Cisco ISR 4000 Family Routers Administrator Guidance
Page
41
of
66
Step2
(ca-certificate-map)# field-name match-
criteria match-value
In ca-certificate-map mode, you specify one or more
certificate fields together with their matching criteria and the
value to match.
field-name
—Specifies one of the following case-
insensitive name strings or a date:
–subject-name
–issuer-name
–unstructured-subject-name
–alt-subject-name
–name
–valid-start
–expires-on
Note Date field format is dd mm yyyy hh:mm:ss or mm dd
yyyy hh:mm:ss.
match-criteria
—Specifies one of the following
logical operators:
–eq—Equal (valid for name and date fields)
–ne—Not equal (valid for name and date fields)
–co—Contains (valid only for name fields)
–nc—Does not contain (valid only for name fields)
–lt —Less than (valid only for date fields)
–ge —Greater than or equal (valid only for date
fields)
match-value
—Specifies the name or date to test with
the logical operator assigned by match-criteria.
Step3 (ca-certificate-map)#
exit
Exits ca-certificate-map mode.
Step4 For IKEv1:
crypto isakmp profile ikev1-profile1
match certificate
label
For IKEv2:
crypto ikev2 profile ikev2-profile1
match certificate
label
Associates the certificate-based ACL defined with the crypto
pki certificate map command to the profile.
For example: To create a certificate map for IKEv1 to match four subject-name values of the peer
enter:
# conf t
(config)# crypto pki certificate map cert-map-match-all 99
(ca-certificate-map)# subject-name co cn=CC_PEER
(ca-certificate-map)# subject-name co o=ACME
(ca-certificate-map)# subject-name co ou=North America
