Hello, I did Upgrade from 2.2.9 to 3.0.15. For marketing purposes if my client is not on my base and tries to connect to my system, I permit the access in a specific pool. When I upgraded to 3, this stoped to work. Some help? Look more details..... In my default file: Auth-Type CHAP { chap { invalid = 1 } if(invalid) { update control { Pool-Name := "mkt_pool" } update reply { Mikrotik-Rate-Limit := "300K/2M 600K/2200K 450K/1500K 10/10" } ok } } My radiusd -X output: Ready to process requests (0) Received Access-Request Id 199 from 172.17.6.2:42459 to 187.120.197.145:1812 length 152 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Port = 15736495 (0) NAS-Port-Type = Ethernet (0) User-Name = "soniaregina" (0) Calling-Station-Id = "84:C9:B2:A3:BB:67" (0) Called-Station-Id = "CE - POP ITPM5" (0) NAS-Port-Id = "ether5" (0) CHAP-Challenge = 0x3cfe95eca592d11448a098b33412cd0b (0) CHAP-Password = 0x01cc08e5f2ad79880124b1d826606947b2 (0) NAS-Identifier = "CE-ITPM" (0) NAS-IP-Address = 172.17.6.2 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) chap: &control:Auth-Type := CHAP (0) [chap] = ok (0) [mschap] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> soniaregina (0) sql: SQL-User-Name set to 'soniaregina' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND N.nasname = '%{Nas-IP-Address}' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY '%{SQL-User-Name}' AND plano_id NOT IN (8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '%{Nas-IP-Address}' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND M.grupocliente = 'ALL-POPS' (0) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'soniaregina' AND M.usuario_login = BINARY 'soniaregina' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'soniaregina' AND plano_id NOT IN (8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'soniaregina' AND M.usuario_login = BINARY 'soniaregina' AND M.grupocliente = 'ALL-POPS' (0) sql: Executing select query: SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'soniaregina' AND M.usuario_login = BINARY 'soniaregina' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'soniaregina' AND plano_id NOT IN (8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'soniaregina' AND M.usuario_login = BINARY 'soniaregina' AND M.grupocliente = 'ALL-POPS' (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'soniaregina' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'soniaregina' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need 9 more connections to reach min connections (15) rlm_sql (sql): Opening additional connection (6), 1 of 58 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'mpc_freeradius' on mysql.mpc.com.br via TCP/IP, server version 5.5.55-0ubuntu0.14.04.1-log, protocol version 10 (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type CHAP { (0) chap: ERROR: &control:Cleartext-Password is required for authentication (0) [chap] = fail (0) } # Auth-Type CHAP = fail (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> soniaregina (0) sql: SQL-User-Name set to 'soniaregina' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'soniaregina', '0x01cc08e5f2ad79880124b1d826606947b2', 'Access-Reject', '2017-08-02 09:11:51') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'soniaregina', '0x01cc08e5f2ad79880124b1d826606947b2', 'Access-Reject', '2017-08-02 09:11:51') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> soniaregina (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (0) linelog: --> messages.Access-Reject (0) linelog: No such entry ".messages.Access-Reject" (0) [linelog] = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (chap: &control:Cleartext-Password is required for authentication): [soniaregina/<via Auth-Type = CHAP>] (from client ce-popitpm-rb port 15736495 cli 84:C9:B2:A3:BB:67) (0) Delaying response for 1.000000 seconds