If the returned value always matches the same kind of format, I would suggest using a regex to extract the relevant part, so, after the call to the ldap module something like:

if (&reply:Tunnel-Private-Group-ID =~ /vlan:([0-9]+)/) { ??? update reply { ??? ??? &Tunnel-Private-Group-ID := "%{1}" ??? } }

That's looking for any digits after vlan: in the returned value - you will have to understand the possible formats of the returned data to know whether that will work.

Thank you, I try your solution and it works