DEFAULT
    MyGroup := 'guests',
    Fall-Through := Yes

# Guest users
guest1 Cleartext-Password := 'password1'
# End of guest users

DEFAULT
    MyGroup := 'staff',
    Fall-Through := Yes

# Staff users
staff1 Cleartext-Password := 'kdjsfhksf'
# End of staff users

ATTRIBUTE MyGroup 3000 string

# get SSID from Called-Station-Id
rewrite_called_station_id

# check guest connecting to staff SSID and reject if so
if (&MyGroup == 'guests' && &Called-Station-SSID == 'STAFF') {
        reject
}

if (&reply:MyGroup == 'guests' && &Called-Station-SSID == 'STAFF') {

if (&reply:MyGroup == 'guests' && &Called-Station-SSID == 'STAFF') {
ERROR: Failed retrieving values required to evaluate condition