Thanks for the comments Alan. I can lookup clients in my nas table by NAS-IP-Address just fine, I get that bit but I can't get FR to 'cache' the reply (and therefore process the request as accepted) as it always ends up referring (keying) to the source IP address.
- Cannot add client 192.168.26.119: IP address 10.10.10.10 do not match
What I need FR to do is to see the packet as coming from the NAS-IP-Address field, in this example 10.10.10.10 so it does match the reply from the sql nas table query. The source IP of the radius packet here is 192.168.26.119 and I need FR to use 10.10.10.10 instead, in this example. I can't see how to set FR up to do this, to me this is more than just dynamic-clients setup, it more fundamental to the way FR clients works. I wondered if there was anything I could change in configure?
It's really about security. If you need random clients connecting to your server, you should be using RADIUS over TLS.
RADIUS over TLS is for my next workstream, for now I'd like to get FR working nice and simple (for the users anyway!) with NAS-IP-Address and secrets per NAS. Or is the only answer to the keying of NAS-IP-Address (which is just the original IP address of the packet before the source IP is NATted over the internet) actually TLS... Does FR see the original source IP address of the NAS as the source IP of the packet, once the TLS is unwrapped?
Because you told it to look up the client as dynamic. What else did you expect?
Thank you, that confirms a few things (longest netmask wins, just like IP routing) and I now have a plan B that I've tested and works great. Cheers very much once again, Kev/.