Alan, I have created an issue ( #529) few months ago which recently closed. But I remember some exchange and a reply from Phil Mayers about it: Link: http://freeradius.1045715.n5.nabble.com/Reply-Message-td5725173.html Phil M. wrote: On 18/02/14 10:03, [hidden email] wrote:

It works when the Access is an accept but not if it's a reject.

I believe that's a limitation of the current code: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_... It only checks and uses "use_tunneled_reply" on inner Accept. I seem to remember a discussion about changing it, but can't find the links. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html So outer.reply doesn't work for me in Post-Auth-Type REJECT ( inner-tunnel) but works in Post-Auth.