Hi, Your server is configured with md5 as the default EAP type. The client NAKs that and then goes on to do PEAP. Can your clients do EAP-GTC? another confusion occurs in inner tunnel due to having 2 auth-type entries. Perhaps define a new file/users instance for the inner-tunnel with DEFAULT Auth-Type = pam defined. Pap module might then pick this up alan