USG FLEX 500 VPN Server EAP-MSChapv2 vs EAP-TLS/PEAP on Radius

Hello,

i've got some trouble setting up remote user connection with certificate instead of user/password, and i don't find much documentation about this on Zyxel networks.

I've setup VPN gateway & tunnel for remote user connection with radius authentification EAP-MSChapv2 successfully, but when i'm trying to change Windows Built-in VPN configuration to use EAP-TLS / PEAP instead of EAP-MSChapv2, connection is never establishing and timed out.

Is it a Zyxel product limitation ? I see on firewall GUI that only MSChapv2 is supported, but i'm wondering if it's also for AAA Radius auth or only USG built-in auth. I saw few doc on AP and 802.11x using EAP-TLS with NXC, but not for USG FLEX itself. (non H version)

The thing is when i switch to EAP-TLS / PEAP the auth is forwarded to my radius server, and Access-Accept is anwsered, like MSChap, but connection never establishing.

On client log i've got an 1931 error, and USG Log doesn't displaying Auth Fail message.

Picture when i'm using EAP-MSChapv2 vs PEAP/EAP-TLS VPN profiles :

On first &second picture, the radius server sent an Access-Accept packet, but USG don't display [AUTH] Recv:[AUTH] when EAP-TLS / PEAP are used.

Thanks for your replies, and every information that could be usefull.

Best Regards.