Thanks, is that an option in IAS? I want to bind a radius policy to a radius client that is a Cisco concentrator. So if a request comes from the concentrator then use a particular radius policy? Does that make sense?

To lock a user to a certain VPN group the Authentication server needs to push this information into the concentratro through Class Attribute 25 (OU=group_name)

This example is with acs, but it is quite helpful.

http://www.cisco.com/en/US/tech/tk59/technologies_configuration_example09186a00800946a2.shtml

Does Class Attribute 25 (OU=group_name) point to a Windows OU?

This attribute contains the VPN Concentrator group name which the administrator wants the user to be locked into. This attribute is the Class attribute (IETF RADIUS attribute number 25), and has to be returned to the VPN Concentrator in this format:

OU=groupname;

where groupname is the name of the group on the VPN Concentrator that the user locks into. OU has to be in capital letters, and there must be a semicolon at the end.

Please rate if helps

Regards,