It is possible with a huntgroups like: gear NAS-IP-Address > IPaddress1 , NAS-IP-Address < IPaddress2 Group == admin But I would assign admin group it's address pool and then restict access with access control lists. That should be the job for the firewall. Ivan Kalik Kalik Informatika ISP http://www.kalik.co.yu Dana 28/2/2007, "Jason Murray" <jemurray@zweck.net> piše:

Is it possible to specify a range of IP addresses in a huntgroups file?

What I am trying to accomplish is:

1) AAA authentication to our Cisco devices using radius 2) Only allow people in a specific group to access the devices 3) Reject everyone else.

I am using the following:

huntgroups: ------------------- netgear NAS-IP-Address == 172.20.120.75

users: ---------- test1@net Auth-Type := Local, User-Password == "testing", Huntgroup-Name == "netgear" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15"

DEFAULT Auth-Type := Reject, Huntgroup-Name == "netgear" Reply-Message = "Not Authorized to access this gear"

This works just fine, but we have well over 600 devices. If at all possible I would like to specify network ranges instead of individual IP addresses in the huntgroups file (similar to what I can do in the clients.conf file). Is this possible? If it is not possible in the huntgroups is there a better way to do what I want to accomplish?

Thanks in advance!

-- Jason E. Murray jemurray@zweck.net http://unixhosts.us/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html