certificate-access-policy

Function

The certificate-access-policy command references a certificate access policy to an IKE peer.

The certificate-access-policy command cancels the certificate access policy referenced by an IKE peer.

By default, the IKE peer does not reference a certificate access policy.

Format

certificate-access-policy policy-name

undo certificate-access-policy

Parameters

Parameter	Description	Value
policy-name	Indicates the name of a certificate access policy.	The certificate access policy with the specified name already exist.

Views

IKE peer view

Default Level

2: Configuration level

Usage Guidelines

Usage Scenario

On an IPSec-enabled network, the headquarters and branches authenticate each other using a certificate. After certificate verification succeeds, the headquarters and branches can establish IPSec tunnels. However, the headquarters may want to prohibit some authenticated branches from establishing IPSec tunnels with it.

To achieve this purpose, run the certificate-access-policy command to reference a certificate access policy to an IKE peer.

Prerequisites

A certificate access policy has been created by running the pki certificate access-control-policy name command.

Precautions

If both certificate-access-policy and certificate-check disable or ike certificate-check disable commands are configured, the certificate-access-policy command does not take effect.

Example

# Reference a certificate access policy to an IKE peer.

<sysname> system-view
[sysname] pki certificate access-control-policy name policy1
[sysname-pki-access-policy1] quit
[sysname] ike peer peer1
[sysname-ike-peer-peer1] certificate-access-policy policy1