I have a unique situation where I would like to NAT "inbound" Post tunnel traffic on 3030 concentrators, for internal routing purposes.I've configured NAT similar to the various posted examples for "outbound", pre tunnel NAT, but NAT isn't working......

I would like to restrict certain ACS 3.3 groups\VPN Clients to only be able to connect from a specific IP subnet or address range.Is this possible? How would it be configured?