Cisco (at least the Access Server 3640) require the attribute Service-Type = Framed-User in the Access-Accept message, otherwhise the Cisco doesn't make up the line