Configuring L2tp forwarding based on suffix?

[Garry Glendown]

I'm trying to set up l2tp forwarding based on an auth suffix ... I've
tried something like this:

DEFAULT Suffix == "#subisp#isp at domain.de"
        Cisco-Avpair := "vpdn:tunnel-type=l2tp",
        Cisco-Avpair += "vpdn:ip-addresses=10.221.1.34",
        Cisco-Avpair += "vpdn:l2tp-tunnel-password=secret"

Testing the access via radtest, I get the "expected" info AFAICT:

rad_recv: Access-Reject packet from host 10.218.212.15:1812, id=24,
length=133
        Cisco-AVPair = "vpdn:tunnel-type=l2tp"
        Cisco-AVPair = "vpdn:ip-addresses=10.221.1.34"
        Cisco-AVPair = "vpdn:l2tp-tunnel-password=secret"

just the "reject" seems to point towards something that's still missing
... what is it??? Loggfile also still says the auth is unsuccessful:

Tue Aug 28 22:33:14 2007 : Auth: Login incorrect:
[d9999#subisp#isp at domain.de] (from client radius port 1)

Help appreciated!

Tnx, -garry

-- 
Garry Glendown
NETHINKS GMBH - Bahnhofstraße 16 - 36037 Fulda
Phone:  +49 661 25 000 0
Fax:    +49 661 25 000 49
E-Mail: Garry Glendown at nethinks.com

Geschäftsführer: Uwe Bergmann
Vorsitzender des Aufsichtsrats: Garry Glendown
AG Fulda HRB 2546