I have a Cisco 3000 series concentrator. I am trying to distribute a pcf that has group authentication to the concentrator, and then uses radius to authenticate users. It works except that one of my remote access policies require that the user be a member of a Windows group called VPN. It is not requiring this for authentication. I want this to happen for two factor authentication. What do I need to do to make this work?