At some peoples' request, The problem was in the aaa authorization statement. In the old config, we had aaa authorization network default if-authenticated This worked just fine, yet was _wrong_! aaa authorization network default group radius local ... solved the problem. Thanks again all. Rob --- Checked for viruses by Transact Bermuda