hello,

I am attempting to authenticate end-users via EAP-TTLS (with EAP-MD5) as the inner method.
I have noticed that the Access-Accept Message does NOT contain the right VSA attributes, nor the dynamic VLAN assignments.

Infact it would appear that the Microsoft MS-MPPE-Rec/Send Key attributes are sent back ?

Sending Access-Accept of id 6 to 172.23.35.62 port 62548
        MS-MPPE-Recv-Key = 0x57718ff5e99e08f770ee3832bd9edf5cf3f010be6f9d200e86bb9afa55ca3c45
        MS-MPPE-Send-Key = 0x946a940cd99bb88a10de103fec50b1634f14869cc8f4da3788e099d5896cf272
        EAP-Message = 0x03060004
        Message-Authenticator = 0x00000000000000000000000000000000
        User-Name = "data1"

Now what makes this really interesting if I change my client's authentication type to EAP-MD5 only the Radius Server Sends back an Access-Accept message with Vendor VSA's and the dynamic-VLAN assignments
(As per the screen capture below)

Sending Access-Accept of id 2 to 172.23.35.62 port 55033
        Tunnel-Type:0 = VLAN
        Tunnel-Medium-Type:0 = IEEE-802
        Tunnel-Private-Group-Id:0 = "4"
        EAP-Message = 0x03020004
        Message-Authenticator = 0x00000000000000000000000000000000
        User-Name = "data1"

Please advise if I have configured something incorrectly ?
As everything works correctly for EAP-MD5, but not for EAP-TTLS (with EAP-MD5 inner authentication)

Attached are the full server debug trace for both scenarios.

thanks

Amit

NOTES:
- FreeRadius 2.1.10 (installed via the "yum install freeradius") command
- Platform Fedora Linux (v14)
  2.6.35.6-45.fc14.i686

- below is an excerpt of my users file for the user "data1"

data1   Cleartext-Password := "data1"
        Tunnel-Type = VLAN,
        Tunnel-Medium-Type = IEEE-802,
        Tunnel-Private-Group-Id = 4,