Pretty much standard. I expect TTLS + PAP, not MSCHAPv2
Why?
I thought that default_eap_type worked that way # Loaded module rlm_eap
# Loading module "eap" from file /usr/local/freeradius-3.0.17/etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls"
Is this a normal outcome?
Yes. Plenty of clients do TTLS + MS-CHAPv2.
Does iOS prefer doing TTLS + MS-CHAPv2 over TTLS-PAP? There is no way of letting it know the preferred method without the use of a WiFi profile?
Why iOS doesn't try PAP?
Because it wasn't configured to to PAP. No amount of poking FreeRADIUS will change the configuration on the iPad. You MUST change the iPad configuration on the iPad.
I believe that this is an answer to my question before. But is it really so? Does the iPad always do TTLS+MSCHAPv2 when trying to connect to an unconfigured 802.1x network?
Having a User-Password attribute doesn't serve as a hint for the server when looking for a mutually acceptable type?
How would that work? There''s not User-Password from the client in the inner tunnel data. The server never sends a User-Password to the client.
Your are right, sorry. The client doesn't send the User-Password in the inner tunnel before deciding the inner-tunnel auth method.