Hi, In using eapol_test against FreeRADIUS 2.2.3 and 3.1 (3.1.0-dead (git #4870102)) I noticed that the following attributes are NOT included in the Access-Accept sent by FR 3.1: EAP-MSK, EAP-EMSK and EAP-Session-Id. Are these attributes required in the Access-Accept? If so, how can I copy them from the inner-tunner server to the Access-Accept? Thanks, Chris 1. FreeRADIUS 2.2.3 Mon Nov 28 08:46:27 2016 : Debug: # Executing section post-auth from file /etc/raddb/sites-enabled/LOCAL-WLAN-outer Mon Nov 28 08:46:27 2016 : Debug: +group post-auth { Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{reply:Packet-Type} -> Access-Accept Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{Operator-Name} -> Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] ... expanding second conditional Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{Calling-Station-ID} -> 02:00:00:00:00:01 Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{NAS-IP-Address} -> 127.0.0.1 Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{NAS-Port} -> Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] ... expanding second conditional Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %t : %{%{reply:Packet-Type}:-unknown-method} [%{User-Name}] ( %{%{Operator-Name}:-No_Operator} client=%{%{Calling-Station-ID}:-00:00:de:ad:be:ef} NAS-IP-Address %{%{NAS-IP-Address}:-0.0.0.0} port %{%{NAS-Port}:-0}) -> Mon Nov 28 08:46:27 2016 : Access-Accept [testuser@leeds.ac.uk] ( No_Operator client=02:00:00:00:00:01 NAS-IP-Address 127.0.0.1 port 0) Mon Nov 28 08:46:27 2016 : Debug: ++[linelog_reply] = ok Mon Nov 28 08:46:27 2016 : Debug: ++[exec] = noop Mon Nov 28 08:46:27 2016 : Debug: +} # group post-auth = ok Mon Nov 28 08:46:27 2016 : Debug: Sending Access-Accept packet to host X.X.X.X port 49011, id=11, length=0 Mon Nov 28 08:46:27 2016 : Debug: User-Name = "testuser" Mon Nov 28 08:46:27 2016 : Debug: MS-MPPE-Recv-Key = 0x88f27e096616e54304666947eaa5c38d3b3b62ba9b116e0c2b476718a56ca767 Mon Nov 28 08:46:27 2016 : Debug: MS-MPPE-Send-Key = 0xbb1a28fa8663a7c7516d89ed921db7159fc05315f5578e7c715fe9261d83ddd6 Mon Nov 28 08:46:27 2016 : Debug: EAP-MSK = 0x88f27e096616e54304666947eaa5c38d3b3b62ba9b116e0c2b476718a56ca767bb1a28fa8663a7c7516d89ed921db7159fc05315f5578e7c715fe9261d83ddd6 Mon Nov 28 08:46:27 2016 : Debug: EAP-EMSK = 0x22ad8973c9357152405aec86b3911658adde465b54757f85d8b35e32fc89bb4e6ba96fc01bd1497afc430b403d51487f0df830c75b11fc40edc42595eb4ea37d Mon Nov 28 08:46:27 2016 : Debug: EAP-Session-Id = 0x19583beee34ffd6c9a5fa449c2ee1648b00378dcf0123d0ec8deed9d57ec59edf7583beee384531fad7b0362375c1618ad5923cec29d453037d7b4f88594db792f Mon Nov 28 08:46:27 2016 : Debug: EAP-Message = 0x030b0004 Mon Nov 28 08:46:27 2016 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Mon Nov 28 08:46:27 2016 : Debug: Finished request 287510. 2. FreeRADIUS 3.1 (12,1) Using 'Auth-Type = eap' for authenticate {...} (12,1) Running Auth-Type eap from file /etc/raddb/sites-enabled/default (12,1) Auth-Type eap { (12,1) eap - Peer sent packet with EAP method PEAP (25) (12,1) eap - Calling submodule eap_peap to process data (12,1) eap_peap - Continuing EAP-TLS (12,1) eap_peap - Got complete TLS record (74 bytes) (12,1) eap_peap - [eap-tls verify] = complete (12,1) eap_peap - Decrypted TLS application data (11 bytes) (12,1) eap_peap - [eap-tls process] = complete (12,1) eap_peap - Session established. Decoding tunneled data (12,1) eap_peap - PEAP state send tlv success (12,1) eap_peap - Received EAP-TLV response (12,1) eap_peap - Success (12,1) eap_peap - Adding session keys (12,1) eap_peap - &reply:MS-MPPE-Recv-Key = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f755 (12,1) eap_peap - &reply:MS-MPPE-Send-Key = 0x96c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) eap_peap - &reply:EAP-MSK = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f75596c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) eap_peap - &reply:EAP-EMSK = 0xb96c201642eb34b43d228b912522eb2fef02d0fbd93a60d2d4d1c90ce5dea84c5a288b49d95fbd9ae1eabfa681064f5e8b1a190ce97500aa79f0a93fffdc0ed7 (12,1) eap - Sending EAP Success (code 3) ID 11 length 4 (12,1) eap - Cleaning up EAP session (12,1) eap (ok) (12,1) if (handled && (Response-Packet-Type == Access-Challenge)) { (12,1) ... (12,1) } (12,1) } # Auth-Type eap (ok) (12,1) Login OK: [testuser@realm] (from client netserv5 port 0 cli 02:00:00:00:00:01) (12,1) Running section post-auth from file /etc/raddb/sites-enabled/default (12,1) post-auth { (12,1) update { (12,1) &reply: += &session-state:Stripped-User-Name -> "testuser" (12,1) &reply: += &session-state:Reply-Message -> "successful authentication" (12,1) } # update (noop) (12,1) update reply { (12,1) &reply:Reply-Message := successful authentication (12,1) } # update reply (noop) (12,1) default-accept-log - Using default message (12,1) default-accept-log - EXPAND %S (%l) id %I DEFAULT ACCEPT %{User-Name} cli %{%{Calling-Station-Id}:--} auth-type %{control:Auth-Type}/%{EAP-Type} realm %{Realm} operator %{%{Operator-Name}:--} client %{%{Packet-Src-IP-Address}:-%{%{Packet-Src-IPv6-Address}:--}} (%{Client-Shortname}) essid (%{%{Called-Station-SSID}:--}) reply-msg '%{reply:Reply-Message}' (12,1) default-accept-log - --> 2016-11-28 13:44:16 (1480340656) id 11 DEFAULT ACCEPT testuser@realm cli 02:00:00:00:00:01 auth-type eap/PEAP realm realm operator - client Y.Y.Y.Y (netserv5) essid (-) reply-msg 'successful authentication' (12,1) default-accept-log - EXPAND /var/log/radius/auth.log (12,1) default-accept-log - --> /var/log/radius/auth.log (12,1) default-accept-log (ok) (12,1) exec (noop) (12,1) remove_reply_message_if_eap { (12,1) if (&reply:EAP-Message && &reply:Reply-Message) { (12,1) update reply { (12,1) &reply:Reply-Message !* ANY (12,1) } # update reply (noop) (12,1) } # if (&reply:EAP-Message && &reply:Reply-Message) (noop) (12,1) else { (12,1) ... skipping else for request 12: Preceding "if" was taken (12,1) } (12,1) } # remove_reply_message_if_eap (noop) (12,1) } # post-auth (ok) (12,1) Sent Access-Accept Id 11 from Y.Y.Y.Y:1812 to Y.Y.Y.Y:53223 via em1 length 0 (12,1) MS-MPPE-Recv-Key = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f755 (12,1) MS-MPPE-Send-Key = 0x96c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) EAP-Message = 0x030b0004 (12,1) Message-Authenticator = 0x00000000000000000000000000000000 (12,1) Finished request