Response-Packet-Type = Do-Not-Respond
Try changing that to Tmp-String-0 := "silent"
And than add to Post-Auth-Type REJECT:
if(control:Tmp-String-0 == "silent") { update control { Response-Packet-Type := 256 } }
Ivan Kalik Kalik Informatika ISP
I can see the logic there, but the packet still exists. I can't see any evidence of this Response-Packet-Type having any notable impact at all. Fri Mar 13 12:07:30 2009 : Error: rlm_ldap: (re)connection attempt failed Fri Mar 13 12:07:30 2009 : Info: [ldap] search failed Fri Mar 13 12:07:30 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Mar 13 12:07:30 2009 : Info: +++[ldap] returns fail Fri Mar 13 12:07:30 2009 : Info: +++- entering group {...} Fri Mar 13 12:07:30 2009 : Info: ++++[control] returns fail Fri Mar 13 12:07:30 2009 : Info: +++- group returns fail Fri Mar 13 12:07:30 2009 : Info: ++- policy redundant returns fail Fri Mar 13 12:07:30 2009 : Auth: Invalid user: [fbloggs] (from client my-switch port 0 cli 10.10.10.10) Fri Mar 13 12:07:30 2009 : Info: Using Post-Auth-Type Reject Fri Mar 13 12:07:30 2009 : Info: +- entering group REJECT {...} Fri Mar 13 12:07:30 2009 : Info: ++? if (control:Tmp-String-0 == "silent") Fri Mar 13 12:07:30 2009 : Info: ? Evaluating (control:Tmp-String-0 == "silent") -> TRUE Fri Mar 13 12:07:30 2009 : Info: ++? if (control:Tmp-String-0 == "silent") -> TRUE Fri Mar 13 12:07:30 2009 : Info: ++- entering if (control:Tmp-String-0 == "silent") {...} Fri Mar 13 12:07:30 2009 : Info: +++[control] returns noop Fri Mar 13 12:07:30 2009 : Info: ++- if (control:Tmp-String-0 == "silent") returns noop Fri Mar 13 12:07:30 2009 : Info: Delaying reject of request 1 for 1 seconds Fri Mar 13 12:07:30 2009 : Debug: Going to the next request Fri Mar 13 12:07:30 2009 : Debug: Waking up in 0.9 seconds. Fri Mar 13 12:07:31 2009 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 4 to 10.20.30.40 port 32776 authorize { preprocess auth_log chap mschap files redundant { ldap group { update control { Tmp-String-0 := "silent" } } } } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject if (control:Tmp-String-0 == "silent") { update control { Response-Packet-Type := Do-Not-Respond } } } } Thanks Chris