One interesting thing I note, is that if I set the filter id to clientacl.in, the connection fails, even though the radius debug indicates an access-accept back from the server. This indicates that the MSFC is doing something with the attribute, but isn't filtering traffic.
BTW, the radius server is RSA, if that matters.