Unfortunately, I have not. I have went to relying more on the Cisco VPN Client and traditional IPSEC methods. I would love to find a solution though.

all right thanks !

all right

i found a way to bypass defaultragroup restriction for L2TP/IPSEC client less

i use AAA local user profil to manage NAC Acl with a specific @IP/user

and a windows script

     to remove defaultgetaway mounted by the ASA so as to setup a split tunneling

     and mount route to the correct vlan

So I can redirect my users in their vlan right to thier NETWORK acl

But every users use the same preshared key

regards

Because I was unable to find a solution to this problem I opened an official TAC request through Cisco and this is the answer I received:

L2TP over IPSEC connection will not fall on any defined tunnel-group unless there is an external auth-server. With LOCAL authentication it will always fall on DefaultRAGroup. Using Local authentication, you can create different VPN group-policies and can bind it with user-attributes. But its usually a feasible option when you have users around 20-40.

This is usually carried out with External Authentication server database like AD, RADIUS.

Not that I have any reason to doubt Cisco's support, but can anybody confirm this? It seems like doing this should be a fairly simple task, but it sure doesn't seem to be working out that way.

Thanks