First, thanks for the detailed and helpful reply. For reference, I was able to get this working according to desired scheme. Dropped the use of 'radiusCheckItem' and 'radiusReplyItem'. Changed to : if ( reply:Framed-Pool =~ /fast/i || reply:Framed-Pool =~ /pro/i ) { update control { Pool-Name := "test_pool" } } Added this condition to 'authorize' section of sites-enabled/default, right after ldap item. This results in assigning an IP address from "test_pool" for every user having either "fast" of "pro" set as Framed-Pool in LDAP. No further questions at this time. Amir. [IMG]<http://www.ccc.co.il> Amir Tal [IMG] System Administrator +972 39201471 [IMG] Cloud Systems Support +972 39201442 [IMG]