Hi,

...

You can verify that, independent of EAP, but using "radtest" with the name & password of the tunneled user.

I'm testing this now, but don't see the same "Access-Accept" message in the debug output. Guess I'm still missing something.

Keep in mind that contrary to the "normal" RADIUS protocols where you just send a request and get an answer, EAP protocols are rather involved beasts, exchanging several packets between client and server before you get the final answer. Regards, Stefan