You can also configure a static filter at the group level.  Please refer to the sample configuration below.

http://www.cisco.com/en/US/partner/tech/tk59/technologies_configuration_example09186a0080094eac.shtml

Hi Todd,

I cannot access the document with my CCO. Looking at the URL its in the partner section. Perhaps you can email it to me? Or is it available elsewhere?

Rgds

Scott

Hi Todd,

Thanks so much. Looks like this will do the trick. Very much appreciated!

Cheers

Scott

Hi Charles,

Thanks for that, an interesting read however I dont believe it is applicable to my situation since I dont use a Cisco RADIUS solution for AAA.

What I have is 3005's at the perimeter acting as the VPN end-pont. These end-points authenticate connections locally and do XAUTH via a RSA RADIUS server. There is a couple of ASA between the 3005s and the RADIUS servers however they dont do any AAA as such.

The document you've provided me with seems to indicate authorisation needs to be done on a Cisco device that can store the ACLs, and provides example for using ASAs. I would prefer to do it on the 3005s, if possible and leave the ASAs untouched (assume the rules on the ASA allow all traffic through, and access will be more tightly defined at the 3005).

If you have any suggestions/further documentation to support my desired setup I'm all ears.

Thanks in advance

Cheers

Scott