Different Groups

Is there a way to set FreeRADIUS to authenticate against specific group of users for certain devices. For example, DEFAULT Auth-Type = System Fall-Through = Yes, cisco-avpair = "shell:priv-lvl=1", Service-Type = NAS-Prompt-User DEFAULT Group == router-rw cisco-avpair := "shell:priv-lvl=15" DEFAULT Group == fw-admin cisco-avpair := "shell:priv-lvl=15" Can I have the PIX to authenticate only against group fw-admin? Norman