Hi All, I have a NAS that sends two types of Access-Requests. They are VPN login (AnyConnect or IPSec), and CLI access for the NAS. I’m trying to direct the VPN requests into the virtual server “vpn”. I would like CLI requests to be handled by realm DEFAULT, so I’m trying to catch everything that doesn’t fit that category and direct it elsewhere. Here is an example of a request: --------------------------------- Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Received Access-Request packet from host <redacted> port 1025, id=24, length=185 Tue Oct 22 07:50:46 2013 : Debug: [<thread>] User-Name = "" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] User-Password = Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-Port = 229748736 Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Called-Station-Id = “<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Calling-Station-Id = "<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-Port-Type = Virtual Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Tunnel-Client-Endpoint:0 = "<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-IP-Address = <redacted> Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Cisco-AVPair = "ip:source-ip=<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Vendor-3076-Attr-146 = 0xxxxx Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Vendor-3076-Attr-150 = 0xxxxx ---------------------------------- What I am interested to know is if my way of accomplishing this task is efficient, or if there is a better way. I’m working on porting my configs to 3.0 and am striving for efficiency and simplicity. I’ve added the two nameless attributes to /etc/raddb/dictionary ATTRIBUTE CPVN3000-Tunnel-Group-Name 146 string ATTRIBUTE CPVN3000-Client-Type 150 string I created hints for each possible value of "CPVN3000-Tunnel-Group-Name” /etc/raddb/hints DEFAULT CPVN3000-Tunnel-Group-Name == “staff”, Strip-User-Name = Yes Hint = “VPN” DEFAULT CPVN3000-Tunnel-Group-Name == “guest”, Strip-User-Name = Yes Hint = “VPN” In /etc/raddb/users… DEFAULT Hint == “VPN”, Proxy-To-Realm := “VPN_REALM” And finally, in /etc/raddb/proxy.conf Realm VPN_REALM { virtual_server = “vpn” } How does that look? Regards, Dave