iPhone IKEv2 zuwa RouterOS: wace shaida ke zuwa ina
Da'awai huɗu daban-daban suna yanke hukuncin ramin IKEv2 a iOS: adireshin da ake bugawa, asalin uwar garke da ake tsammani, asalin abokin ciniki da ake iƙirari da kayan takardar shaidar.
Isar da ƙofar MikroTik tana warware rabin ɓangaren sufuri na turawar IKEv2 kawai, ba wani abu ba. Bayan haka, da'awai huɗu daban-daban suna yanke hukuncin ko ramin zai samu: adireshin da wayar ke bugawa, asalin uwar garke da take tsammani, asalin da take iƙirari ga kanta, da kayan takardar shaidar da ke goyon bayan wannan iƙirari. Duba su a wannan tsari, ka tsaya a na farko da bai dace da abin da ƙofar ke gabatarwa ba. Kowanne ana gyara shi a wani wuri daban, shi ya sa gyara mara kyau yakan motsa kuskure maimakon gyara shi.
| Setting | What it decides | What it has to agree with |
|---|---|---|
| Remote address | where IKE packets are sent | a reachable name or address for the gateway |
| Remote Identifier | which server identity is expected | the gateway certificate name and the peer identity RouterOS presents |
| Local Identifier | who the phone claims to be | the client certificate name and the RouterOS identity entry |
| Certificate payload | trust plus proof of key possession | the issuing chain and a usable client private key |
Duba filayen bayanin martaba a tsarin da musayar ke amfani da su
Adireshin nesa shi ne inda fakitin IKE na farko zai je, ba wani abu ba. Mai gane nesa shi ne abin da wayar ke tsammanin ƙofar ta tabbatar da ita, kuma suna ne, ba hanya ba. Cika duka biyu da sunan uwar garke ɗaya yana aiki idan takardar shaidar ƙofar tana ɗauke da wannan sunan, kuma yana kasa ta yadda zai yi kama da matsalar hanya idan ba ta ɗauke da shi ba. Karanta bayanin martaba a matsayin jerin da'awai, ba jerin filaye da za a cika ba.
Mai gane na gida shi ne iƙirarin wayar kanta, kuma dole ne ya zama sunan da shigarwar asali ta RouterOS ke karɓa don takardar shaidar abokin ciniki da wayar ke gabatarwa. Idan biyun ba su dace ba, ƙofar tana ƙin haɗin bayan an tabbatar da takardar shaidar kanta, kuma rajistan yana kama da matsalar izini maimakon matsalar suna.
Duba masu gane da abin da ƙofar ke gabatarwa
Shigarwar abokin taro ta RouterOS da aka saita don tabbatarwa da takardar shaidar tana gabatar da takardar shaidarta, kuma asalinta ana ɗauka daga wannan takardar shaidar sai dai idan ka saita wani abu daban. Idan mai gane nesa na wayar yana ambaton sunan DNS na ƙofar, takardar shaidar ƙofar tana buƙatar wannan sunan a wurin da wayar za ta karɓa, yawanci a madadin sunan jigo. Takardar shaidar da aka bayar don wani sunan gama gari daban ba za ta tabbatar ba koda ma maɓalli da sarkar suna da kyau.
Bayanan martaba na Apple da ake sarrafawa na iya ɗauke da ƙuntatawar sunan takarda a matsayin ƙari ga filayen mai gane. Bincika kayan da aka ɗauka maimakon ka kammala sunan tabbatarwa daga abin da allon saiti ke nunawa, domin biyun ba saiti ɗaya ba ne.
Duba cewa takardar shaidar abokin ciniki maɓalli ce, ba kawai anka ta amincewa ba
Shigo da takardar shaidar CA yana ba wayar abin da za ta tabbatar da ƙofar. Ba ya ba wayar asalin abokin ciniki, kuma tabbatarwa da takardar shaidar tana buƙatar takardar shaidar ganye ta abokin ciniki da maɓallin sirrinta a kawo su tare ta hanyar rajista da aka amince da ita. PKCS#12 da aka gina ba tare da maɓallin sirri ba yana samar da bayanin martaba da ke shigowa cikin tsafta kuma ba ya tabbatar da komai.
Ganyen abokin ciniki kuma yana buƙatar asalin da ɓangaren RouterOS ke tsammani, wato jigon ko madadin sunan jigo dole ne ya dace da saitin asali mai dacewa. Bayar da takaddun shaidar abokin ciniki da uwar garke daga CA ɗaya yana sa sarkar ta zama mai sauƙi kuma ba ya sa ganyen biyu musanya.
Duba cewa manufar RouterOS tana karɓar wannan sunan
A ƙofar, shigarwar abokin taro tana saita yanayin musayar da hanyar tabbatarwa, kuma shigarwar asali tana ɗaure asalin nesa da aka karɓa ga takardar shaidar da manufar da ke biye. A RouterOS v7 ana bayyana wannan nau'i biyu ta shigarwar abokin taro da asali na IPsec, misali abokin taro IKEv2 da auth-method=digital-signature. Duba ainihin abin da menu ke ɗauka a sigar da ka shigar, ba jagora da aka rubuta don wata tsohuwar ba.
Anan kuma ne mafi sauƙin gyara rashin daidaituwa, domin ƙofar za ta iya gaya maka asalin da ta karɓa da asalin da take so. Faɗaɗa asalin da aka karɓa don yin shiru da kuskure yana cire ɗaurin da ya sa turawar ta yi ma'ana.
Duba wane mataki ya kasa kafin ka gyara wani abu
Karanta yunƙurin a ƙarshen biyu ka rarraba shi kafin ka canza shawara. Rashin daidaituwar shawara, maɓallin sa hannu da ya ɓace, mai bayarwa da ba a amince da shi ba, mai gane abokin taro mara kyau da kin amincewa da izinin abokin ciniki duk suna kama da mataccen rami daga wayar, kuma kowanne yana da mai shi daban. Canza duka saituna biyar tare yana tabbatar da cewa ba za ka koyi komai daga sakamakon ba.
Yi rikodin asalin da aka gabatar, asalin da ake tsammani, mai bayar da takardar shaidar da lambar jerin ta, da sunan manufar da ta dace, yayin da ka ajiye maɓallan sirri da asirin bayanin martaba a wajen wannan rikodin. Idan tabbatarwa ta yi nasara, gwada sabis mai zaman kansa da amsarsa, domin rabon adireshi, masu zaɓi, DNS da manufar shiga dole ne su yi aiki bayan musayar IKE ta ƙare.