Brilliant, that is exactly what I was looking for. I use the perl module to debug all VSAs and it wasn't in the payload. (12) perl: $RAD_REQUEST_PROXY_REPLY{'Proxy-State'} = &proxy-reply:Proxy-State -> '0x3435' (12) perl: &proxy-reply:Proxy-State = $RAD_REQUEST_PROXY_REPLY{'Proxy-State'} -> '0x3435' Perl only shows the proxy-reply:Proxy-State, not Packet-Type (12) [perl] = ok (12) update control { (12) EXPAND %{proxy-reply:Packet-Type} (12) --> Access-Accept (12) MSG1 := Access-Accept (12) } # update control = noop vs (11) perl: $RAD_REQUEST_PROXY_REPLY{'Proxy-State'} = &proxy-reply:Proxy-State -> '0x313031' (11) perl: &proxy-reply:Proxy-State = $RAD_REQUEST_PROXY_REPLY{'Proxy-State'} -> '0x313031' (11) [perl] = ok (11) update control { (11) EXPAND %{proxy-reply:Packet-Type} (11) --> Access-Reject (11) MSG := Access-Reject (11) } # update control = noop Exactly what I was looking for... Many thanks :) Peter On Fri, Feb 26, 2016 at 9:39 AM, Alan DeKok <aland@deployingradius.com> wrote:

On Feb 24, 2016, at 10:35 PM, Peter Lambrechtsen <peter@crypt.co.nz> wrote:

...

I've got FR3.0.10 working happily and now I am testing some edge cases with post-proxy accepts and rejects.

When the proxy returns Reject, which VSA would I need to query to pick that up, as it doesn't seem to be in control:Auth-Type

It's not a VSA. It's %{proxy-reply:Packet-Type}

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html