On Sat, Jun 23, 2012 at 08:35:31AM +0800, John wrote:

With this solution, both Ip phone or other device will be marked as 'voice', right?

Yes

Can we distinguish it is a 'voice' device?  then add Cisco-AVPair = "device-traffic-class=voice" . otherwise, don't add this attribute.

I hit exactly this issue this week. It depends on what your NAS sends in the request. Annoyingly it seems that Cisco doesn't send anything useful apart from the MAC address in Calling-Station-Id (that I can find), or the username or certificate checks if you're using 802.1x rather than MAB. (In my case, at this stage, I'm less concerned about the security and would more like logging and an easy way to block a MAC address, so if the switch send device class details, or even PoE state, from LLDP or CDP, it would be much more useful, but I haven't yet found a way to get it to do that.) So you either look it up in a database, or check the MAC prefix. Something like if (Calling-Station-Id =~ /^001122/) { update reply... } As I said before -

man unlang

Cisco specifically say in their documentation that you can't check the mac address prefix if you're using Cisco phones, though, as unlike some other more useful manufacturers they use many different prefixes for their phones. That pushes you to have to use a database of some kind if you use their system (which thankfully we don't). Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>