-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So you have two issues: 1) Post-Auth REJECT isn't processed in the inner tunnel 2) Authenticate->EAP does not process additional statements after EAP has rejected the user. Regarding 1: I've discussed this with Alan before. Not running Post-Auth in the inner server probably is a bug. It's certainly not intuitive behavior. But you can work around it. Regarding 2: Good news and bad news. Yes, that's normal, bug free behavior. Override the rcode for EAP not to be reject e.g. inner-eap { invalid = 1 fail = 1 reject = 1 } Bad news, I believe there's a logic error with how rcodes propagate through unlang stanzas. You may find an If or Update statement rejecting the user at a later time. I reviewed the source code with Alan a while back and he said there'd probably be a fix in a later versions. Arran - -- Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk>, Systems Administrator (AAA), Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkrF8P4ACgkQcaklux5oVKLYpACeJCKMKSri09e54jE4uxCjggmR qcwAnjrt/+ZQ+FiegumyXqmCuxvcZtWB =8emf -----END PGP SIGNATURE-----