Examine the output below:

asa(config-username)# group-lock value WEBVPN
WARNING: tunnel-group  does not exist
asa(config-username)# sh run username
username CISCO password FFTdXxgak9zQNzNG encrypted
username CISCO attributes
 group-lock value WEBVPN

Notice that a warning is given when a user is locked into a group that doesn’t exist. Although you receive the warning the command is still applied.

No idea how I overlooked this before but I used the question mark on the ASA this evening. Here is my output:

asa(config-group-webvpn)# filter ?


config-group-webvpn mode commands/options:
  none   Specify that no webtype access-list will be used
  value  Specify a valid webtype ACL name

configure mode commands/options:
  activex  ActiveX filtering
  ftp      FTP filtering
  https    HTTPS filtering
  java     Java filtering
  url      HTTP filtering

Notice that I was give help for the mode I was in, config-group-webvpn mode commands/options, as well as configure mode commands/options.  Very Interesting!