Dear both Many thanks for your help. It worked now. Following Buxey's suggestion I moved the VLAN logic to the inner-tunnel and now it works perfectly :) Assign the VLANs in the inner-tunnel virtual server, in the post-auth section: post-auth { ... if (LDAP-Group == ....) { update outer.session-state { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "11" } } ... } This is there too: And double-check that the "default" virtual server, post-auth section has this in it: update { &reply: += &session-state: } RE: One simple solution is to authenticate with the correct User-Name, instead of "anonymous". I wasn't trying to authenticate as anonymous, it was Windows trying all sort of magic to get me in. Thats why before I asked about if the anonymous should worry me. Apologies for not understanding well your instructions earlier, but I got confused with what you understood by configuration. Many thanks and apologies. Matthew