ASA AnyConnect Connection Profiles with RADIUS, restrict access

[tgregorics]

Hi,

We have a working setup of ASA AnyConnect with RADIUS authentication. The RADIUS server is an NPS running on Windows.

We need to be able to restrict users to separate connection profiles (or group policies), via RADIUS and windows AD groups. I think we can do this with radius attribute 25.

My question: if a user must have access to multiple connection profiles/group policies, how can we solve it? I think, NPS would match the first network policy with the AD group membership and would return only one attribute 25.

Thank you.

[tgregorics]

Solved the problem by using DAP and LDAP authentication servers instead of RADIUS/NPS.

Although, I still would be interested in a solution for when using RADIUS authentication.