IKE kan TCP 4500: duba bangarorin biyu kafin ka'idar tashar
Bangarorin biyu ne ke tattauna rufewar TCP, ba ka'idar wuta ce ke bayarwa ba. Gudanar da duba mai saurara, kamawa da matakan karɓa huɗu bisa tsari.
Tikitocin tallafi sukan zo yayin da an riga an amince da canjin wutar wuta kuma ramin har yanzu yana ƙin tashi. Wannan shi ne sakamakon da ake tsammani idan ƙarshen ɗaya ne kawai ke da fasalin: dole ne a aiwatar da rufewar TCP bisa RFC 9329 kuma a daidaita shi a ƙarshen biyu, kuma yarjejeniyar tana faruwa cikin haɗin kafin kowane zirga-zirgar da aka kare ya motsa. Buɗe tasha yana shelanta mai saurara wanda wataƙila ba ya wanzu, kuma mai saurara ba tare da daidaitaccen saitin a ɗaya gefen ba yana karɓar haɗi sannan ya yi shiru. Jerin da ke ƙasa yana sanya dubawa masu sauƙi a gaba.
San abin da zaɓin ke ƙarawa da gaske
IPsec na asali yana ɗaukar kaya ɓoyayye a matsayin ka'idar IP 50, ba tare da lambar tasha da za a yarda ba. NAT traversal yana naɗe waɗannan fakiti cikin UDP zuwa tashar 4500, wanda shi ya sa yawancin ka'idojin wutar wuta ke ambaton wannan tashar. RFC 9329 yana ƙara wakilcin rafi: fakitan IKE da IPsec duk suna tafiya cikin haɗin TCP ɗaya, yawanci zuwa tashar 4500.
Rafin ba sabis na yanar gizo ba ne. Haɗin TCP zuwa 4500 ba ya faɗin komai game da HTTP, TLS ko sauƙin wakili, kuma wakilin HTTP a hanya yawanci zai karya firam ɗin maimakon ɗaukar shi.
Bincike kafin ka taɓa wutar wuta
Ma'aunin yana sanya TCP a matsayin madadin hanyar UDP don hanyoyin sadarwar da ke watsar da hanyar UDP, ba a matsayin maye gurbinta ba. Sami gaskiya biyu daga kowane mai kaya: ainihin sunan fasalin da sigar da ke aiwatar da RFC 9329 maimakon wani nau'in mallaka. An yi amfani da lakabi kamar IPsec over TCP don ƙira marasa alaƙa, don haka nemi maganar takarda da maɓallin saitin da ke kunna shi. Ba tare da amsoshi biyu ba, kada ka ɗauka komai game da daidaituwar waya.
Tabbatar da shi a dakin gwaji inda ƙarshen biyu naka ne. Ƙofar da ke amsa TCP 4500 amma ba ta taɓa kammala IKE ba alama ce ta mai saurara ba tare da daidaitaccen rufewa a ɗaya gefen ba, kuma gano hakan a can ya fi sauƙi fiye da lokacin taga canji.
A kan mai amsawa: akwai abin da ke saurara
Fara da soket. ss -ltnp | grep 4500 yana nuna ko akwai mai saurara na TCP kuma wace tsari ya mallake shi. Rashin layi yana ƙare bincike a saitin ƙofar maimakon a hanyar sadarwa.
Idan soket ɗin yana nan, kalli musafaha maimakon yin hasashe daga gefen abokin ciniki: tcpdump -ni any 'tcp port 4500'. Kammala musafaha na matakai uku sannan shiru yana nufin an karɓi rafin kuma musayar IKE a cikinsa ta kasa, yayin da SYN ba tare da amsa ya nuna tacewa ko adireshin da ba daidai ba.
Kwatanta da hanyar UDP a cikin taga kamawa ɗaya domin kada biyun su rikice: tcpdump -ni any 'udp port 4500 or proto 50'. Zirga-zirga a kan ka'idar 50 ko tashar UDP 4500 yayin da kake tsammanin ana amfani da TCP yana nufin ƙarshen biyu ba su taɓa yarda da madadin ba. Yi kama a kan ƙofar kuma idan za ka iya, domin kamawa daga gefen abokin ciniki ba zai iya nuna abin da ƙarshen nesa ya aika ba.
Karɓa a matakai huɗu daban-daban
Dauki tashin a matsayin sakamako huɗu. Kowanne na iya kasawa saboda dalili dabam, kuma wucewa ko kasawa ɗaya yana ɓoye wanne ne, don haka tsaya a matakin farko da ya kasa kuma fara sake daga sama.
| Stage | What you check | What it proves |
|---|---|---|
| 1 | TCP connection established to 4500 | A listener exists and the path permits it |
| 2 | IKE_SA authenticated in the gateway log | Both peers agreed on the encapsulation |
| 3 | CHILD_SA installed, visible with ip xfrm state | Keys exist for the protected traffic |
| 4 | A new application exchange succeeds | The data path works, not just the control path |
Mataki na huɗu shi ne wanda ake tsallake. Zaman da ke akwai na iya ci gaba da aiki a kan ajiyayyen yanayi, don haka buɗe sabon haɗi zuwa mai karɓar bayanai a bayan ƙofar kafin ka rufe canjin. Idan mataki na biyu ya kasa yayin da na farko ya wuce, rashin jituwa yana cikin shawara ko a cikin saitin rufewa, ba a cikin wutar wuta ba.
Komawa baya, da kuɗin barin shi a kunne
Tsara sokewar kafin canjin: kashe zaɓin rufewa a ƙarshen biyu kuma tabbatar ramin ya dawo ta UDP. Ka ajiye ka'idar TCP na zagayen bita ɗaya idan ana buƙatar madadin kuma, sannan ka cire ta. Mai saurara mara amfani a 4500 fili ne ba tare da wani amfanin aiki ba.
Kula da alamar aiki da zarar ya ɗauki aiki na gaske. TCP cikin TCP yana ƙara matakan tabbatarwa waɗanda ke tsayawa kan asara ɗaya, kuma rafukan da ke raba haɗi ɗaya na iya toshe juna, don haka auna aikace-aikacen da zai yi amfani da ramin maimakon ping.
Jerin karɓa
Tabbatar da sunan fasalin da siga a ƙarshen biyu, mai saurara a kan mai amsawa, kama da ke nuna kammalalliyar musafaha, da matakai huɗu da aka rubuta da tambarin lokaci. Ƙara dalilin madadin a cikin rikodin canji domin injiniya na gaba ya san dalilin da ya sa TCP yake can. Gwada komawa baya kafin ka buƙace shi.
Idan wani mataki ya kasa, gyara wannan matakin kawai. Canza rukunin sirri ko saitunan ainihi don bin matsalar jigila yawanci yana ƙara na biyu, mara alaƙa a kan na farko.