I am trying to accept and add a custom reply to a check based on NAS-Identifier and Realm, I have added this to the post-auth section of sites-enabled/default Q+++ if ("%{reply:NAS-Identifier}" =~ /VPN-/) { if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") { update reply { Reply-Message += "VPN Access Granted" } } } ++++Q This appears to evaluated correctly, however the update reply module always returns noop: Q++++ ++? if ("%{reply:NAS-Identifier}" =~ /VPN-/) expand: %{reply:NAS-Identifier} -> VPN-SITE1 ? Evaluating ("%{reply:NAS-Identifier}" =~ /VPN-/) -> TRUE ++? if ("%{reply:NAS-Identifier}" =~ /VPN-/) -> TRUE ++- entering if ("%{reply:NAS-Identifier}" =~ /VPN-/) {...} +++? if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") expand: %{reply:NAS-Identifier} -> VPN-SITE1 expand: %{reply:Realm} -> VPN-SITE1 ? Evaluating ("%{reply:NAS-Identifier}" == "%{reply:Realm}") -> TRUE +++? if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") -> TRUE +++- entering if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") {...} ++++[reply] returns noop +++- if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") returns noop ++++Q If I add a "reject" to the if, like so: Q++++ if ("%{reply:NAS-Identifier}" =~ /VPN-/) { if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") { update reply { Reply-Message += "VPN Access Granted" } reject } } ++++Q Then the debug log stil returns noop but somehow manages to update the reply: Q++++ ++? if ("%{reply:NAS-Identifier}" =~ /VPN-/) expand: %{reply:NAS-Identifier} -> VPN-SITE1 ? Evaluating ("%{reply:NAS-Identifier}" =~ /VPN-/) -> TRUE ++? if ("%{reply:NAS-Identifier}" =~ /VPN-/) -> TRUE ++- entering if ("%{reply:NAS-Identifier}" =~ /VPN-/) {...} +++? if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") expand: %{reply:NAS-Identifier} -> VPN-SITE1 expand: %{reply:Realm} -> VPN-SITE1 ? Evaluating ("%{reply:NAS-Identifier}" == "%{reply:Realm}") -> TRUE +++? if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") -> TRUE +++- entering if ("%{reply:NAS-Identifier}" == "%{reply:Realm}") {...} ++++[reply] returns noop ++++[reject] returns reject . . . Sending Access-Reject of id 25 to 192.168.4.1 port 59028 Reply-Message = "VPN Access Granted" ++++Q Can someone help me undestand what I am doing wrong? datablitz