You should set "default_eap_type" to have the server start a particular EAP type. The client *should* either start that EAP type, or NAK it with a list of supported EAP types.
In this case, you set "default_eap_type = mschapv2", but deleted the "mschapv2" from the "eap" section. That's confusing and wrong. Don't do that.
I had forgot to set the default in the PEAP section in this test (I had tried it before). In either case it doesn't work as it still provides the same error. But since Alan says that is a bad idea anyway, I left in the mschapv2 section in and I changed inside PEAP to "default_eap_type = gtc" in the eap file. Tunnel settings are both set to no (which I believe is default). Any other default settings I should try? When I have it like this, it just tries mschapv2, fails due to authentication problem (as my android puts it) and just keeps trying and failing. Again if I force it to use GTC on android, then it would work in this current config. rlm_ldap (ldap): Released connection (4) (7) [ldap] = ok (7) [expiration] = noop (7) [logintime] = noop (7) WARNING: pap : Auth-Type already set. Not setting to PAP (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap : Expiring EAP session with state 0x157f222d157738f9 (7) eap : Finished EAP session with state 0x157f222d157738f9 (7) eap : Previous EAP request found for state 0x157f222d157738f9, released from the list (7) eap : Peer sent method MSCHAPv2 (26) (7) eap : EAP MSCHAPv2 (26) (7) eap : Calling eap_mschapv2 to process EAP data (7) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) eap_mschapv2 : Auth-Type MS-CHAP { (7) WARNING: mschap : No Cleartext-Password configured. Cannot create LM-Password (7) WARNING: mschap : No Cleartext-Password configured. Cannot create NT-Password (7) mschap : Creating challenge hash with username: testuser (7) mschap : Client is using MS-CHAPv2 (7) ERROR: mschap : FAILED: No NT/LM-Password. Cannot perform authentication (7) ERROR: mschap : MS-CHAP2-Response is incorrect (7) [mschap] = reject (7) } # Auth-Type MS-CHAP = reject (7) eap : Freeing handler (7) [eap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [testuser/<via Auth-Type = EAP>] (from client WLC port 0 via TLS tunnel)