Palo Alto Networks

You may have to disable zone protection, see here https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNZMCA4. This can cause PAP to succeed, but multi-packet reqeusts like EAP-TTLS and EAP-TLS to fail.