hello
The RFC 2865 says that Reply-Message (attribute 18) MAY be sent in Access-Accept and/or Reject - it's not mandatory of course, but I noticed that ISE 2.4 will allow me to configure both scenarios - but it will only send the attribute in the Access-Accept case, and not in the Reject case. I would have thought the GUI might flag that as "not supported" or something along those lines. It's a useful attribute to flag a reason code to the client (perhaps another Radius server) - this can be something cryptic like REASON-CODE 0x01 - only the remote end will understand it.
