Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 398)

23-10

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring Certificate Group Matching

Be aware of the following:

• You can invoke this command multiple times as long as each invocation is unique and you do not

reference a map index more than once.

• Rules cannot be longer than 255 characters.

• You can assign multiple rules to the same group. To do that, you add the rule priority and group first.

Then you define as many criteria statements as you need for each group. When multiple rules are

assigned to the same group, a match results for the first rule that tests true.

• To match users to tunnel groups based on multiple fields in the certificate so that all the criteria must

match for the user to be assigned to a permission group, create a single rule with multiple matching

criteria. To match users to tunnel groups based on one criterion or another so that successfully

matching any of the criteria identifies the member of the group, create multiple rules.

The following example enables mapping of certificate-based ISAKMP sessions to a tunnel group based

on the content of the phase1 ISAKMP ID:

hostname(config)# tunnel-group-map enable ike-id

hostname(config)#

The following example enables mapping of certificate-based ISAKMP sessions to a tunnel group based

on the IP address of the peer:

hostname(config)# tunnel-group-map enable peer-ip

hostname(config)#

The following example enables mapping of certificate-based ISAKMP sessions based on the

organizational unit (OU) in the subject distinguished name (DN):

hostname(config)# tunnel-group-map enable ou

hostname(config)#

The following example enables mapping of certificate-based ISAKMP sessions based on established

rules:

hostname(config)# tunnel-group-map enable rules

hostname(config)#

policy Specifies the policy for deriving the tunnel group name from the certificate.

Policy can be one of the following:

ike-id—Indicates that if a tunnel-group is not determined based on a rule

lookup or taken from the ou, then the certificate-based ISAKMP sessions are

mapped to a tunnel group based on the content of the phase1 ISAKMP ID.

ou—Indicates that if a tunnel-group is not determined based on a rule lookup,

then use the value of the organizational unit (OU) in the subject distinguished

name (DN).

peer-ip—Indicates that if a tunnel-group is not determined based on a rule

lookup or taken from the ou or ike-id methods, then use the peer IP address.

rules—Indicates that the certificate-based ISAKMP sessions are mapped to a

tunnel group based on the certificate map associations configured by this

command.

rule index Optional. Refers to parameters specified by the crypto ca certificate map

command. The values are 1 to 65535.

1 2 ... 393 394 395 396 397 398 399 400 401 402 403 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 398

Komentarze do niniejszej Instrukcji