Alan,

I have created an issue ( #529) few months ago which recently closed.

But I remember some exchange and a reply from  Phil Mayers about it:

Link:  http://freeradius.1045715.n5.nabble.com/Reply-Message-td5725173.html



Phil M. wrote:

On 18/02/14 10:03, [hidden email] wrote:
> It works when the Access is an accept but not if it's a reject.

I believe that's a limitation of the current code:

https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_eap/types/rlm_eap_peap/peap.c#L432

It only checks and uses "use_tunneled_reply" on inner Accept.

I seem to remember a discussion about changing it, but can't find the links.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html 


So outer.reply doesn't work for me in Post-Auth-Type REJECT ( inner-tunnel) but works in Post-Auth.