I'm using FreeRadius (with mysql) to authenticate VPN users on a PIX. I have multiple vpngroups setup on the PIX and want to be able to assign users in the radius database to specific vpngroups on the PIX. For instance, I have a username 'bob' in radcheck (mysql). Bob can use any valid vpngroup (setup on the PIX) and then authenticate (via radius) with his 'bob' username and successfully connect. -- not exactly what I had in mind. Bob should only be able to connect to vpngroup 'usersvpn' and not 'adminsvpn'. I figured there must be an attribute to get this to work? Anyone have any success doing this with a PIX in the picture? __________________________________________ Yahoo! DSL – Something to write home about. Just $16.99/mo. or less. dsl.yahoo.com