Hi,

We have several vpn groups configured and need to restrict particular user to particular vpn group only. We created two authorization profile and add the vpn group-policy name as RADIUS attribute 25 (class) and applied those authorization profile in two different access policies in ACS. However user1 can authenticate and connect both vpn groups whenever he select any group regardless of the group that he supposed to be. When we checked in successful authentication logs (RADIUS) we could noticed that whatever the group user selects its shows as the same value (group-name) in DAP-Tunnel-group-name.

Appreciate if someone has implemented this and advise what are the missing configuration here..?

thanks