Freeradius и Cisco: не работает разграничение по IP

Исходные данные: в одной сети Cisco 1841 (194.176.9.10), сервер Freeradius v.1.0.4 (194.176.9.10) и клиент 194.176.9.130. Есть пользователь New, которому разрешено входить только с хоста, на котором установлен radius-сервер. Почему получается заходить на Nas (cisco1841) по telnet с любого ip-адреса, хотя в указано Login-IP-Host = 194.176.9.10?

Настройки и логи
В логах:
Цитата:
Sat Dec 24 13:56:49 2005 : Auth: Login OK: [new/new] (from client cisco port 1 cli 194.176.9.155)
Sat Dec 24 13:56:59 2005 : Auth: Login OK: [new/new] (from client cisco port 1 cli 194.176.9.155)

Sat Dec 24 14:00:35 2005
NAS-IP-Address = 194.176.9.50
NAS-Port = 1
NAS-Port-Type = Virtual
User-Name = "new"
Calling-Station-Id = "194.176.9.155"
Acct-Status-Type = Alive
Acct-Authentic = RADIUS
Service-Type = NAS-Prompt-User
Acct-Session-Id = "000000CC"
Acct-Session-Time = 216
Acct-Delay-Time = 0
Client-IP-Address = 194.176.9.50
Acct-Unique-Session-Id = "01b52fd61965e4b1"
Timestamp = 1135422035

На Cisco
Цитата:
Aaa authentication login default radius local
Radius-server host 194.176.9.10
Radius-server key cisco1




clients.conf
Цитата:
client 127.0.0.1 {
secret = cisco1
shortname = localhost
nastype = cisco # localhost isn't usually a NAS...
}
client 194.176.9.50/32 {
secret = cisco1
shortname = cisco
nastype = cisco
}
client 194.176.9.1/32 {
secret = cisco1
shortname = cisco
}
client 192.168.1.1/32 {
secret = cisco1
shortname = cisco
nastype = cisco
}
client 196.190.5.1/32 {
secret = cisco1
shortname = cisco
nastype = cisco
}
client 194.176.5.1/32 {
secret = cisco1
shortname = cisco
nastype = cisco
}


radiusclient.conf
Цитата:
auth_order radius,local
login_tries 4
login_timeout 60
nologin /etc/nologin
issue /etc/radiusclient/issue
authserver localhost:1812
acctserver localhost:1812
servers /etc/radiusclient/servers
dictionary /etc/radiusclient/dictionary
login_radius /usr/sbin/login.radius
seqfile /var/run/radius.seq
mapfile /etc/radiusclient/port-id-map
radius_timeout 10
radius_retries 2
login_local /bin/login


servers
Цитата:
194.176.9.50 cisco1
194.176.9.10 cisco1
194.176.9.1 cisco1
192.168.1.1 cisco1
196.190.5.1 cisco1
194.176.5.1 cisco1


users
Цитата:

DEFAULT Auth-Type = Local
Fall-Through = 1
cisco-r User-Password == "cisco-r"
Service-Type = NAS-Prompt-User,
Login-Service = Telnet,
Login-IP-Host = 194.176.9.0,
Login-IP-Host = 194.176.9.100,
Login-IP-Host = 194.176.9.255,
NAS-IP-Adress = 194.176.9.50,
Login-TCP-Port = 23
user Auth-Type := Reject
Reply-Message = "Your account has been disabled."
new User-Password == "new"
Service-Type = NAS-Prompt-User,
Login-Service = Telnet ,
Prompt = No-Echo,
Login-IP-Host = 194.176.9.10,
NAS-IP-Adress = 194.176.9.50,
Login-TCP-Port = 23,