I have just been timing my 2.1.12 setup in Debian 7, authenticating in an AD via samba 3.6.6, and selecting VPN via LDAP groups.

The point is that a EAP connections can take around 162ms-190ms, of which 30ms account to the EAP negotiation, 13-20ms taken in ntlm_auth running in command line, and around 100 ms more when processing mschap/ntlm_auth inside freeradius.

 Any ideia where I could find the culprit, or profile it? I suspect it is due to the forking of ntlm_auth. The CPU is practically idle with a couple thousand users per day. No lack of memory too.

Finally, do you find 160ms-200ms an acceptable time to authenticate, or do I need to dig it further on?

Regards, 

Rui Ribeiro