username based resource assign-APM

What about (and someone please correct me if this will not work)...

I. Create separate network access policies - see "IPv4 LAN Address Space" in "Network Settings" - (one with only server-1's IP, one with only server-2's, one with all three).

II. Route users to the appropriate network access policy via the local user database (I use this to allow/restrict available IP networks to VPN users). In the local user database, assign the users to groups ("g1" "g2" "g3" whatever...). In APM, after a successful Radius authentication, create a step where the Local User DB is checked and which the user is directed to an access policy based on the group they're in. This could get messy in APM's visual policy editor , however.

Someone may know of a cleaner/better way to do this, but this may work or at least get you started toward a solution.

Good luck,

Alan