Hello List, I want to Update_Control and Update_Reply for rejected users (not in my database). My Users are coming from PAP Authentication method. If the users are not in my Database, I want to give an IP from a specific Pool to this users. I did this in my default file in Post-Auth-Type REJECT session but this settings are not Working Post-Auth-Type REJECT { # log failed authentications in SQL, too. # -sql attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure # eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap update control { Pool-Name := "mkt_pool" } update reply { Mikrotik-Rate-Limit := "2M/2M" Framed-IP-Address !* ANY } } Take a Look in my DEBUG output: Ready to process requests (0) Received Access-Request Id 71 from 172.17.200.2:33183 to XXX.XXX.XXX.XXX:1812 length 148 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Port = 15729152 (0) NAS-Port-Type = Ethernet (0) User-Name = "testepppoe2" (0) Calling-Station-Id = "D8:77:8B:65:C5:B4" (0) Called-Station-Id = "CE - POP ENCOL 11" (0) NAS-Port-Id = "ether11" (0) Acct-Session-Id = "81a00200" (0) User-Password = "testeppp" (0) NAS-Identifier = "CE-ENCOL" (0) NAS-IP-Address = 172.17.200.2 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) files: users: Matched entry DEFAULT at line 167 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> testepppoe2 (0) sql: SQL-User-Name set to 'testepppoe2' rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 77 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 77 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 76 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 76 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 76 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 76 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (6), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'mpc_freeradius' on mysql.mpc.com.br via TCP/IP, server version 5.7.32-0ubuntu0.16.04.1-log, protocol version 10 rlm_sql (sql): Reserved connection (6) (0) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND N.nasname = '%{Nas-IP-Address}' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY '%{SQL-User-Name}' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '%{Nas-IP-Address}' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND M.grupocliente = 'ALL-POPS' (0) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'testepppoe2' AND M.usuario_login = BINARY 'testepppoe2' AND N.nasname = '172.17.200.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'testepppoe2' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.200.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'testepppoe2' AND M.usuario_login = BINARY 'testepppoe2' AND M.grupocliente = 'ALL-POPS' (0) sql: Executing select query: SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'testepppoe2' AND M.usuario_login = BINARY 'testepppoe2' AND N.nasname = '172.17.200.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'testepppoe2' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.200.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'testepppoe2' AND M.usuario_login = BINARY 'testepppoe2' AND M.grupocliente = 'ALL-POPS' (0) sql: WARNING: User not found in radcheck table. rlm_sql (sql): 1 of 1 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (7), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'mpc_freeradius' on mysql.mpc.com.br via TCP/IP, server version 5.7.32-0ubuntu0.16.04.1-log, protocol version 10 rlm_sql (sql): Reserved connection (7) rlm_sql (sql): Released connection (7) Need 1 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (8), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'mpc_freeradius' on mysql.mpc.com.br via TCP/IP, server version 5.7.32-0ubuntu0.16.04.1-log, protocol version 10 (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'testepppoe2' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'testepppoe2' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (6) (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> testepppoe2 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) update control { (0) Pool-Name := "mkt_pool" (0) } # update control = noop (0) update reply { (0) Mikrotik-Rate-Limit := "2M/2M" (0) Framed-IP-Address !* ANY (0) } # update reply = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [testepppoe2/testeppp] (from client ce-pop-encol port 15729152 cli D8:77:8B:65:C5:B4) (0) Delaying response for 1.000000 seconds Waking up in 0.5 seconds. Waking up in 0.4 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 71 from XXX.XXX.XXX.XXX:1812 to 172.17.200.2:33183 length 33 (0) Mikrotik-Rate-Limit := "2M/2M" Waking up in 3.9 seconds. (0) Cleaning up request packet ID 71 with timestamp +76 Ready to process requests How can I solve this? Thanks Aurélio