS-Port-Type = Async

        Acct-Terminate-Cause = User-Request

        Framed-IP-Address = x.x.x.x

        NAS-IP-Address = y.y.y.y

        NAS-Port = 481

        Acct-Delay-Time = 0

        Proxy-State = 0x323436

Proxying request 125 to home server 192.x port 1813

Sending Accounting-Request of id 237 to 192.x port 1813

Is there a way to proxy those packets *only* if contains the Class attribute or Acct-Status-Type = Stop?

How can I "filter" that?