Hi,

Unfortunately what you want to do cannot be done on the pix, let's say that you have

multiple vpn groups on your firewall, as soon as you apply the following command:

crypto map mymap client authentication partnerauth

where parnerauth can a radius, tacacs, tacacs+ or an ACS server:

aaa-server partnerauth protocol radius

aaa-server partnerauth (inside) host 172.18.124.196 cisco123

As soon as you use "crypto map mymap client authentication partnerauth" the authentication

is applied globally on the crytpmap, thus affecting all the vpn groups configured.

You can have multiple vpn groups running on your firewall (dynamic crypto maps) but you

need to associate them to a static crypto map ( crypto dynamic-map dynmap 10 set

transform-set myset).

You can only have 1 crypto map applied to one interface, when you apply this line:

"crypto map mymap client authentication partnerauth"

The authentication is applied to ALL the clients, we cannot separate the extended

authentication based on the vpn group or ip address.

Please rate if that helps !

Regards,

~JG