I am trying to upgrade from radius 1 to radius 2 and will be using an entire set of new configuration.

Currently, I am checking an Ldap attribute "dialupaccess" to allow users to get access to vpn / network devices. Unfortunately everyone has access to everything in this scenario (Don't ask, I didn't set this up !!)

I am trying to setup a configuration where network admins have access to all devices and users have only access to cisco vpn.  I don't wanna use local user database since I already have Ldap to authorize and Kerberos to authenticate.

How do you do this in your domain currently with version 2 ?

Much appreciated

John.