Locking user via AAA to VPN group

[a-larkins]

Is there a way within ACS to restrict a user to a specific VPN group. I know that if authenticated the user locally on the ASA / PIX (ver 7) you can do this with a user attribute.

What I am trying to achieve here is to stop a user jumping into a different group with more rights if they get hold of the vpn client profile

[a.kiprawih]

Hi,

The following config guide is more or less similar to the feature you're looking for.

This guide is provide step-by-step configuration on how to lock VPN 3K user into their group using AAA-Radius to ensure users are locked into their respective group.

http://www.cisco.com/en/US/tech/tk59/technologies_configuration_example09186a00800946a2.shtml

Hope this helps.

Rgds,

AK