Eventually the Type 1 devices, specifically network switches, will be doing two different types of auth: vty access for admins only and 802.1x auth for all users! So, I can't process simply on NAS IP alone. I'm assuming there will be some diffs in the request packets sent to FR for vty, dot1x, etc. - but haven't got that far yet.
I know when I get this figured out it will be SO simple and I'll feel like even a bigger dumb-a$$ than I do already, but at least I'll be a less busy dumb-a$$! :)
Service-Type. Type 1 will be Nas-Prompt-User or Administartive-User. 2 should be Framed-User just as 802.1x but NAS-Port-Type will tell you if it is wireless. Construct unlang if statement filters using Service-Type and Ldap-Group (AD group). Ivan Kalik Kalik Informatika ISP