I will definately check that out. Thank you!!!

Reading through the documentation is there a way to do it by a group?

For example, I have a group called Desktop and desktop can only access NDG A and B but not NDG C and my group Full_Access has access to A,B, and C.

Yes, you can set it up on group level,

1) On ACS go to Group Desktop.

2) Edit Group

3) Jump to Access Restriction

4) On Per Group Defined Network Access Restrictio, enable IP based access restriction.

5)On aaa-clients drop down choose your NDG ( the one your want user should have access ie NDG a , b )

6)For Port and IP address use *

7)Choose condition Permit.

Now Desktop group will ONLY have access to A, B NDG. Rest all is denied.

For admin group do not set any NAR, so that they can browse whole network.

Thanks

Again thank you very much!

Thankfully found out they needed this done before go live date.