Binding trusted CAs to an IKE Policy

You can group ca-profiles (trusted CAs) in a trusted-ca-group and or bind a specific ca-profile to an IKE policy. When a remote peer establishing a connection that matches this IKE policy, the particular ca-profile or trusted-ca-group will be used to validate the remote peer. A group of trusted CA servers can be created with the trusted-ca-group configuration statement at the [edit security pki] hierarchy level; one or multiple CA profiles can be specified. The trusted CA server is bound to the IKE policy configuration for the peer at [edit security ike policy policy certificate] hierarchy level.