Thanx for your answer, Freeradius is now able to do local authentification for this Wimax Solution, which is great. Now I'm trying to do the following ASN <---- EAP/TTLS --> Radius A (Proxy) <---- Inner CHAP Request ----> Radius A The idea would be that Radius B only do simple authentication (ie send access accept without Wimax attribute), and Radius A would add Static Wimax Attribute in the Outer Tunnel reply, using post-proxy filter attrs. 1. I've tried to apply post-proxy filter in the inner-tunnel virtual server, but it doesn't seem to have an effect. 2. When I use it in the main virtual server (default for me), It works but not as I was expected to. Extract of attrs ################################### test.fr Service-Type := Framed-User, Framed-IP-Address := 172.16.3.33, EAP-Message =* ANY, Message-Authenticator =* ANY, # MS-CHAP2-Success =* ANY, # MS-MPPE-Recv-Key =* ANY, # MS-MPPE-Send-Key =* ANY, # MS-CHAP-MPPE-Keys =* ANY, # MS-MPPE-Encryption-Policy =* ANY, # MS-MPPE-Encryption-Types =* ANY, #3GPP2 Attribute 3GPP2-Service-Option-Profile := 0x000000010104B001, # WiMAX Attribute #WiMAX-Packet-Flow-Descriptor WiMAX-Packet-Data-Flow-Id := 1, WiMAX-Service-Data-Flow-Id := 1, WiMAX-Direction := 3, WiMAX-Activation-Trigger := 4, WiMAX-Transport-Type := 1, WiMAX-Uplink-QOS-Id := 1, WiMAX-Downlink-QOS-Id := 2, #WiMAX-QoS-Descriptor 1 # WiMAX-QoS-Descriptor:= 000103010C030204030205030006060001F400 WiMAX-QoS-Id := 1, WiMAX-Schedule-Type := 2, WiMAX-Traffic-Priority := 0, WiMAX-Maximum-Sustained-Traffic-Rate := 128000, WiMAX-Media-Flow-Type := 2, #WiMAX-QoS-Descriptor 2 # WiMAX-QoS-Descriptor:= 000103020C030204030205030006060001F400 WiMAX-QoS-Id := 2, WiMAX-Schedule-Type := 2, WiMAX-Traffic-Priority := 0, WiMAX-Maximum-Sustained-Traffic-Rate := 1024000, WiMAX-Media-Flow-Type := 2 ######################################## With that configured I've got the following reply Mon Apr 6 17:39:35 2009 Packet-Type = Access-Accept Service-Type := Framed-User Framed-IP-Address := 172.16.3.33 3GPP2-Service-Option-Profile := 0x000000010104b001 WiMAX-Packet-Data-Flow-Id := 1 WiMAX-Service-Data-Flow-Id := 1 WiMAX-Direction := Bi-Directional WiMAX-Activation-Trigger := 4 WiMAX-Transport-Type := IPv4-CS WiMAX-Uplink-QOS-Id := 1 WiMAX-Downlink-QOS-Id := 2 WiMAX-QoS-Id := 1 WiMAX-Schedule-Type := Best-Effort WiMAX-Traffic-Priority := 0 WiMAX-Maximum-Sustained-Traffic-Rate := 128000 WiMAX-Media-Flow-Type := Robust-Browser WiMAX-QoS-Id := 2 WiMAX-Schedule-Type := Best-Effort WiMAX-Traffic-Priority := 0 WiMAX-Maximum-Sustained-Traffic-Rate := 1024000 WiMAX-Media-Flow-Type := Robust-Browser MS-MPPE-Recv-Key = 0x71ed589b8e837324d47495472db7da4dd6b0de3ec00989e1302fe293c667619c MS-MPPE-Send-Key = 0x8d810a02c7ba85a7a6f43a8ade921b5828306c1f8a5ae3b07a4ca087edb8add6 EAP-MSK = 0x71ed589b8e837324d47495472db7da4dd6b0de3ec00989e1302fe293c667619c8d810a02c7ba85a7a6f43a8ade921b5828306c1f8a5ae3b07a4ca087edb8add6 EAP-EMSK = 0xa79a1c166e077a2e02f60d07980c6b46c334c78f24fb084cc31050d558f0d25f469961d048daf09dbdbbd0e6acbf1219926b1c39453f583c51e4b622e9a688c6 EAP-Message = 0x03720004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00210400E0D7@test.fr" which is what I want, but in that case, the chap challenge won't be send to ASN (cause MS-CHAP2-Success is commented). If i'm enable MS-CHAP2-Success attribute, then the chap challenge is being sent, but the reply becomes Mon Apr 6 17:44:06 2009 Packet-Type = Access-Accept Service-Type := Framed-User Framed-IP-Address := 172.16.3.33 3GPP2-Service-Option-Profile := 0x000000010104b001 WiMAX-Packet-Data-Flow-Id := 1 WiMAX-Service-Data-Flow-Id := 1 WiMAX-Direction := Bi-Directional WiMAX-Activation-Trigger := 4 WiMAX-Transport-Type := IPv4-CS WiMAX-Uplink-QOS-Id := 1 WiMAX-Downlink-QOS-Id := 2 WiMAX-QoS-Id := 2 WiMAX-Schedule-Type := Best-Effort WiMAX-Traffic-Priority := 0 WiMAX-Maximum-Sustained-Traffic-Rate := 1024000 WiMAX-Media-Flow-Type := Robust-Browser MS-MPPE-Recv-Key = 0x8975a67313e522170555477b8af1736aa7d82bafcad34af2ea4a01b3284bf453 MS-MPPE-Send-Key = 0xcf575423d99ebcb96651472e306a1ef2d8740705dbe83343a97bdef699fc4f08 EAP-MSK = 0x8975a67313e522170555477b8af1736aa7d82bafcad34af2ea4a01b3284bf453cf575423d99ebcb96651472e306a1ef2d8740705dbe83343a97bdef699fc4f08 EAP-EMSK = 0xf1b5140862d8944cb3c4548b65faf80209f9d7a6432060534f63128d2554bb69abf81d0544068ce2c0c549ef620d5d217dd4857ba563709e014a4f14ad90dbbc EAP-Message = 0x03fa0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00210400E0D7@test.fr" -> In that case some of the Wimax attribute are missing (actually this is the attribute I've got twice with differents values). Do you have an idea how to explain that ? I agree that post-proxy filter might not be the good tool to do that (It should be use to filter, and I use it to add new attributes), maybe I should use policies instead ? Thanks Thomas