GM, I'm a bit rusty on the NetScaler side in terms of Classic vs Advanced Policy. I tried to convert the current ns.conf with nspepi but that didn't work due to current/active bindings. I've create new Advanced Session Policies, but unable to bind due to the following error message "Classic VPN Session Policy cannot be bound if Advanced VPN Session Policy is already bound to any entity (i.e. aaa user, aaa group, vpn vserver, vpn global)"

Typically this means from what I've experienced is that you have a global Binding somewhere that is a classic policy. I'm no Netsclaer expert, but I manage at times and get around See if this will show you show system global

okay, that would be 2 VPN Virtual Server Authentication RADIUS Policy Binding. Does they count as well?

I would say yes. I ran into this a couple of weeks ago and had to switch it to advanced. All though it was ldaps, but similar. Had to go create the necessary parts for the advanced with auth parts then I went to the global section in auth section unbounded it, then set it there.

PITA, I have LDAP, DUO etc