Hi all, This is probably obvious but I can't understand it! FR 3.1 from git, although not updated for a little while.. When the inner tunnel is called in PEAP/mschapv2, some of the attrs from our request aren't making their way through. Extreme wireless (siemens), the Siemens-AP-Name and Siemens-AP-Serial attributes seem to be missing, unfortunately we use/record some of these otherwise it wouldn't be a problem. My pre-proxy section has the attr_filter.pre-proxy commented out.. PEAP module tunnel copy is enabled (see bottom) Sorry for the regular "help me!" posts, still learning! Thanks Andy Starting request: (10) Received Access-Request Id 187 from 192.168.116.10:52330 to 192.168.176.123:1812 length 421 (10) User-Name = 'SATH\\franksa' (10) NAS-IP-Address = 0.0.0.0 (10) NAS-Port = 106 (10) Framed-MTU = 1400 (10) Called-Station-Id = '20:b3:99:ea:a8:5a' (10) Acct-Session-Id = '5644626401a5' (10) Calling-Station-Id = '00:18:39:0e:77:a2' (10) NAS-Port-Type = Wireless-802.11 (10) NAS-Identifier = 'RSH_WiFi_2_VNS' (10) Service-Type = Framed-User (10) Siemens-AP-Serial = '14351087085D0000' (10) Siemens-AP-Name = 'RSH-AP1125' (10) Siemens-VNS-Name = 'RSH_WiFi_2_VNS' (10) Siemens-SSID = 'RSH_WiFi_2' (10) Siemens-BSS-MAC = '20:b3:99:ea:a8:5a' (10) Siemens-Policy-Name = 'No_Access' (10) Siemens-Topology-Name = 'VLAN200_AP_T' Proxy: (10) EAP-Message = 0x020900471a020900423151ad822a193537467947d21c25db073300000000000000001f4ec99cdb09ee5c7421b6264c4f5cc10e5c0c2db2c039bf00534154485c4652414e4b5341 (10) FreeRADIUS-Proxied-To = 127.0.0.1 (10) User-Name = 'SATH\\franksa' (10) State = 0xd86926bed9603cd4e2325db6a06e5230 (10) NAS-IP-Address = 0.0.0.0 (10) NAS-Port = 106 (10) Framed-MTU = 1400 (10) Called-Station-Id = '20:b3:99:ea:a8:5a' (10) Acct-Session-Id = '5644626401a5' (10) NAS-Port-Type = Wireless-802.11 (10) NAS-Identifier = 'RSH_WiFi_2_VNS' (10) Service-Type = Framed-User (10) Siemens-VNS-Name = 'RSH_WiFi_2_VNS' (10) Siemens-SSID = 'RSH_WiFi_2' (10) Siemens-BSS-MAC = '20:b3:99:ea:a8:5a' (10) Siemens-Policy-Name = 'No_Access' (10) Siemens-Topology-Name = 'VLAN200_AP_T' (10) Calling-Station-Id := '00-18-39-0e-77-a2' PEAP section of relevant EAP mod: peap { tls = tls-common default_eap_type = tls copy_request_to_tunnel = yes use_tunnelled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" # EAP-TLS-Require-Client-Cert = Yes # require_client_cert = yes }