Cisco Secure ACS 2.6 Returns too many RADIUS attributes

[darren.foo]

Hi all,

I'm trying to authenticate my Firewall-1 VPN users to Cisco Secure ACS 2.6. FW-1 ignores packets that have unnecessary attributes returned. I've turned off all attributes in the Interface Configuration screen but a snoop shows that the ACS box is still sending several attributes.

[wdrootz]

It is hard to say what CSNT is sending back in the way of attributes without debug (http://www.cisco.com/warp/public/480/9.html) or a sniffer trace. I think RFC 2138 addresses what is sent. If the FW1 ignores packets that have unnecessary attributes, I don't know why there is a need to turn off attributes.