I have a cisco vpn3030 concentrator with both IPSec and PPTP clients. IPSec clients can successfully connect using my FreeRadius 2.1.3 server. They use PAP, I believe. My PPTP clients are failing to connect. Every indication on the Radius server is they have authenticated successfully, although the client says no (both Macintosh and Windows XP clients). When I point my cisco vpn3030 back to the CiscoSecure Radius server they use now (what I'm migrating from), the clients work again. There must be something different about the reply from each server. Any idea what might be happening? VPN logs from my failing PPTP connection: Mar 27 15:03:30 macvpn-inside 13885796 03/27/2009 15:03:30.520 SEV=4 PPTP/47 RPT=37605 76.64.100.68 Tunnel to peer 76.64.100.68 established Mar 27 15:03:30 macvpn-inside 13885797 03/27/2009 15:03:30.590 SEV=4 PPTP/42 RPT=37421 76.64.100.68 Session started on tunnel 76.64.100.68 Mar 27 15:03:33 macvpn-inside 13885798 03/27/2009 15:03:33.800 SEV=5 PPP/8 RPT=33514 76.64.100.68 User [test26] Authenticated successfully with MSCHAP-V1 Mar 27 15:03:33 macvpn-inside 13885799 03/27/2009 15:03:33.890 SEV=4 PPTP/35 RPT=37406 76.64.100.68 Session closed on tunnel 76.64.100.68 (peer 0, local 61694, serial 44796), reason: User request (No additional info) FreeRadius debug log of failed connection: Ready to process requests. rad_recv: Access-Request packet from host 172.26.69.8 port 1479, id=77, length=146 User-Name = "test26" NAS-Port = 8057 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "76.64.100.68" MS-CHAP-Response = 0x02010000000000000000000000000000000000000000000000002f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 MS-CHAP-Challenge = 0x5e0b3b68c24784e0 NAS-IP-Address = 172.26.69.8 NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test26", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=test26 [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain:-ap1} -> --domain=ap1 [mschap] mschap1: 5e [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=5e0b3b68c24784e0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 Exec-Program output: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B Exec-Program-Wait: plaintext: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B Exec-Program: returned: 0 ++[mschap] returns ok Login OK: [test26] (from client macvpn port 8057) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 77 to 172.26.69.8 port 1479 Finished request 5. Going to the next request And my VPN logs from a working connection (ciscosecure radius): Mar 27 15:08:11 macvpn-inside 13886204 03/27/2009 15:08:11.640 SEV=4 PPTP/47 RPT=37606 76.64.100.68 Tunnel to peer 76.64.100.68 established Mar 27 15:08:11 macvpn-inside 13886205 03/27/2009 15:08:11.710 SEV=4 PPTP/42 RPT=37422 76.64.100.68 Session started on tunnel 76.64.100.68 Mar 27 15:08:14 macvpn-inside 13886215 03/27/2009 15:08:14.920 SEV=5 PPP/8 RPT=33515 76.64.100.68 User [test26] Authenticated successfully with MSCHAP-V1 Mar 27 15:08:17 macvpn-inside 13886216 03/27/2009 15:08:17.790 SEV=5 PPP/49 RPT=33002 76.64.100.68 User [test26] IPCP assigned IP Address 172.26.94.7 Mar 27 15:08:17 macvpn-inside 13886217 03/27/2009 15:08:17.790 SEV=4 AUTH/22 RPT=354231 76.64.100.68 User [test26] Group [Base Group] connected, Session Type: PPTP -Mike