If you configure IAS (Internet Authentication Service) on a domain member server, you can use RADIUS authentication for the VPN users. Shrewsoft cannot pull the credentials from the active user profile, but the 3448 can authenticate against Active Directory through IAS.
It works fine on mine.
I went ahead and flagged the "Correct Answer" on this post to make it more visible and help other members of the community find solutions more easily. If you don't feel like the answer I marked was correct, feel free to come back to this post to unmark it and select another in its place with the applicable buttons. If you still need assistance, we would be more than happy to continue working with you on this - just let us know in a reply.