24-54
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 24 Managing Site-to-Site VPNs: The Basics
Creating or Editing VPN Topologies
Related Topics
•Understanding the GET VPN Registration Process, page 28-4
•Understanding Group Encrypted Transport (GET) VPNs, page 28-2
•Configuring GET VPN, page 28-12
Add Certificate Filter Dialog Box
Use the Add Certificate Filter dialog box to define a certificate filter for the group encryption policy for
GET VPNs. This filter, located on the key server, specifies the attributes and values used to validate
whether the group member is authorized to join the group.
Select one of the following filter types:
•dn—(Distinguished name.) Specify a comma separated list of name=value pairs in the Subject
field. For example, OU=Cisco, C=US. When you configure the Public Key Infrastructure policy, the
PKI enrollment object you select should define the same values on the Certificate Subject Name tab
(see PKI Enrollment Dialog Box—Certificate Subject Name Tab, page25-61). Using a
distinguished name can let you match multiple devices with a single filter.
•fqdn—(Fully-qualified domain name.) Specify the fully qualified domain name of a single device
(for example, router1.example.com) in the Domain Name field. When you configure the Public Key
Infrastructure policy, the PKI enrollment object you select should have the Include Device’s FQDN
option selected. Because each device has a unique name, an FQDN filter matches a single device
only.
Tip To configure certificate authorization, you must also configure a Public Key Infrastructure (PKI) policy
for the GET VPN. The PKI policy is configured on all devices in the VPN.
Navigation Path
From the Group Settings tab on the GET VPN Group Encryption page, select Certificates as the
authorization type and click the Add Row button under the Authorization Filter table, or select a filter
and click the Edit Row button. For information on opening the Group Encryption page, see Defining
GET VPN Group Encryption, page 24-51.
Security Associations Tab
Security Associations table Use the Security Associations table to define security associations for
the VPN. The columns in the table summarize the settings for an entry
and are explained in Add New or Edit Security Association Dialog Box,
page 24-55. When creating a new VPN, the Security Policy field
(explained above) is used instead of this tab, which does not appear in
the wizard.
To configure security associations:
•Click the Add button to add an entry to the table, and fill in the Add
New Security Association dialog box.
•Select an entry and click the Edit button to edit an existing entry.
•Select an entry and click the Delete button to delete it.
Table24-12 GET VPN Group Encryption Policy Page (Continued)
Element Description