>Now I have NAS-Identifier attribute in group table, but it is ignored and >the user can connect from different NAS. > That's how sql groups work. If the group check doesn't match - group is ignored. User is not rejected. If you wan't to force this use unlang or hungroups (or users) file. Ivan Kalik Kalik Informatika ISP