hi, you've stripped out all the stuff in the virtual server config that makes it do things - take a default copy of the 'default' birual server and start from there (having the named 'eduroam' instance is okay - so long as you have the logic to send the request into there (eg define virtual_server in the clients.conf) historically, i have found using 'eduroam' named virtual server problematic if used for local users. instead, use a local virtual server (where you can define local return VLANs etc etc) and then a named eduroam instance for requests coming to you from the national radius proxy servers (NTLRs) - where you will simply be authenticating (and not setting VLANs etc)...and doing more filtering of RADIUS attributes etc (so you dont leak things to outside world). alan