ASA Certificate Maps & tunnel-group-map configuration
Hey all,
I've got a L2L VPN set up between an ASA and Router, using rsa-sig authentication. For reference, my using the layout as depicted in the "Remote Access VPN" labs in Workbook Vol I. My tunnel comes up fine, using rsa-sig and traffic between 136.1.121.0/24 (behind ASA) and 136.1.23.0/24 (behind R3) is protected.
On the ASA I've tried to test the certificate map & tunnel-group-map feature but my tunnel still comes up when I expect my entries in the certificate map will filter the peer and prevent the tunnel from coming up. Here are my related configurations.
On the ASA:
tunnel-group 136.1.123.3 type ipsec-l2l
tunnel-group 136.1.123.3 ipsec-attributes
trust-point IOSCA
tunnel-group-map enable rules
tunnel-group-map CERT-MAP 10 136.1.123.3
These are the 3 different options I have tried with the certificate map configuration, but none works:
crypto ca certificate map CERT-MAP 10
subject-name attr cn co ccie.net
crypto ca certificate map CERT-MAP 10
subject-name co ccie.net
crypto ca certificate map CERT-MAP 10
issuer-name eq IOS
Can anyone point out where in my configuration I need to look to fix the error. Am I getting the syntax wrong? How come my tunnel keeps coming up when the certificate map has entries that dont match what's in the peer's certificate.
Here are the certificates from both peers too:
From Router R3
R3#show crypto ca certif
Certificate
Status: Available
Certificate Serial Number (hex): 03
Certificate Usage: General Purpose
Issuer:
cn=IOSCA
Subject:
Name: R3.ccie.com
hostname=R3.ccie.com
Validity Date:
start date: 12:59:36 PST Nov 2 2010
end date: 12:52:18 PST Nov 12 2010
Associated Trustpoints: IOSCA
Storage: nvram:IOSCA#3.cer
CA Certificate
Status: Available
Certificate Serial Number (hex): 01
Certificate Usage: Signature
Issuer:
cn=IOSCA
Subject:
cn=IOSCA
Validity Date:
start date: 12:52:18 PST Nov 2 2010
end date: 12:52:18 PST Nov 12 2010
Associated Trustpoints: IOSCA
Storage: nvram:IOSCA#1CA.cer
R3#
From the ASA:
ASA1# sh crypto ca certif
CA Certificate
Status: Available
Certificate Serial Number: 01
Certificate Usage: Signature
Public Key Type: RSA (1024 bits)
Issuer Name:
cn=IOSCA
Subject Name:
cn=IOSCA
Validity Date:
start date: 12:52:18 PST Nov 2 2010
end date: 12:52:18 PST Nov 12 2010
Associated Trustpoints: IOSCA
Certificate
Status: Available
Certificate Serial Number: 04
Certificate Usage: General Purpose
Public Key Type: RSA (1024 bits)
Issuer Name:
cn=IOSCA
Subject Name:
hostname=ASA1.ccie.com
Validity Date:
start date: 15:59:49 PST Nov 2 2010
end date: 12:52:18 PST Nov 12 2010
Associated Trustpoints: IOSCA
Greatly appreciate the help
Wendal