For the benefit of future users with same issues who come across this mailing list thread after a Google search it would be nice if you briefly noted what the issue was that fixed your clients in case they have similar issues (though it's good to know that the default config works! :) )
Yea, the default config just works :) Regarding the fix its just a simple config edit but it took longtime to find out because my production config was working with Apple and Android except windows phone. So after comparing the default inner-tunnel file with the production inner-tunnel file, sites-available/inner-tunnel: in the authorize section this was commented, but then I removed the comment and enabled it. eap { ok = return } Then in the authenticate section, I added mschap again before the eap. authenticate { Auth-Type MS-CHAP { mschap } mschap eap } } This modification worked. Thank you.