Agogon VPN marar aiki yana kirga zirga-zirga, ba madannin rubutu ba
Iyakar rashin aikin ƙofar tana lura da fakiti a kan tunel, ba madannin rubutunka ba. Raba agogon rashin aiki, zaman da kulle allo kafin ka canza ɗaya.
Agogon da ke katse zaman VPN marar aiki yana kirga fakiti, ba danna maɓalli ba. Yana lura da rashin sadarwa a kan tunel, don haka kwamfutar tafi-da-kai da ke da wasiƙa, wakilin ajiya ko abokin hira a baya ba ta taɓa zama marar aiki a gare shi ba. Wannan gaskiyar ɗaya tana bayyana duka biyu na ƙararrakin da aka saba: zaman da ke jure dogon abincin rana, da zaman da ke mutuwa a tsakiyar aiki. Yanke shawara wace agogo kake faɗa da ita kafin ka fara neman saiti.
Abin da agogon ke lura da shi da gaske
A kan Cisco ASA maɓallin shine vpn-idle-timeout, ana saita shi ƙarƙashin manufar ƙungiya ko manufar mai amfani, kuma yana auna lokacin da babu aikin sadarwa. Ma'aunin minti ne, ana gadon ƙimar da aka saba, kuma binciken yana kan masu kirga zirga-zirga a zaman, ba kan abin da tsarin aiki ya sani game da na'urorin shigarwa ba. Ƙofar ba ta da masaniya ko mutum yana kan madannin rubutu. Ta san lokacin da ta ƙarshe ga fakiti daga wannan abokin ciniki.
Agogo na biyu shine vpn-session-timeout, kuma cikakke ne. Yana farawa lokacin da aka kafa zaman kuma yana ƙarewa ko da yaya tunel yake aiki. Zaman da ke ƙarewa bayan awa ɗaya daidai na amfani mai nauyi shine wannan agogon, ba agogon rashin aiki ba, kuma babu yawan bugawa da zai tsawaita shi.
Karanta duka ƙididdiga biyu kafin ka canza ɗaya, domin suna gazawa ta hanyoyin da suke kama da juna daga kujerar mai amfani.
Agogo uku daban-daban da mutane ke kira rashin aiki
Ana kwatanta manufofi uku marasa alaƙa a matsayin agogon rashin aiki, kuma ɗaya ne kawai daga cikinsu game da shiru na cibiyar sadarwa.
| Measure | What it observes | How it fails |
|---|---|---|
| Gateway idle timeout | No packets from the client on the tunnel | Drops after a quiet period, survives background traffic |
| Gateway session timeout | Elapsed time since the session was established | Drops at a fixed interval no matter how active the tunnel is |
| Screen lock and device policy | Human presence at the device | Session stays up while the laptop sits unattended and unlocked |
Layi na uku shine abin da mutane suke so da gaske lokacin da suke cewa ya kamata VPN ya kulle idan wani ya tafi. Agogon VPN ba zai iya auna kasancewa ba. Idan buƙatar ita ce kwamfutar da ba a kula da ita ta rasa shiga, wannan yana cikin manufar kulle allo da manufar na'ura, inda za a iya tilasta shi ba tare da la'akari da zirga-zirgar baya ba.
Haɗa ukun yana haifar da buƙatu kamar katse bayan minti talatin ba bugawa, wanda babu wata ƙofar VPN da za ta iya aiwatarwa da gaskiya.
Nemo manufar da ke da wannan haɗin
Gano abokin ciniki da ka'idar kafin ka nemi saiti. Bayanan Cisco IPsec na macOS, haɗin L2TP na asali da Cisco Secure Client ba sa bayar da kulawa iri ɗaya, kuma hoton allo na akwatin katse-idan-ba-aiki a ɗayansu ba shaida ba ne game da sauran. Bayanan asali ba su bayar da komai da yawa sai uwar garke, asusu da sirrin da aka raba. Agogon yana zaune a kan ƙofar.
A kan ASA, karanta manufar da ta dace ga mai amfani ko ƙungiya maimakon manufar da aka saba ga kowa:
show running-config group-policy NAME | include timeout
show vpn-sessiondb detail anyconnect filter name USERFitowar cikakken bayanin zaman tana lissafa iyakokin rashin aiki da na zaman da aka yi amfani da su da gaske, tare da sauran lokaci. Wannan ita ce manufar da ta dace, har da gado, abin da wani yanki na running-config ba zai iya gaya maka ba. Kwatanta shi da ƙungiyar da kake tsammanin mai amfani yana cikinta, domin manufar mai amfani tana wuce manufar ƙungiya.
Me ya sa Mac ɗinka yake kama da an haɗa bayan minti talatin
Zirga-zirgar baya ita ce amsar da aka saba, kuma ba kuskure ba ne. Wasiƙa, daidaita hotuna, duba sabuntawa, abokin hira da ke riƙe soket a buɗe, ko shafin burauza mai web socket kowanne yana haifar da fakiti da ƙofar ke kirga a matsayin aiki. Tunel yana nan a buɗe domin ana amfani da shi da gaske, amma ba da kai ba. Duba masu kirga maimakon allo idan kana son hujja.
Hoton madubi shine zaman da ke faɗuwa yayin da kake bugawa, kuma wannan iyakar zaman ne ko canjin manufa daga mai gudanarwa, ba rashin aiki ba.
Akwai kuma tasirin gefen abokin ciniki da ya kamata a sani. Wasu abokan ciniki suna aika nasu siginar kiyaye rai ko binciken abokin tarayya da ya mutu, kuma waɗannan fakiti suna sake saita ma'aunin rashin aikin ƙofar. Shi ya sa kiyaye rai da aka ƙara don cin nasara kan iyaka yana aiki, kuma shi ya sa ba kayan aiki daidai ba ne: yana canza shaidar da agogon ke gani ba tare da canza buƙatar izini da ke bayan manufar ba.
Canza maɓallin da ya dace ba tare da karya manufarsa ba
Idan manufar ita ce a kawo ƙarshen rukunin haɗi bayan rashin aikin cibiyar sadarwa da aka amince da shi, nemi daidai haka a cikin harshen manufar, kuma riƙe matsakaicin tsawon zaman a matsayin ƙima daban kuma da gangan. Sannan gwada shi a ƙarƙashin tsarin mai gudanarwa tare da yin la'akari da aikin baya.
Idan manufar ita ce a dakatar da shiga lokacin da mutum ya bar tebur, VPN shine layin da bai dace ba don tilasta hakan.
Kada ka taɓa ƙara kiyaye rai mai haifar da zirga-zirga kawai don kiyaye zaman a raye bayan manufar da aka rubuta don kawo masa ƙarshe. Wannan yana mai da kulawa zuwa tsari, kuma ana samun sa a cikin bincike ba a cikin tikitin ba. Canza manufar, ko canza buƙatar.