Design question - IPSEC client with certs

[gizbri]

When using certificates with the IPSEC VPN client is there a way use different polices as you would with connection profiles ?

[Herbert Baerten]

Hi,

yes, when using certificates you can use the 'tunnel-group-map' feature to map certificates to tunnel groups (aka connection profiles) based on certain field(s) in the certificate. By default the ASA will map the connection to a tunnel-group with the same name as the OU field in the cert's subject, but you can customize this to use another field.

cfr.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/ike.html#wp1053978

hth

Herbert

[gizbri]

Thanks Herbert - That may  fit, I will take a look.

Thanks