Currently your vpn clients connect using tunnel group authentication , in order to activate user authentication after they pass the group authentication. For this you to either confiure an external RADIUS server or build a LOCAL user database within the pix for your vpn users and you have to instruct firewall under your tunnel group how the clients will autenticate using LOCAL database, the local database you build the users within the PIX firewall and you have to configure each user name in the database, this is found under in the system properties tab/administration/user accounts.
For example to create two users: (privilege 0 is to not allow users admin access to firewall but RA vpn will use local user database for single user vpn autentication)
username user1 password xxxxxx privilege 0
username user2 password xxxxxx privilege 0
I beliebe in 6.x code under your current crypto map you would add bellow statement
crypto map outside_map client authentication LOCAL , but if you are running 7.x above the link provided shows how is done in 7.x
read carefully the link and scritp process.
Once you create this, your vpn users will get a second authentication window when the vpn-in.
Rgds
Jorge
Jorge Rodriguez
