Hi, We tried to stress test (EAPTLS) FreeRADIUS 2.1.7 which sits behind Load Balancer We had 2 FreeRADIUS servers behind load balancer (R1,R2) Some requests got rejected (Access-Reject was sent) and the log showed Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Now we understand that if EAPTLS session started (we have 10 Access-Challenge messages because of our certificate chain) against Radius_1 and then continued to Radius_2 because load balancer reverted it there then EAPTLS handshake cannot succeed, but we expected that FreeRADIUS should drop packets and NOT RESPOND instead of sending Access-Reject when it cannot find STATE variable By looking at the code we think eap_tls module returns RLM_MODULE_INVALID or RLM_MODULE_FAIL when it cannot find EAP session in the tree. What is proper configuration that we can do? Is something like this recommended? authorize { .. eap { ok = return updated = return handled = return } if (invalid) { do_not_respond } # if we reach here then Auth-Type != EAP .. } Thanks you for your response -- View this message in context: http://www.nabble.com/EAPTLS-Stress-test%3A-2.1.7-tp25686662p25686662.html Sent from the FreeRadius - User mailing list archive at Nabble.com.