Hi,
I think the whole idea behind using digital certificates is that a certificate proves a couple of things: your identity (positive proof that you have been granted a certificate and are using it), and your "trustability".
The certificate itself contains information about you (the end user), your organization, etc. When you present the certificate to the VPN gateway, that says the user's identity is you. You're right - in a way, it does only prove that whoever has the certificate appears to be you. However, in order to use the certificate in the VPN client, you are required to enter a challenge password or PIN that "unlocks" the certificate for use each time a VPN connection is made. If someone steals your certificate, they can't use it because they don't know its password.
Now you have a two-faceted authentication scheme: Something you have (the certificate) and something only you could know (the password or PIN).
As for an organization with an existing PKI, I think you can merge the two PKI environments. Everything uses X.509v3 certificates, so all you need to do is have the VPN gateway enroll itself with the existing PKI CA. Now the gateway and users have the same trustpoint. Just make sure that the existing CA can support SCEP (simple certificate enrollment protocol) that all Cisco devices use. SCEP is a common addition to most CAs. (If you're using a Microsoft Windows 2000/2003 server CA, there is a separate or additional piece to load to add SCEP capability.)
The down side of this is that all of your existing PKI users now have valid certificates, meaning that all of them could potentially connect to the VPN gateway. You might want to allow only a subset of users VPN remote access. That's where authorization comes in. Even though a user can be authenticated (proof of identity), he/she must then be authorized (allowed access).
That can be done by configuring certificate group matching on the VPN gateway, where certain certificate fields are matched and assigned to receive specific VPN group policies. (On a Cisco VPN3K, see Configuration->User Management->Group Matching).
Otherwise, you can do authorization by the addition of a RADIUS or LDAP server. This is done in individual VPN group configurations, under the User Management->Groups->IPSec tab.
One last note - you described using RADIUS accounting, only to see "unknown" usernames in the records. To correct this, go into the VPN group configuration. Under the IPSec tab, look for "DN Field". There, you can select the certificate credential info that will become the username. Usually, the user will fill out their whole name in the "CN" field when they enroll for a certificate.
Hope this helps,
Dave Hucaby, CCIE#4594 hucaby@uky.edu
