Hi, this looks suspiciously like a bug to me. I updated from 3.0.10 to 3.0.11 with a perfectly working and unchanged configuration. In 3.0.11, all PEAP is broken with a slightly enigmatic error message which suggests my config may be sub-par; I can't really determine what should be wrong with it. Here's -X, the end of authorize and beginning of authenticate inside inner-tunnel: (484) sql-commonauth: User found in radcheck table (484) sql-commonauth: Conditional check items matched, merging assignment check items (484) sql-commonauth: NT-Password := 0xREALLYITISTHEPASSWORDBUTIREDACTEDIT rlm_sql (sql-commonauth): Released connection (0) (484) [sql-commonauth] = ok (484) } # redundant = ok (484) [mschap] = noop (484) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (484) pap: WARNING: Auth-Type already set. Not setting to PAP (484) [pap] = noop (484) } # authorize = updated (484) Found Auth-Type = eap (484) # Executing group from file /usr/local/freeradius/config/raddb/sites-enabled/inner-tunnel (484) authenticate { (484) eap: Expiring EAP session with state 0x3a79dfac3a78c68e (484) eap: Finished EAP session with state 0x4db614dc4dbc0e2d (484) eap: Previous EAP request found for state 0x4db614dc4dbc0e2d, released from the list (484) eap: Peer sent packet with method EAP MSCHAPv2 (26) (484) eap: Calling submodule eap_mschapv2 to process data (484) eap_mschapv2: Auth-Type sub-section not found. Ignoring. (484) eap_mschapv2: # Executing group from file /usr/local/freeradius/config/raddb/sites-enabled/inner-tunnel (484) eap: Sending EAP Failure (code 4) ID 10 length 4 (484) eap: Freeing handler (484) [eap] = reject (484) } # authenticate = reject (484) Failed to authenticate the user (484) Using Post-Auth-Type Reject So... the inner-tunnel eap comes as far as realising it should call the eap_mschapv2 sub-module; but that one bails out claiming it can't find its own config? Well mods-enabled/eap has a mschapv2 EAP type configuration just fine: eap { default_eap_type = peap [...] peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } mschapv2 { } } So which sub-section would be missing here? Strange. I've rolled back with the exact same config to 3.0.10 and things started working again like a charm. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66