IKEv2 ko L2TP/IPsec: wane profile uwar garkenka ke tafiyar da shi?
Lamba ɗaya tana ɓoye matattara biyu, nau'ikan sirri uku da kuma hali daban idan adireshin ya canza. Rarrabe matakan kafin ka kwatanta menu ɗin.
Sunayen biyu suna fitowa gefe da gefe a cikin jerin zaɓi ɗaya, wanda ke gayyatar ka zaɓi tsakanin biyu daidai. Ba su daidaita ba. L2TP shine ka'idar tunnel ba tare da sirrinta ba, kuma kariya a cikin sabis ɗin L2TP/IPsec tana zuwa daga matakin IPsec da aka naɗe a kansa. IKEv2 yana yin shawarwari kai tsaye kan haɗin IPsec kuma ba shi da matakin tunnel cikin tunnel. Sanin wane matattara uwar garkenka ke bayarwa zai ƙayyade profile ɗin, tambayoyin da abin da zai faru idan kwamfutar tafi-da-gidanka ta canza hanyar sadarwa.
Matattara biyu, lamba ɗaya a cikin abokin ciniki
L2TP yana ɗaukar zama na aya-zuwa-aya a kan UDP har zuwa tashar 1701 kuma yana barin ɓoyewa ga wanda ya naɗe shi. Haɗa shi da IPsec kuma za ka sami matakai biyu: haɗin IPsec da ke kare hanya, da zama na L2TP a ciki da ke ɗaukar firam ɗin matakin haɗin mai amfani da tabbatarwar PPP.
IKEv2 yana ƙirƙirar haɗin sarrafawa sannan haɗi ɗaya ko fiye na yara waɗanda ke kare zirga-zirga, duk a cikin iyali ɗaya na musanya a kan UDP 500 da 4500. Babu ka'idar tunnel ta ciki kuma babu shawarwarin PPP.
Tabbobi: sirri uku a kan matakai uku
A nan ne yawancin lokacin tallafi ke ɓacewa. Profile ɗin L2TP/IPsec na iya neman maɓalli da aka riga aka raba don matakin IPsec da sunan mai amfani tare da kalmar sirri don zama na PPP na ciki, kuma sassa daban-daban ne ke duba duka biyun. Maɓallin da aka raba na dukan ƙofa ne, don haka ba ya gane kowa; yana tabbatar da cewa ɗayan ɓangaren ya san sirri ne kawai.
IKEv2 yawanci yana amfani da takaddun shaida, ko EAP tare da sunan mai amfani da kalmar sirri, kuma yana iya amfani da maɓalli da aka riga aka raba. Waɗannan zaɓuɓɓukan ba sa musanya da biyun L2TP. Sake saita kalmar sirri da ke gyara shiga EAP da aka ƙi ba ya amfani da komai ga takardar shaidar abokin ciniki da ta ƙare, kuma duk sau nawa ka sake rubuta kalmar sirrin asusu ba zai gamsar da maɓallin ƙofar da ba daidai ba. Idan tambaya da ba ka tsammani ta bayyana, tambayi mai aiki wane mataki take ciki kafin ka yi hasashe.
| Question | L2TP/IPsec | IKEv2 |
|---|---|---|
| What encrypts the traffic | A wrapping IPsec association | The child association |
| Ports you must permit | UDP 500/4500 and UDP 1701 inside | UDP 500 and 4500 |
| Typical secrets | Gateway PSK plus PPP credentials | Certificate, EAP, or PSK |
| Address change | Tunnel breaks, reconnect needed | Can migrate with MOBIKE |
Abin da MOBIKE ke canzawa, da abin da ba ya canzawa
IKEv2 na iya matsar da haɗi zuwa sabon adireshi idan ɓangarorin biyu suna goyon bayan MOBIKE, wanda ke rufe yanayin kwamfutar tafi-da-gidanka ta bar Wi-Fi zuwa hotspot ɗin wayar ba tare da yayyage haɗin tsaro ba.
Ba ya kiyaye kowace manhaja da rai a cikin wannan matsayi. Gudanarwar jigilar kaya har yanzu tana canza adireshi, soket ɗin da aka ɗaure da tsohon adireshin har yanzu suna karyewa, kuma manufar da ke liƙa zirga-zirga ga wata fuska har yanzu tana iya jefa shi. Gwada jujjuyawar da kake yi da gaske, walau barin hanyar sadarwa, farkawa daga barci ko dawowa bayan dogon lokaci ba aiki, kuma ka duba manhajar maimakon lambar Connected.
Siffofin gazawa da ke raba su
Profile ɗin L2TP/IPsec da ya isa ƙofar kuma ya tsaya yakan gaza a ɗaya daga cikin tambayoyi biyu: maɓallin da aka raba ko tabbobin PPP. Maɓalli mara kyau yawanci ba ya nuna wani abu mai amfani a cikin tarihin abokin ciniki, yayin da kalmar sirri mara kyau ke haifar da ƙin tabbatarwa bayyananne, kuma wannan bambancin yana gaya maka inda za ka duba.
Profile ɗin IKEv2 yakan gaza da wuri kuma da ƙarfi idan asalin ko takardar shaidar ba daidai ba ce, domin haɗin sarrafawa ba ya taɓa kammalawa. Idan haɗin ya kammala kuma zirga-zirgar har yanzu tana gaza, matsalar ta koma ga haɗin yaro, masu zaɓen zirga-zirga ko hanya, kuma babu wani canjin tabbobi da zai taimaka.
Inda kowanne har yanzu ya dace
L2TP/IPsec yana dawwama domin yana nan a kusan kowane abokin ciniki kuma baya buƙatar ƙarin software, wanda ke da muhimmanci ga ɗan kwangila a kan na'urar da ba ka sarrafa. Farashin shi ne ƙarin mataki, tsarin sirrin da aka raba da sake haɗawa bayan kowane canjin adireshi.
IKEv2 ya fi dacewa da na'urorin da ake sarrafawa: asalin takardar shaida, motsi mai tsabta, da iyalin haɗi ɗaya don yin tunani akai. Yana kuma gaza da ƙarfi idan abokin ciniki ya tsufa, don haka duba hanyar tabbatarwa da dandamali ke goyon baya kafin ka tsara abu a kansa.
Gwada profile ɗin da aka ba ka
Da farko tabbatar da yanayin daga ɓangaren uwar garke, sannan zaɓi profile ɗin abokin ciniki da ya dace da shi. Gwada da ainihin sunan mai masauki da tabbobin da aka bayar don wannan profile, kuma tabbatar da albarkatun sirri maimakon shafin jama'a.
Idan ya haɗa kuma babu abin da ke lodawa, tunnel ɗin yana aiki kuma hanya, DNS ko mai zaɓen zirga-zirga ba sa aiki. Canza ka'ida a wannan lokacin yana sake fara bincike maimakon ciyar da shi gaba.