Normal roadwarrior uses the VPN ID from the cert for example. The CA roadwarrior, you can filter/mask the DN of the certificate.
C=*, ST=*, L=*, O=*, OU=*, CN=*, E=*
* means any, so you can replace the * with for example an location. This would then allow a tunnel for any user comming in with an Certificate from selected CA, and location for example being Stuttgart.
Normal roadwarrior uses the VPN ID from the cert for example. The CA roadwarrior, you can filter/mask the DN of the certificate.
C=*, ST=*, L=*, O=*, OU=*, CN=*, E=*
* means any, so you can replace the * with for example an location. This would then allow a tunnel for any user comming in with an Certificate from selected CA, and location for example being Stuttgart.
Thanks for the answer. So, i think the standard way is to use a setup with roadwarrior and the standart x509-certificate created and signed on the firewall?