Hi, We use dynamic clients + sql for our authentication of NAS devices. We also use rlm_raw because we cannot auth on the IP Address (because of not knowing all the dynamic IP's clients are coming from), so we auth on the Called-Station-Id value. In normal circumstances this works beautifully, but when we have a NAS that sends the Called-Station-Id value as AABBCCDDEEFF with no colon or hyphen, auth fails, because in our SQL database we store the MAC like AA-BB-CC-DD-EE-FF. I already use SQL to replace colon with hyphen, but I am struggling with if it has no delimiter at all. For this particular NAS client, there is no way to change the format of the Called-Station-Id value it is sending so I need something on the FreeRadius side. I tried using the rewrite.called_station_id module from policy.conf and whilst it does not error it doesn't rewrite the incoming Called-Station-Id to the format I require. Here is my dynamic clients file: client dymamic { ... } server dynamic_client_server { authorize { #Test to see if our required raw attribute exists if("%{raw:Called-Station-Id}"){ rewrite.called_station_id #Test to see if it is in the DB if ("%{sql: select count(*) from nas where community=REPLACE(SUBSTRING(\"%{Called-Station-Id}\",1,17),\":\",\"-\")}" == 1) { update control { ... } ok } } } } I suspect it's a problem because we are using raw:Called-Station-Id because before auth Called-Station-Id itself is not accessible. Is it possible to just have a rewrite block in the authorize section of dynamic clients so it can rewrite the raw value there? Thank you, James