In strongswan for ikev1 it uses xauth-eap that I use to do validation with RADIUS (that's the only way for ikev1 clients with strongswan). My design is that I don't actually care about secondary authentication with RADIUS since it's already doing certificate validation from strongswan side before doing secondary authentication. All is good if I was only need secondary authentication since I can bypass with verify_eap from strongswan side but I want to make use of the Expiration module on freeradius side (works great). I have few questions so it can help me determine next course of action: 1) is there a way to configure freeradius for Accounting only and also does the user expiration check? 2) is it possible for me in any way to reject expired user but accept eap based authentication (from configuration or code modification)? 3) when connection is rejected does the strongswan side (xauth-eap plugin in particular) receive information that can differentiate this logic (send attribute that it can handle maybe? I have no idea how that work)? Thanks