Hi i have a policy: if ((Tunnel-Server-Endpoint:0[0] != '172.20.10.10') && (User-Name =~ /my.realm.dsl/) && ("%{Packet-Src-IP-Address}" == "192.168.50.100")) { update reply { tunnel-Server-Endpoint:0 := '172.20.10.10' tunnel-Client-Auth-Id:0 := "LAC-172.20.10.10" tunnel-Server-Auth-Id:0 := "LNS-172.20.10.10" Tunnel-Preference !* "" Framed-MTU !* "" Cisco-AVPair !* "" MS-Primary-DNS-Server !* "" MS-Secondary-DNS-Server !* "" Framed-IP-Address !* "" Framed-IP-Netmask !* "" Service-Type !* "" Framed-Protocol !* "" Tunnel-Type := "L2TP" Tunnel-Medium-Type := "IPv4" } Actually, i delete name by name the attribute (sample Cisco-AVPair, Tunnel-Preference etc ..) it's possible to start by delete all attribute and after add the attribute that i want ? sample (not tested): if ((Tunnel-Server-Endpoint:0[0] != '172.20.10.10') && (User-Name =~ /my.realm.dsl/) && ("%{Packet-Src-IP-Address}" == "192.168.50.100")) { update reply { * !* "" tunnel-Server-Endpoint:0 := '172.20.10.10' tunnel-Client-Auth-Id:0 := "LAC-172.20.10.10" tunnel-Server-Auth-Id:0 := "LNS-172.20.10.10" Tunnel-Type := "L2TP" Tunnel-Medium-Type := "IPv4" } i don't know if : * !* "" is correct and work Thanks for your help olivier