It works for me, so my guess is that something else in your configuration is setting Class to that value.
Okay, I'll bite - so what on earth might be causing that? I'm not doing any rewriting, and both the Filter-Id and the Split-Tunnel-List attributes come back as strings. I thought maybe it was getting confused on the Class since it contains an =, but changing that to an _ doesn't help. Is this perhaps coming back from the proxy server, and if so, is there a way to use my local Class attribute instead?
Well, you can use := instead of = , this overwrites any Class attribute that a proxy may have sent. See if that helps. Stefan -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche - Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg