Cisco AnyConnect - Tunnel Group Match Criteria using Certificates (OR or AND function)

[KatoNakatomi]

Looking for confirmation if the Certificate to Connection Profile Maps criteria is based on "OR" or "AND" functions.

crypto ca certificate map CertMap_Fnct10 10
subject-name attr cn co laptop
subject-name attr cn co desktop

For example the matching criteria is looking for presence (contains) "laptop" OR "desktop" in the certificate CN in this example or is this an "AND" function for criteria matching.

[Rob Ingram · Accepted solution]

Hi,
The criteria is AND, in your example this would fail to match (assuming the certificate has either laptop or desktop value in the subject-alt name and not both). You can just define additional rule priorities on the certificate map, when a connection is made if it does not match the first entry it will move to the next until it either matches or fails.

crypto ca certificate map CertMap_Fnct10 10
 subject-name attr cn co laptop
crypto ca certificate map CertMap_Fnct10 20
 subject-name attr cn co desktop

The WebVPN configuration would map the tunnel as required

webvpn
 certificate-group-map CERT_MAP 10 TG-2
 certificate-group-map CERT_MAP 20 TG-3

HTH

[KatoNakatomi]

Thanks, we implemented the same change yesterday.

Just needed confirmation this was an AND function.