Is it possible to have client shortname (from clients.conf) or any custom per-client property inside post-auth and post-proxy block? Problem: I have multiple physical locations of different "types", each location type has it's own requirement for Tunnel-Private-Group-Id. With MS NPS, I have AAA clients named location-a@location-type-x@ap1 location-a@location-type-x@ap2 location-b@location-type-x@ap1 location-c@location-type-z@ap1 location-c@location-type-z@ap2 And I build access rules logic with conditions like "rule when client name match /@location-type-x@/" and "another rule when client name match /@location-type-z@/". With FreeRADIUS I found no information about client shortname in debug_all output inside post-auth block. I can build huge ruleset of additional unlang logic like this, or maybe more simple... if (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "100" } } elsif (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "101" } } elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "100" } } elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "101" } } elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "203" } } elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "204" } } ... But in my opinion, 1) there must be a way not to duplicate client address information in both post-auth and clients.conf 2) amount of code looks stupid when scaled to tens of locations.