Hi, On 'users' file I have this entry; b2 User-Password := "b2", Calling-Station-ID =~ "(00:10:B5:7A:13:BD)", Expiration := "28 Feb 2009 23:00:00" this entry should match only if Calling-Station-Id equals to "00:10:B5:7A:13:BD". on my case, it matches always, no matter what I send as Calling-Station-ID. if I dont set Calling-Station-Id on access request, then 'files' module returns with noop, which is correct. this is a snippet of debug output, rad_recv: Access-Request packet from host 10.241.21.202 port 1538, id=67, length=68 User-Name = "b2" User-Password = "b2" NAS-Port = 212 NAS-IP-Address = 192.168.10.113 Calling-Station-Id = "asdfasdfadsf" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "b2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] expand: %{Calling-Station-Id} -> asdfasdfadsf [files] users: Matched entry b2 at line 1 ++[files] returns ok [expiration] Checking Expiration time: '28 Feb 2009 23:00:00' ++[expiration] returns ok ++[logintime] returns noop I am testing this on latest version taken from git repositories, but I tried it also on older versions down to 2.1.1, they behave the same. on version 2.0.5 I get correct behavior. Thanks,