During a search, the RADIUS server handles the BaseDN and FILTER tokens in the following manner: it first performs an ordinary search, then, if this search fails, it performs a search on temporary tokens.
The ordinary search starts from the most restrictive to the most general:
FILTER_nasname
FILTER
BaseDN_nasname
BaseDN
If the ordinary search fails, the temporary search is handled in the same way:
TMP_FILTER_nasname
TMP_FILTER
TMP_BaseDN_nasname
TMP_BaseDN