Здравствуйте.
Есть настроенный EasyVPN на 2801, есть потребность аутентифицировать и авторизовать пользователей в RADIUS (freeradius).
В freeradius настроен модуль mschap, который вкупе с самбой на этом же сервере успешно справляется с задачей ааа для пользователей L2TP, однако не работает с EasyVPN ввиду того, что циска присылает пароль в чистом виде, без MS-CHAP-Challenge.

Пользователь в радиусе:
testuser  Auth-Type := MS-CHAP
        Cisco-AVPair += "ipsec:user-vpn-group=vpn-access",
        Cisco-AVPair += "ipsec:user-include-local-lan=1",
        Cisco-AVPair += "ipsec:user-save-password=0"

Дебаг радиуса:

rad_recv: Access-Request packet from host 172.16.5.17:1645, id=16, length=92
        User-Name = "testuser"
        User-Password = "testuser123"
        Calling-Station-Id = "194.26.4.75"
        NAS-Port-Type = Virtual
        NAS-Port = 1
        NAS-Port-Id = "194.26.4.74"
        NAS-IP-Address = 172.16.5.17
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
  modcall[authorize]: module "preprocess" returns ok for request 1
  modcall[authorize]: module "mschap" returns noop for request 1
    rlm_realm: No '/' in User-Name = "testuser", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "IPASS" returns noop for request 1
    rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 1
    rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "ntdomain" returns noop for request 1
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 1
    users: Matched entry testuser at line 35
  modcall[authorize]: module "files" returns ok for request 1
modcall: leaving group authorize (returns ok) for request 1
  rad_check_password:  Found Auth-Type MS-CHAP
auth: type "MS-CHAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 1
  rlm_mschap: No User-Password configured.  Cannot create LM-Password.
  rlm_mschap: No User-Password configured.  Cannot create NT-Password.
  rlm_mschap: No MS-CHAP-Challenge in the request
  modcall[authenticate]: module "mschap" returns reject for request 1
modcall: leaving group MS-CHAP (returns reject) for request 1
auth: Failed to validate the user.
Login incorrect: [testuser/testuser123] (from client c2811 port 1 cli 194.26.4.75)
Delaying request 1 for 1 seconds
Finished request 1
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 16 to 172.16.5.17 port 1645
Waking up in 2 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 15 with timestamp 45f7be04
Waking up in 2 seconds...

Так вот, как заставить работать aaa через MS-CHAP в случае c EasyVPN?