Nauyin IPsec: yanayi, NAT-T da algorithms duk suna canza shi
Lamba ɗaya da aka buga na nauyi tana bayyana rufewa ɗaya a hanya ɗaya. Haɗa kanun da tunnel ɗinka ke yarjejeniya da su da gaske, sannan ka auna hanyar.
Wani wuri a cikin jagora akwai lamba, yawanci tsakanin sittin da tamanin bytes, da wani ya cire daga 1500 don samun MTU na interface. Wannan lambar tana bayyana rufewa ɗaya tak a kan hanya ɗaya tak. Canza yanayin, dangin adireshin waje, tsarin rufewa ko kasancewar NAT, kuma lissafin ba ya aiki ga tunnel ɗinka kuma.
Lambar ta zo daga wani tunnel daban
Nauyi ba sifa ce ta IPsec a zance ba. Sifa ce ta fakiti da ake gina shi da gaske: yanayin da aka amince da shi, kan waje, kan kariya, cikawa, filin lafiya da wataƙila ƙarin murfin UDP.
Lambar da aka ambata don yanayin jigila tare da IPv4 kuma ba tare da NAT ba tana bayyana ƙaramin fakiti fiye da yanayin tunnel tare da IPv6 a ƙarƙashin wucewar NAT. Dukansu daidai ne don yanayinsu. Kwafin ɗayansu zuwa wani turawa daban shine yadda mutane ke ƙarewa da MTU da ke karya manyan jigilar. Rashin yana shiru ne saboda ƙananan buƙatun suna ci gaba da aiki.
Haɗa matakan da suke can da gaske
Fara daga kan IP na waje ka shiga ciki. A yanayin tunnel ainihin fakitin yana ciki, don haka kan waje ƙari ne ba maye gurbi ba. RFC 4303 yana bayyana kan ESP, cikawa da bayanan lafiya da ke biye da shi.
| Layer | What it adds | When it applies |
|---|---|---|
| Outer IP header | 20 bytes for IPv4, 40 for IPv6 | Always, and 40 rather than 20 if the outer path is v6 |
| ESP header | 8 bytes of SPI and sequence number | Always |
| Block cipher IV | 8 to 16 bytes depending on the transform | When the negotiated cipher uses one |
| Padding and trailer | Padding to the block size, plus two trailer bytes | Always, and the amount varies with payload length |
| Integrity data | 12 to 16 bytes for common authenticated ciphers | When integrity protection is negotiated |
| UDP encapsulation | 8 bytes | NAT traversal on port 4500, which is common for clients behind NAT |
Babu ɗaya daga cikin waɗannan layuka da yake tsayayye a tsakanin turawa, kuma layin cikawa ba ya tsayawa ko a cikin turawa ɗaya. Wannan shine dukan dalilin da ya sa lamba ɗaya da aka buga na nauyi ke ba da takaici.
Wurare biyu na iya samun sabani kan tunnel ɗaya
Fakitin da aka kare har yanzu dole ya tsallake hanyar waje, kuma hanyar waje ba ɗaya ce a ko’ina. Hanyar shiga ta PPPoE tana ɗaukar ƙasa da tsaftataccen sashin Ethernet. Cibiyar sadarwar wayar hannu na iya ƙara ƙunci, kuma mai ba da sabis da ke tunnel ɗin nasa zirga-zirga yana ƙara wani rufewa da babu wanda ya ambata. Tunnel da ke aiki a wata hanyar kuma ya kasa a wata yana bayyana hanyar ta biyu, ba ka’idar ba.
Hanyoyi biyu ma na iya bambanta. Hanya marar daidaito na iya ba ka lodawa mai aiki da saukewa a tsaye, wanda ake karantawa a matsayin matsalar manhaja har sai ka duba girman fakiti maimakon isarwa. Yin nasarar ƙaramin ping yana tabbatar da kaɗan game da amsa mai cikakken girma.
Auna maimakon cirewa
Nemo mafi girman datagram da ke tsira a hanya. Sannan ka kwatanta shi da ƙimar da interface ke bayarwa:
ip link show eth0 | grep -o 'mtu [0-9]*' ip xfrm state list ping -M do -s 1400 198.51.100.7 ping -M do -s 1372 198.51.100.7 tcpdump -ni any -c 20 'esp or udp port 4500'
Saukar da girman ping har sai amsoshi sun iso, kuma ɗauki mafi girman ƙimar da ke aiki a matsayin kasafin kuɗin wannan hanya. Fitar xfrm tana gaya maka wane yanayi da waɗanne algorithms aka amince da su, kuma shine shigarwar kowane lissafi na gaskiya. Ɗaukar hoton yana tabbatar da ko ESP ne ko ESP a cikin UDP a kan waya, kuma hakan yana warware tambayar NAT ba tare da zato ba.
Ajiye ƙima ɗaya don matakin sarrafawa kuma. Fakitin musafaha na IKE suna da tsari daban da fakitin bayanai, don haka girman da aka samu daga hoton musafaha ba MTU na matakin bayanai ba ne.
Sanya lambar inda ta dace
Ga TCP ta cikin tunnel, matsawa MSS sau da yawa shine mafi ƙarancin tsangwama, domin yana rage abin da ƙarshen ke aikawa ba tare da canza tunnel ɗin kansa ba. Ga tunnel mai tushen hanya, saita MTU na interface ɗin tunnel da gangan kuma rubuta dalilin. Yin duka biyu lokaci ɗaya sannan ka auna ba ya ba ka wani bayani game da wanne ya taimaka.
Riƙe yanayin da aka amince da shi, dangin waje, yanayin NAT da alamar da za a maimaita tare a cikin tikitin. Rikodin abubuwa huɗu da aka rubuta ya fi tsayayyen abin tunawa, kuma shine kawai sigar wannan da za ta tsira daga haɓakar abokin ciniki na gaba.