RADIUS VSA questions

When you configure RADIUS authentication you import the following VSAs into RADIUS server: ############################## VENDOR Fortinet 12356 BEGIN-VENDOR Fortinet ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string # While there is a knowledge base article on FortiNet which clearly explains how to import VSAs into RADIUS (IAS on Windows 2003) there is nothing that explains VSAs themselves and what firewall does with the attributes when it receives them. So there is a room for different interpretations of the attributes and as a result RADIUS authentication configuration problems. Fortinet-Group-Name 1 string - what group name do you specify here? The group name on firewall which relies on RADIUS authentication or RADIUS group name an authenticating user belong to? If the groups names on a FortiGate and on RADIUS are the same than you can' t go wrong but what if they are different? Fortinet-Client-IP-Address 2 ipaddr - what IP address we are talking about here? Is it IP address of interface FortiGate directly communicates to RADIUS server or it is IP address of interface FortiGate receives users authenticating requests from? Fortinet-Vdom-Name 3 string - that one seems to be obvious: we specify VDOM name where authentication takes place. Fortinet-Client-IPv6-Address 4 octets - same as the second attribute. It might become even more complicated if we take into consideration the fact that wireless access points involved into RADIUS authentication have different IP addresses on their physical and virtual interfaces. Fortinet-Interface-Name 5 string - most likely that must be interface name FortiGate receives client' s authenticating request from. Fortinet-Access-Profile 6 string. I have absolutely no idea what you would put here. One might think that if there is a policy which relies on RADIUIS authentication with above mentioned user group you would specify it here. But what if there are multiple policies which use the same authentication group? Example in " Importing FortiGate VSAs into Windows 2003 Server" (see above mentioned artickle) doesn' t use this attribute at all. Is it because this attribute is irrelevant or simply because the example in the artickle it it too old and doesn' t reflect requirements of FortiOS 4.0? Thank you for any comments. VA