AD Group Authentication

I need to allow only 1 group with AD to be able to login to the L3 VPN page. I am using AQ Query to do this. Unger the search filter I used sAMAccountName=%{session.logon.last.username} and then I used the Brach rule to see if the user is the member of the group. I am unable to login sucessfully. It the reports is says query with sAMAccountName failed no matching users found with filter sAMAccountName =(-1). I get this message as soon as I lauch the login page. It doesnt even show the login or password box. Please let me know what I am doing wrong here.

 

 

 

Thanks in Advance.