![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_186241567.webp)
1-17
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring IPsec and ISAKMP
Configuring Certificate Group Matching for IKEv1
Note
Certificate group matching applies to IKEv1 and IKEv2 LAN-to-LAN connections only. IKEv2 remote
access connections support the pull-down group selection configured in the webvpn-attributes of the
tunnel-group and webvpn configuration mode for certificate-group-map, and so on.
To match users to tunnel groups based on these fields of the certificate, you must first create rules that
define a matching criteria, and then associate each rule with the desired tunnel group.
To create a certificate map,
use the crypto ca certificate map
command. To define a
tunnel group, use
the
tunnel-group
command.
You must also configure a certificate group matching policy, specifying to match the group from the
rules, or from the organizational unit (OU) field, or to use a default group for all certificate users. You
can use any or all of these methods.
The following sections provide more information:
•
Creating a Certificate Group Matching Rule and Policy, page 1-17
•
Using the Tunnel-group-map default-group Command, page 1-18
Creating a Certificate Group Matching Rule and Policy
To configure the policy and rules by which certificate-based ISAKMP sessions map to tunnel groups,
and to associate the certificate map entries with tunnel groups, enter the
tunnel-group-map
command
in either single or multiple context mode.
The syntax follows:
tunnel-group-map enable
{
rules | ou | ike-id | peer ip
}
tunnel-group-map
[
rule-index
]
enable
policy
Be aware of the following:
•
You can invoke this command multiple times as long as each invocation is unique and you do not
reference a map index more than once.
•
Rules cannot be longer than 255 characters.
policy
Specifies the policy for deriving the tunnel group name from the certificate.
Policy
can be one of the following:
ike-id
—Indicates that if a tunnel group is not determined based on a rule
lookup or taken from the OU, then the certificate-based ISAKMP sessions are
mapped to a tunnel group based on the content of the phase1 ISAKMP ID.
ou
—Indicates that if a tunnel-group is not determined based on a rule lookup,
then use the value of the OU in the subject distinguished name (DN).
peer-ip
—Indicates that if a tunnel group is not determined based on a rule
lookup or taken from the OU or ike-id methods, then use the peer IP address.
rules
—Indicates that the certificate-based ISAKMP sessions are mapped to a
tunnel group based on the certificate map associations configured by this
command.
rule index
(Optional) Refers to parameters specified by the
crypto ca certificate map
command. The values are 1 to 65535.
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......