Thank you for your answer. The problem description was that when enabling rules, all my connection attempts were mapped to the DefautRAGroup instead of its specific group.
Finally, i located my problem and here is the answer. I had the following configuration:
!
crypto ca certificate map DefaultCertificateMap 10
issuer-name attr o eq xyz.test
...
...
crypto ca certificate map GROUPTEST 100
subject-name attr ou eq grouptest
...
tunnel-group-map DefaultCertificateMap 10 DefaultRAGroup
tunnel-group-map GROUPTEST 100 GROUPTEST
With such configuration, the mapping rule DefaultCertificateMap:
- Does not contain any “OU” matching rule. It only matches the issuer-name.
- Its sequence number (10) is lower than the “grouptest” map rule (100).
- It is mapped to the default group.
Under such configuration, every client connection attempt, regardless of its certificate ou field, was bounded to the DefaultRAGroup instead of its specific tunnel-group: The DefaultCertificateMap map rule was applied first because it had a lower seq number (10) than the others. Moreover, this rule does not contain any ou matching, only the issuer name. Therefore it always mapped successfully every connection attempt to the DefaultRAGroup because all my certificates include o=xyz.test
My solution:
I added the rule subject-name attr ou eq DefaultRAGroup to the crypto ca certificate map DefaultCertificateMap. Therefore, only the client certificates with ou=DefaultRAGroup will match this map rule, allowing thereby the inspection of all subsequent map rules.
