Hello, I'm using Freeradius for VPN and Wifi clients. Lately, I encountered a scenario wrt the NAS client IP address. Before I explain my problem to you, I'd like to give you a brief on the configuration. I'm using the dynamic_clients section, which verifies the NAS entries against the external SQL server. Post which uses rest auth for completion. We have a scenario where a Wireless access point Wifi and VPN gateway are configured at the customer site, and the network has one public IP for both NAS clients. In *the nas* table, I have two entries with the same nas name, i.e., the same client IP address but different secrets. When the Radius packet from *NAS client **1* received, it resolves to the right entry in the database and happy flow. And when the Radius packet from *NAS client 2* received it complains secret is invalid as it always picks one entry from the database. This is evident from the query pasted below for reference. I was of the opinion that secret is different, so lookup can be solved. But from the *dynamic_clients* documentation, it reads as, "*You can specify overlapping networks (127/8 and 127.0/16)*.* In that case, the smallest possible network will be used as the "best match" for the client.*" But in mycase it is overlapping IPs. I also read that some NAS clients do allow to change NAS-IP address, and some don't. At first, I thought relying on the NAS-IP address instead of Packet-Src-Ip-Address as Packet-Src-Ip-Address is same in radius auth packets from both sources. But apparently, I see the NAS IP address remains the same, and some NAS clients don't allow to change their NAS IP address. *Questions are:* *1. Is this the correct configuration (where two NAS clients under same roof)? If yes, is it a solved use case? * *2. Should I use shortname in the query where clause? Will that help? This requires configuring shortname at the NAS client? *Or *does this mean I can have only one IP per NAS client ? * *3. Any alternative approach I can look for dynamic_clients query? I do not want to skip dynamic_client auth as it efficiently blocks invalid clients. **Any reason for dynamic clients not looping all the entries matching the same IP address to compare secrets? i.e forming uniqueness with IP and secret together.* This is the current query (default from the package, as I haven't changed anything) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { update control { # # Echo the IP. &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" # # Do multiple SELECT statements to grab # the various definitions. &FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" } } Thanks, Sachin