> You don't configure FreeRADIUS to use PAP. You configure the EAP supplicant (Windows PC, iPhone, etc.) to do TTLS + PAP. > As always, reading it helps. > See? No User-Password inside of the tunnel. So you mean I should enable pap in proxy-inside-tunnel authorization section before proxy-to-realm?