Thanks for the interest guys,
<div><br></div><div>So by 'PAP not MSCHAP', I think I am implying PEAPv1? This is because the ACS is using LDAP as a backend database for the authentication, and LDAP does not support MSCHAP. This might be incidental to the configuration though if EAP negotiates the correct settings..</div>
<div><br></div><div>Here are my debug logs after a bit of a clean-up. There were actually two connection attempts in the original file, but they appeared to have such different content that I split it into two files for clarity. It's possible the second attempt is being denied due to 'too many attempts' so possibly the first file is the relevant one.</div>
<div><br></div><div><br></div><div>cheers,</div><div><br></div><div>B</div>