Hello Everyone, Further to my post late last year I'm hoping to get more help on my issue which still remains un-resolved. Is there a wild card I can use all the time with one NAS that will match on any domain while NAS2 needs to have a specific user? Let me first present the flow just in case I don't explain myself correctly: 1PPPOE User -> 2Telco LAC -> 3Telco Radius -> 4Our Radius -> 5Telco Radius -> 6Telco LAC -> 7Our LNS -> 8Our Radius 1. User initiates a PPPOE request 2. Telco LAC sees the request and forwards it to their Radius server 3. Telco Radius server proxies the request to our Radius expecting us to respond with Tunnel information to aid their LAC establish a L2TP tunnel to our LNS 4. Our radius sends the Tunnel information back to Telco Radius 5. Telco radius forwards the Tunnel information to the Telco LAC 6. Telco LAC uses that tunnel info to initiate an L2TP tunnel to our LNS 7. After the tunnel is established our LNS then forwards the PPPOE request to our Radius server for authenticating the user and get the IP information The flow above seems to be doing a double level authentication which gives me issues. The reason I have issues is because the same reply I'm sending to the Telco's LAC/Radius I'm now sending to my LNS thus creating a loop (Tunnel parameters that should not go to my LNS at all) Can anyone think of a way to remedy this? My solution might be to only respond with the Tunnel info to the Telco's LAC/Radius while I respond with the IP info to the PPPOE request from my LNS only. Any help is appreciated. (I'm currently using groups to achieve this but it does not work yet) Thank you Adrian -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, November 02, 2007 8:45 AM To: FreeRadius users mailing list Subject: Re: NAS-Group? - different replies to different NASes? Adrian wrote:
Since both requests are addressed to domain.com how can I selectively allow only certain responses to NAS A and others to NAS B?
Match on the Client-IP-Address, or on the NAS-IP-Address attribute. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html