the EAP type is known to the server - and this can be passed through to the inner-tunnel (you need to pass this attribute through. obviously, SOME EAP types - eg EAP-TLS dont ever touch the inner-tunnel.... alan