Make sure that by default, when you use EAP-MSCHAP inner methods, ACS allows authentication attempts up to the specified value you configured on the Service page inside the TLS tunnel if the initial authentication attempt fails. After the fourth failed authentication attempt inside the SSL tunnel, ACS terminates the EAP conversation, resulting in a RADIUS access-reject.
ACS supports issuing an out-of-band PAC file that allows you to generate a PAC that can be downloaded to ACS.
