1. Can we somehow limit a host to connect to only a particular port/NAS device based on data stored in LDAP attributes (or, respectively, in flat files) and reject it otherwise?
Yes. See ldap_xlat http://wiki.freeradius.org/modules/Rlm_ldap Use a query that searches for the value of NAS-IP-Address in the user object in a custom attribute. If the query expands to something other than a zero length string, the attribute exists. authorize { if ("%{ldap:<query>}" == '') { reject } }
2. Can we assign the client to a particular VLAN based on data stored in LDAP attributes (or, respectively, in flat files)?
Yes, using ldap.attrmap map an LDAP attribute to Tunnel-Private-Group-ID. You also need to return Tunnel-Type and Tunnel-Medium-Type but they can be static one you know you're assigning a VLAN. http://wiki.freeradius.org/vendor/HP#RFC-3580-(single-untagged-VLAN)-Assignm...
3. Can we configure in FreeRadius an auto email to an administrator when there is a MAC-auth failure with the associated info (time, MAC Address, NAS device, port)?
Yes, use rlm_exec in async mode and call sendmail or something similar. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team