We have ASA units that have tunnel-groups that have a particular group-policy defined via
default-group-policy statement. This initial group-policy ("NOACCESS") is one that prevents any logins via the use of
vpn-simultaneous-logins 0 statement. However, upon user authentication (done via RADIUS protocol), the group-policy is somehow changed to one of a few we have defined, depending on the value of the RADIUS "Class" attribute (attribute 25) set on the user record. The "replacement" group-policy has a positive number set for the value of
vpn-simultaneous-logins which then lets the user establish up to "n" simultaneous sessions.
My question is, how is this done? (we had a VAR CCIE set this up quite a few years ago, and "it just worked" so we didn't record the nitty-gritty details at the time, but now I want to know...)