March 2017 - Freeradius-Users - lists.freeradius.org

Active Directory and Calling-Station-Id
by Ethariel 13 Jun '17

13 Jun '17

Hello, I'm running Freeradius : freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 I've configurated Active Directory integration, and it's working fine for authentication. Local users in users file are also ok. In the local users file I can specify a calling station id like : customer Cleartext-Password := "password",Calling-Station-Id == "AA-AA-AA-AA-AA-AA" How can I use a local file (or sql table) to link a user authenticated in Active Directory with one or several calling-station-id ? If possible I'd really prefer not to use the ActiveDirectory to store the Mac addresses. The goal is to limit each login to a few devices (I know it's possible to mask mac address, this is not the point here). I've tried to insert in the users file : customer2 Calling-Station-Id := "BB-BB-BB-BB-BB-BB" but with correct password customer2 is always authenticated using the BB-....-BB mac adress or not. Thks a lot for any help, Ethariel

2 4

another crash on 3.0.x
by Stefan Winter 19 May '17

19 May '17

Hi, with that newest 3.0.x from today, I just got a crash (after some 15 min of normal operation, so nothing about stale EAP sessions this time). The directory in question exists (/var/log/radius/tlscache-eduroam-users/) but possibly there's simply no stored session if it's a fresh auth. I (again) don't have an easy way to get a full backtrace as this is happening on a live system, but maybe the below gives a hint already. Greetings, Stefan Winter Tue Mar 28 09:56:08 2017 : Info: rlm_sql (sql-null-acct-erx): Opening additional connection (3), 1 of 97 pending slots used Tue Mar 28 09:56:11 2017 : Info: (12277) eap_peap: This means you need to read the PREVIOUS messages in the debug output Tue Mar 28 09:56:11 2017 : Info: (12277) eap_peap: to find out the reason why the user was rejected Tue Mar 28 09:56:11 2017 : Info: (12277) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Tue Mar 28 09:56:11 2017 : Info: (12277) eap_peap: what went wrong, and how to fix the problem Tue Mar 28 09:56:11 2017 : Error: Couldn't open /var/log/radius/tlscache-eduroam-users/acd33e166c8284cf667a3990565aac2efa85f6ea8c0f813fba87448829b947e5.vps for reading: No such file or directory CAUGHT SIGNAL: Segmentation fault Backtrace of last 29 frames: /usr/local/freeradius/3.0.x-20170328/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f9a7c155461] /lib64/libpthread.so.0(+0xf370)[0x7f9a7aa27370] /lib64/libssl.so.10(+0x47c92)[0x7f9a7b929c92] /lib64/libssl.so.10(SSL_CTX_add_session+0xe7)[0x7f9a7b92aaf7] /lib64/libssl.so.10(ssl_get_prev_session+0x40c)[0x7f9a7b92afcc] /lib64/libssl.so.10(ssl3_get_client_hello+0x227)[0x7f9a7b8ffbd7] /lib64/libssl.so.10(ssl3_accept+0x95d)[0x7f9a7b90481d] /lib64/libssl.so.10(ssl23_accept+0x1c8)[0x7f9a7b912508] /lib64/libssl.so.10(ssl23_read+0x32)[0x7f9a7b9136a2] /usr/local/freeradius/current/sbin/radiusd(tls_handshake_recv+0x110)[0x45058c] /usr/local/freeradius/3.0.x-20170328/lib/libfreeradius-eap.so(+0x6c51)[0x7f9a7bf40c51] /usr/local/freeradius/3.0.x-20170328/lib/libfreeradius-eap.so(eaptls_process+0x3aa)[0x7f9a7bf410b2] /usr/local/freeradius/3.0.x-20170328/lib/rlm_eap_peap.so(+0x1f9c)[0x7f9a75c80f9c] /usr/local/freeradius/3.0.x-20170328/lib/rlm_eap.so(+0x40f5)[0x7f9a76ab70f5] /usr/local/freeradius/3.0.x-20170328/lib/rlm_eap.so(eap_method_select+0x431)[0x7f9a76ab7add] /usr/local/freeradius/3.0.x-20170328/lib/rlm_eap.so(+0x2d01)[0x7f9a76ab5d01] /usr/local/freeradius/current/sbin/radiusd[0x428d3c] /usr/local/freeradius/current/sbin/radiusd[0x4293e9] /usr/local/freeradius/current/sbin/radiusd[0x428efd] /usr/local/freeradius/current/sbin/radiusd[0x429e1d] /usr/local/freeradius/current/sbin/radiusd(modcall+0xa2)[0x42ab62] /usr/local/freeradius/current/sbin/radiusd(indexed_modcall+0x363)[0x426374] /usr/local/freeradius/current/sbin/radiusd(process_authenticate+0x22)[0x428639] /usr/local/freeradius/current/sbin/radiusd[0x40f7ed] /usr/local/freeradius/current/sbin/radiusd(rad_authenticate+0x51e)[0x410118] /usr/local/freeradius/current/sbin/radiusd[0x43d74c] /usr/local/freeradius/current/sbin/radiusd[0x439382] /lib64/libpthread.so.0(+0x7dc5)[0x7f9a7aa1fdc5] /lib64/libc.so.6(clone+0x6d)[0x7f9a7a51773d] Calling: gdb -silent -x /usr/local/freeradius/config/raddb/panic.gdb /usr/local/freeradius/current/sbin/radiusd 18297 2>&1 | tee /var/log/radius/gdb-radiusd-18297.log Tue Mar 28 09:56:14 2017 : Info: Need 1 more connections to reach 5 spares Tue Mar 28 09:56:14 2017 : Info: rlm_sql (sql-null-acct-erx): Opening additional connection (4), 1 of 96 pending slots used Panic action exited with 0 _EXIT(0) CALLED src/lib/debug.c[743] Tue Mar 28 10:15:49 2017 : Error: Cannot update core dump limit: Operation not permitted Tue Mar 28 10:15:49 2017 : Info: Core dumps are enabled Tue Mar 28 10:15:49 2017 : Info: Debugger not attached -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 4

linelog best practice
by cedric delaunay 17 May '17

17 May '17

Hello all, I'm trying to log accounting and requests into our elasticsearch/graylog logserver. I use home made linelog modules to rewrite logs into json format. modules are called in authorize, accounting, post-auth, Post-Auth-Type REJECT, preproxy and post-proxy sections here is an exemple of my module : linelog linelog_postauth { format = "%t linelog_postauth \%Packet-Type non reconnu for %{User-Name} (%{Packet-Type})" filename = ${logdir}/linelog_json permissions = 0600 reference = "messages.%{%{reply:Packet-Type}:-format}" messages { Access-Reject = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\"}" Access-Challenge = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-Protocol\":\"%{Framed-Protocol}\",\"Framed-IP-Address\":\"%{Framed-IP-Address}\",\"Framed-IP-Netmask\":\"%{Framed-IP-Netmask}\",\"Framed-Routing\":\"%{Framed-Routing}\",\"Filter-Id\":\"%{Filter-Id}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"Framed-Compression\":\"%{Framed-Compression}\",\"Login-IP-Host\":\"%{Login-IP-Host}\",\"Login-Service\":\"%{Login-Service}\",\"Login-TCP-Port\":\"%{Login-TCP-Port}\",\"Reply-Message\":\"%{Reply-Message}\",\"Callback-Number\":\"%{Callback-Number}\",\"Callback-Id\":\"%{Callback-Id}\",\"Framed-Route\":\"%{Framed-Route}\",\"Framed-IPX-Network\":\"%{Framed-IPX-Network}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\"}" Access-Accept = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"Login-IP-Host\":\"%{Login-IP-Host}\",\"Login-Service\":\"%{Login-Service}\",\"Login-TCP-Port\":\"%{Login-TCP-Port}\",\"Reply-Message\":\"%{Reply-Message}\",\"Callback-Number\":\"%{Callback-Number}\",\"Callback-Id\":\"%{Callback-Id}\",\"Framed-Route\":\"%{Framed-Route}\",\"Framed-IPX-Network\":\"%{Framed-IPX-Network}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\",\"VLAN\":\"%{Tunnel-Private-Group-ID:0}\"}" } } the goal is to keep info about login attempts and failure and why. when we run radius in debug mode we can see failure reason as next example : ..... (17) authenticate { (17) eap : Expiring EAP session with state 0x2ee654852ee14efb (17) eap : Finished EAP session with state 0x2ee654852ee14efb (17) eap : Previous EAP request found for state 0x2ee654852ee14efb, released from the list (17) eap : Peer sent method MSCHAPv2 (26) (17) eap : EAP MSCHAPv2 (26) (17) eap : Calling eap_mschapv2 to process EAP data (17) eap_mschapv2 : # Executing group from file /etc/raddb//sites-enabled/eduroam-inner-tunnel (17) eap_mschapv2 : Auth-Type MS-CHAP { (17) mschap : Found LM-Password (17) WARNING: mschap : No Cleartext-Password configured. Cannot create LM-Password (17) mschap : Found NT-Password (17) WARNING: mschap : No Cleartext-Password configured. Cannot create NT-Password (17) mschap : Creating challenge hash with username: cdelauna(a)univ-rennes1.fr (17) mschap : Client is using MS-CHAPv2 (17) ERROR: mschap : MS-CHAP2-Response is incorrect (17) [mschap] = reject (17) } # Auth-Type MS-CHAP = reject (17) eap : Freeing handler (17) [eap] = reject (17) } # authenticate = reject ..... I can't find reject reason (mscahp result, ...) in access-reject variables. I had a look into mailist's archives without success ;( Do anybody can help me to find the best way doing this ? Thanks a lot -- Cédric Delaunay Direction des Systèmes d'Informations Equipe Réseau & Telephonie 263, Avenue du Général Leclerc Tel: 02 23 23 71 59 CS 74205 - 35042 Rennes Cedex Pour toute demande utiliser l'aide et assistance via l'ENT à l'adresse http://ent.univ-rennes1.fr

7 19

Help for buy a real Cert (not self-signed)
by Spider s 04 May '17

04 May '17

Hello, I have got a few questions about radius and buy an original Certificate. Firsts thank you for the help here, but I can’t find an option for search on all post, is this possible ?? only find this: For example only can find post from this mount http://lists.freeradius.org/pipermail/freeradius-users/2017-January/thread.… Is for don’t disturb with my questions is are answered, sorry. And now my questions, first I have got running my freeradius installation 3.10 on ubuntu) with AD Auth, but with limitations, because I need install my self-signed cert on all device for connect to wifi. I don’t want this (I don’t want install the certs), and I need buy a real cert for a real CA, I know ,but I never buy one for this. (I never buy a certfor radius, web or similar) I need buy a real cert, where I can buy ?? recommendations webs?? And witch type ?? I see a lot of certs, and I don’t know the certification specification.( a lot of prices and options) Please a direct links if possible to correct cert. I never buy an original cert and I don’t know process. When I receive the certificates is like certs on the folder?? Need change data??? How can use this certs on my radius install?? Are 3, 5, 20 files ???? where i can find info about this ?? (On docs i reffer) Need a domain for this ?? can i use the cert from a Web (typical ssl cert that is used for web?? I see a lot of info on internet for use self-signed cert, but I can’t find info on documentations or on my Ubuntu install when use real certs. (Is very possible I don’t find) Thank you for your time when you read me, and sorry if a newbie questions. Thank you in advanced, i dont want confuse with this and spend money with this.

6 15

EAP TLS against multiple certificates?
by David Hartburn 03 May '17

03 May '17

Hi, Is it possible to check EAP-TLS against multiple certificate chains, or bundle two chains together into the same pem file? We have a potential problem where all our certificate auth laptops have been using SHA1 for quite some time. Recently we upgraded our certificate authority to SHA256, so any laptops that request a new cert will get a SHA256. If I put a SHA256 root chain certificate in the EAP-TLS config then a SHA256 client can authenticate, but naturally SHA1 can not. If I leave the SHA1 root chain on the server, then the newer SHA256 clients can not authenticate. I am worried that one day I will come in to find half the clients have renewed to a SHA256 and can no longer auth. Is there anything I can do to allow both certificate types to authenticate during this transition period? In terms of config, in mods-enabled/eap, I have tls-config loanlaptops { private_key_file = ${confdir}/certs/loan_laptop_server.pem certificate_file = ${confdir}/certs/loan_laptop_server.pem ca_file = ${confdir}/certs/unikentrootCAchain.pem ...... } tls { # Point to the Loan Laptops TLS configuration tls = loanlaptops virtual_server = check-eap-tls } Yours Dave Hartburn

2 5

freeradius with sqlite3 solving database lock issue
by Antonio Silva 10 Apr '17

10 Apr '17

Hi, What are the best options to configure sqlite3 sql with freeradius? i'm having some lock errors followed by "ERROR: Hit reconnection limit" I tried to set the pool to only 1 server, since its a file db, but them i got the error "max connections2 when connecting two users at the same time. Right now i use: .... thread pool { start_servers = 5 max_servers = 25 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 1024 auto_limit_acct = yes } sql { driver = "rlm_sql_sqlite" sqlite { filename = "radius.db" busy_timeout = 200 } dialect = "sqlite" delete_stale_sessions = yes pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } ... The errors are: Feb 12 17:41:08 PC radiusd[18187]: (2038) Login OK: [402(a)cm.com/<CHAP-Password>] (from client nas01 port 17 cli 30-10-E4-66-1A-CF) Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: Error fetching row Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: rlm_sql_sqlite: database is locked Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: SQL query failed: server error Feb 12 17:41:58 PC radiusd[18187]: (2041) Login OK: [402(a)cm.com/<CHAP-Password>] (from client nas01 port 14 cli F4-37-B7-E0-66-DF) Feb 12 17:41:59 PC radiusd[18187]: (2042) sql: ERROR: Error fetching row Feb 12 17:41:59 PC radiusd[18187]: (2042) sql: ERROR: rlm_sql_sqlite: database is locked ... Feb 12 17:56:39 PC radiusd[18187]: (2125) sql: ERROR: Hit reconnection limit You can check the entire log in http://pastebin.com/fXuZVU93 Thanks, -- Saludos / Regards / Cumprimentos, António silva

2 9

Help request: LDAP syntax authorization
by Aaron Dalla-Longa 03 Apr '17

03 Apr '17

Freeradius version 3 Is it possible to deny a user based on an attribute that LDAP sends through, and if so, what is the syntax for it? Alternatively, if there is a well-put together guide on Freeradius LDAP syntax, could you link it to me? Something that I would be looking for would be something like the pseudo-code below: if (user_attribute "delinquency" == "no") { accept { else { reject } Our LDAP directory is a list of library patrons, and I would want the LDAP module to reject based on one or other attributes. -- *Aaron Dalla-Longa* Systems Administrator Shortgrass Library System tf: 1.866.529.0550 | p: 403.529.0550

2 3

User authentication for remote NAS'?
by wefwe fewfew 03 Apr '17

03 Apr '17

Hi, I'm completely new to Freeradius and mysql and have been playing around with it for the past couple of weeks. A lot of fun but also a bit frustrating at times. So far I've managed to get Freeradius and mysql working. I can even authenticate users and send back attributes to them to limit time online, link speed etc. This part I've got working. However one thing I'm totally unable to figure out is how I can base authentication on which NAS a user is trying to log in from. I've been reading the mailing lists, googling, and there are people with similar questions but I've yet to find an answer. Hopefully somebody can give me some pointers :) Goal: Have multiple NAS' in remote locations authenticate with a central Freeradius server. The NAS' will be in remote locations, I won't always know the IP and in some cases they will be using the same IP as they are behind a private network. Setting up radius proxies at the remote locations is not an option. I was thinking about using the NAS-ID or called-station-id to authenticate instead. The NAS-ID is in the rad_recv request so I'm figuring somehow it must be possible to use that? My non-programmer-way-of-thinking Freeradius receives request from NAS NAS request includes NAS-ID Freeradius somehow checks if NAS-ID is present in mysql table If not present -> Reject request If present -> check usergroup that corresponds with the NAS-ID and authenticate against the users in that group. Very simple minded I thought that it might be as simple as modifying the hunt group tutorial on the wiki by replacing the nas-ip with nas-id but that didn't work. After some more reading all the mailing list entries tell me the wiki is wrong and won't work. Right now I'm at a loss and don't know what to do. The mailing list is my last resort. I would like to know if A) its possible to use anything other than the IP to identify the NAS and B) How would I go about achieving that? By the way, if I ever get this working, can I write a guide and submit it to the wiki? Freeradius version 2.2.8 Freeradius -X: None as I don't think that'll answer my question at this point ;) Thanks.

4 7

FYI, I gave up on eap-tls for OS X and ios.
by John Tobin 02 Apr '17

02 Apr '17

I am currently setup with a cisco 1282 access point running wpa2 supported by free radius under suse linux [tumble weed]. I am supporting students on window 7, [I believe I have a few win-10s] and osx, will be testing ios later this week. The server is the CA, and for testing purposes I had setup a self signed cert, and was testing the client cert. I could not get it to work, went through a number of different efforts with multiple tries / multiple profiles on osx sierra, and el capitan Peap will have to do the job. that’s what is currently running. Sincerely, tob

3 6

Question on Unlang
by Olivier CALVANO 02 Apr '17

02 Apr '17

Hi i request your help for know if it's possible in unlang Actually, in policy.d/my.conf i have: if ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ /network\\.local/) && (User-Name !~ /admin\\.local/) && (User-Name !~ /wifi\\.local/) && ("%{Packet-Src-IP-Address}" == "192.168.20.1")) { update reply { <...> } } elsif ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ /network\\.local/) && (User-Name !~ /admin\\.local/) && (User-Name !~ /wifi\\.local/) && ("%{Packet-Src-IP-Address}" == "192.168.50.1")) { update reply { <...> } } i put only 3 in my sample of !~ (network,admin and wifi), but i have ~40 and i have ~30 of "elsif" it's a long file ;) i want know if it's possible in unlang to create a list: SubRealm_Exclude { network.local admin.local wifi.local } and after put in if condition : if ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ SubRealm_Exclude) && ("%{Packet-Src-IP-Address}" == "192.168.20.1")) { update reply { <...> } } elsif ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ SubRealm_Exclude) && ("%{Packet-Src-IP-Address}" == "192.168.50.1")) { update reply { <...> } } Thanks for your help regards

4 14