Anyone using FortiGate with RSA SecurID?

I have successfully setup our FortiGate with RSA SecureID for SSL VPN however I cannot have more then one type of SSL VPN portal (full access, web access etc). Fortinet explains that in order to have fortigate to communicate with the RSA SecurID server you must create a RADIUS connection (client) to your RSA Server. Then create a Local Group that uses RADIUS as a Remote Server. Under Remote Servers there is the ability to specify the Group in the RADIUS server but I cannot get this function to work. If I change the current value from " Any" to a specified DN all SSL authentication fails. Is there an attribute that my RSA server needs to send back to my fortigate? I know that some vendors have values that they are expecting back to perform validation. My use case is the following: If user A belongs in Group A they get the full access SSL page If user B belongs in Group B they get the web access SSL page Both users require 2 factor authentication with RSA SecurID. Help!