How to match tunnel-group with ASA 8.2 and VPN Client IPSec auth using Digital Certificates with Microsoft CA

[fernandoaguirre]

Hi,

I have configured a lab for RA VPNs with a ASA5510 software version 8.2 and VPN Client 5 using digital certificates with Microsoft CA on a Windows 2003 server. I did the configuration based on this document from Cisco website:

http://www.cisco.com/en/US/partner/products/ps6120/products_configuration_example09186a0080930f21.shtml

Now the vpn works just fine, but now I need to configure different tunnel-groups so I can provide different services to different users. The problem I have now is that I don't know how to configure it so the certificate matches the tunnel-group name. If i do a debug crypto isakmp on ASA I get this error messages:

%ASA-7-713906: IP = 165.98.139.12, Trying to find group via OU...
%ASA-3-713020: IP = 165.98.139.12, No Group found by matching OU(s) from ID payload:   Unknown
%ASA-7-713906: IP = 165.98.139.12, Trying to find group via IKE ID...
%ASA-3-713020: IP = 165.98.139.12, No Group found by matching OU(s) from ID payload:   Unknown
%ASA-7-713906: IP = 165.98.139.12, Trying to find group via IP ADDR...
%ASA-7-713906: IP = 165.98.139.12, Trying to find group via default group...
%ASA-7-713906: IP = 165.98.139.12, Connection landed on tunnel_group DefaultRAGroup

So basically when using certificates I always connect the RA VPN only with the default group DefaultRAGroup. Do I need to use a different web enrollment template for certificate request instead of the user template??? How can I define the OU on the User certificate so it matches the tunnel-group???

Please help me!!!!

Regards,

Fernando Aguirre

[Jennifer Halim · Accepted solution]

You can use the certificate group map feature to map it to a specific group.

Here is the configuration guide for your reference:

http://www.cisco.com/en/US/partner/docs/security/asa/asa82/configuration/guide/ike.html#wp1053978

And here is the command reference for "crypto ca certificate map":

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/c5.html#wp2186685

Hope that helps.

[fernandoaguirre]

Thanks, the information you sent me was very helpful. I have the tunnel group mapping working with certificates now.

[Guido Arturo Catalano]

One of the links is bronken.

I found new and very usefull info, Posted by Petr Lapukhov:

http://blog.ine.com/tag/tunnel-group/

1)The rules are configured using the command

crypto ca certificate map [] .

2) Enable the mapping rules using the command

tunnel-group-map enable rules.

3) Configure certificate map to tunnel-group mapping using the global commands

tunnel-group-map []

The rules are configured using the command crypto ca certificate map [] .

My Conf:

crypto ca certificate map CertMap 10

issuer-name attr cn co RT_CA01

subject-name co ARRT01

tunnel-group-map enable rules

tunnel-group-map CertMap 10 vpnBranches

More info on Cisco ASA 5500 Series Configuration Guide using the CLI

search for "Creating a Certificate Group Matching Rule and Policy"

[thomas.busse]

Hello and sorry to bring this old topic up again :-)

I'm aware of the certificate group map feature but in our environment we are not able to use it, as the customer wants to use the option of "group-delimiter #" to make users fall into a special tunnel-group in some circumstances.

I have heard, that you could name the tunnel-group the same as the OU-Field from the certificate to make users fall into that tunnel-group, is this correct and is there any documentation from cisco about that feature?

I'm relatively new to ASA and what I have learned is, to use certificate group map :-)

Thank you guys in advice.

Best regards,

Thomas