*sigh* You cannot do what you want. Even if you send an Access-Accept, the client will most likely disconnect of its own accord, because you cannot fake a success message in the inner tunnel. Unless of course you're using some weird funky cisco client that ignores all the standards. If you really don't believe us, try it for yourself: Post-Auth { Post-Auth-Type REJECT { if("%{reply:EAP-Message}" =~ /0x04([0-9a-f]{2}).*/i){ update reply { EAP-Message := "0x03%{1}0004" } } update control { Response-Packet-Type := Access-Accept } } } Note: Modifying Repost-Packet-Type that may not be supported in future versions. -Arran On 30 Aug 2012, at 17:52, Andras Ionut <ionut.andras@gmail.com> wrote:

Hi Phil,

Sorry if this looks dump for you.

I've read your post the reason I've explicitely asked how to do this in PEAP is because in the post it says: "This only works for PAP, and does NOT work for EAP-TLS, CHAP, MSCHAP, or WIMAX authentication."

Now, I especially need to send Access-Accept for PEAP with inner EAP-MSCHAPv2, and I also I don't use MyQL to select the users. I've also tried to set Access-Accept as any other AVP from my Freeradius module, but doesn't work. (extract from log attached)

Can you please help?

Thanks in advance. Andras

On 30/08/12 15:11, Andras Ionut wrote:

...

Hi Phil,

Thanks a lot for the quick response.

I need this for PEAP with EAP protocol inside the tunnel, like EAP-MSCHAPv2.

Again, The device MUST reject the connection as EAP is not completed, but the ROUTER needs that Access-Accept, in order to be able to redirect user to portal.

Can this be done?

The technique to do this is described in the FAQ entry I linked. Did you read it?

<radius.txt>- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

On 08/30/2012 05:52 PM, Andras Ionut wrote:

Now, I especially need to send Access-Accept for PEAP with inner EAP-MSCHAPv2, and I also I don't use MyQL to select the users. I've also tried to set Access-Accept as any other AVP from my Freeradius module, but doesn't work. (extract from log attached)

You keep repeating this. It is obvious you are really desparate. But it doesn't work like that. You *CAN* force the server to send the Accept - Arran has shown you how to do that. The FAQ entry is another way to force it for *every* user. The reason the FAQ entry says "this doesn't work for EAP" is NOTHING to do with the server. With enough knowledge, you can make the server do anything you want. The problem is the EAP client. It WILL NOT STAY CONNECTED to the network. Think about it for a second: from the debug you show, you are dealing with Wi-Fi. If you force auth success, the radius server will return an accept, and the wi-fi point will forward the EAP Success to the client. But the client will not have completed a successful authentication, so it won't have any keying material. How is it going to send encrypted packets? Try it and see; do what the FAQ entry says, or what Arran has suggested, and watch what the client does when you try to override failed auth.