Gilbert,

Thank you very much. I cannot supply the crypto includes, as I have since removed the configuration to attempt to do it another way. However, I believe I can clarify sufficiently:

(0) outside interface: 71.71.71.1/30

(100) inside interface: 10.0.16.1/22

(0) DSL interface: 81.81.81.1/30

(four class C's routed to DSL)

In a traditional VPN scenario, when an employee is traveling and needs access to the inside network, I would have them VPN to 71.71.71.1 with their group name and shared secret, and their username and password. We have employees that do this, and it works great.

Now, imagine those same employees go home, and are now connected via their DSL, which resides off of the DSL interface on the firewall. When they try to VPN to 71.71.71.1, it no longer works. So, in my head, I figured I would set up another VPN group policy and set of usernames for them to connect to the DSL interface at 81.81.81.1 during those times. People obviously don't like the idea of maintaining multiple usernames and passwords for access to the same internal network however.

At this point, I can use selective DNS to make sure that if someone uses vpn.company.com to connect from the DSL subnet, they will be directed to the 81.81.81.1 IP, or anywhere else they will be directed to the 71.71.71.1 IP ... but how would I configure the group policies, etc to accept their group name, shared secret, username, and password on either interface?

Thank you again.