L2TP, GRE ko IPsec: wanne sashe zai ɗauki zaman?
L2TP yana ɗaukar zaman PPP, GRE yana ɗaukar fakiti tsakanin adireshi, IPsec yana kare zaɓaɓɓen zirga-zirga. Ka ba kowane sashe aiki ɗaya, sannan ka tabbatar da kowanne shi kaɗai.
Duk lokacin da L2TP, GRE da IPsec suka taru a cikin rubutun ƙira ɗaya, tambayoyi biyu suna rikicewa: wane zaman nake ɗauka, kuma wane sashe ne yake kare shi? Idan ka yi kuskuren na farko, duk abin da ke gaba zai ci gaba da daidaito a ciki yayin da yake magance matsalar da ba daidai ba — an gina wani overlay mai tura fakiti a inda masu amfani suke buƙatar yin dial-in, ko kuma an ajiye na'urar dial-in a madadin ƙofar site-to-site. Takardar aikin da ke ƙasa tana tilasta wannan bambanci kafin kowa ya shiga na'ura. Cika ta bisa tsari kuma kowanne layi zai zama abin da za ka iya gwadawa shi kaɗai.
Fara daga zaman, ba daga jerin ka'idoji ba
Mai amfani na nesa da ke riƙe da zaman PPP da wani overlay mai tura fakiti tsakanin ƙofofi biyu dangantakar cibiyar sadarwa ce dabam, ko da duka biyun sun ƙare a lulluɓe cikin IPsec. Na farko yana ƙare hanyar haɗi ta kowane mai amfani kuma yana buƙatar rabon adireshi, tabbatar da mutum ko na'ura, da manufa da ke ambaton waɗanne cibiyoyin ciki ne mai amfanin zai iya isa. Na biyu yana tura fakiti tsakanin wuraren da babu wanda ke yin dial-in zuwa gare su.
Rubuta jumla ɗaya da ke ambaton wanne daga cikin biyun kake ginawa, sannan ka karanta ta kamar kai ne mutumin da zai yi aiki da ita. Idan jumlar tana buƙatar kalmar “da”, kana ginawa duka biyun, kuma takardar aikin tana buƙatar ginshiƙai biyu maimakon ginshiƙi ɗaya na sulhu da ke yi wa kowanne rabin hidima. Idan ta ambaci mai amfani amma ba tarin adireshi ba, ko prefix amma ba manufar turawa ba, jumlar har yanzu ba ta cika ba. Kalmomin suna jin kamar na ofis, amma ita ce hanya mafi arha don kama ƙirar da in ba haka ba tikitin teburin taimako zai gano ta.
Ba kowane sashe aiki ɗaya daidai
L2TPv2 yana ɗaukar zaman PPP tsakanin ƙarshenta biyu. PPP yana gudanar da tattaunawar hanyar haɗi kuma, idan an tattauna ta, tabbatar da mai amfani; L2TP ba ya ƙara wani ɓoyewa, don haka L2TP daemon kawai ba ya aiwatar da kowane ɓangare na dangantakar tsaron IPsec kuma yana cikin hanyar haɗi da ka riga ka amince da ita kawai.
GRE lulluɓe ne tsakanin adireshi biyu. Yana ɗaukar fakiti na sashen cibiyar sadarwa a kan wani overlay na hankali kuma, shi kaɗai, ba ya bayar da sirri ko tabbataccen asalin abokin haɗi. Wannan ba aibi ba ne: an tsara kanun kai don ya kasance mai sauƙi domin ya kasance mai arha wajen sarrafawa a kan kayan aikin turawa. Sakamakon shi ne GRE yana amsa tambayar yadda za a motsa wannan fakitin tsakanin adireshi biyu kuma ba wani abu ba, wanda shi ne ainihin tambayar da ya kamata ka yi masa.
Wannan ya bar IPsec a matsayin sashen da ke zaɓar zirga-zirga, tabbatar da abokan haɗi kuma yana ɓoye abin da aka gaya masa ya kare. Wane zirga-zirga yake karewa shawara ce ta saitin da dole ta dace da lulluɓen da ƙarshen ke haifarwa a zahiri, domin manufar da aka rubuta don adireshin waje na GRE tana aiki daban da wadda aka rubuta don prefix na ciki. ƙayyadaddun GRE yana ajiye kaya, kanun kai na GRE da ka'idar isar da waje a bayyane daban, kuma manufarka tana buƙatar irin wannan rabuwa.
| Layer | Its one job | What it never does |
|---|---|---|
| PPP | Link negotiation, optional user authentication, address assignment | Protect traffic between gateways |
| L2TPv2 | Carry the PPP session between two endpoints | Encrypt or authenticate peers |
| GRE | Encapsulate network-layer packets between two addresses | Hide or authenticate the payload |
| IPsec | Authenticate peers and encrypt selected traffic | Carry a dial-in user session by itself |
Rubuta hanyar fakiti kafin saitin
Ɗauki fakiti ɗaya ka lissafa kowane kanun kai da ake ƙarawa, bisa tsarin da ake ƙarawa, tare da ambaton na'urar da ke ƙara shi. Ga mai amfani na dial-in yawanci PPP ne a cikin L2TP a cikin IPsec; ga overlay na waje fakiti na IP na ciki ne a cikin GRE a cikin IPsec. Idan na'urori biyu suna ƙara kanun kai ɗaya, kana da madauki ko rami mai kwafi, kuma duk gyaran manufar da za ka yi ba zai gyara shi ba.
Irin wannan lissafin yana ƙayyade MTU, domin girman ciki mai amfani shi ne MTU na hanyar da aka auna a cire kanun kai da ka jera yanzu kuma babu wani abu. Kada ka kwafi lamba daga rubutun forum: haɗa kanun kanun waje na IP, UDP da ESP, sannan GRE ko L2TP, sannan PPP a inda ya dace, ka cire daga MTU na hanyar da ka auna a zahiri. Alamun da ke bayyana a manyan turawa kawai, ko zaman da ke tashi sannan su mutu a babban amsa ta farko, yawanci suna komawa ga yin wannan haɗin da ƙiyasi.
Duba kowane sashe daban, daga waje zuwa ciki
Gudanar da gwaje-gwajen bisa tsari ka tsaya a farkon wanda ya kasa. Kowane layi yana amsa tambaya daban, don haka kasawa tana nuna ginshiƙi ɗaya na takardar aikin maimakon gaya maka ramin ya lalace.
ip xfrm state # is the IPsec SA up?
ip -s link show gre1 # does the overlay interface carry packets?
ip route get 10.20.0.5 # does the inner prefix route where you think?
ss -lun | grep -E "1701|4500" # are the L2TP and NAT-T listeners bound?A kan na'urar Cisco makamancin haka ya dogara da rawar, kuma ainihin rubutun ya dogara da dandamali da sigar: show crypto session ga abokan IPsec, ƙididdigar interface ga interface na GRE ko rami, da tabbatarwar VPDN ko PPP ga rawar dial-in. Tsarin umarni da ke ƙare PPP ba ya tabbatar da komai game da tallafin GRE, kuma interface na GRE mai aiki ba ya tabbatar da komai game da sabis ɗin PPP, don haka tabbatar da rawar da ka saita a zahiri maimakon wadda ke cikin zanen.
Rubuta kowanne fitarwa kusa da layin takardar aikin da ya shafi. Bayanan da aka ɗauka yayin da laifin yana nan sun fi topology da aka sake zana daga baya daga tunawa daraja.
Tsara rugujewar, sannan sake tabbatarwa
Rugujewa tana gudana a juyi saboda wani dalili: fitar da zirga-zirgar da aka kare daga manufar IPsec kafin ka cire lulluɓen da aka rubuta ta dominsa, in ba haka ba manufar za ta ci gaba da nuni ga interface da babu shi kuma lodin saiti na gaba zai kasa a wani wuri da ba ya da alaƙa. A kan Linux wannan yana nufin share shigarwar yanayi da manufa kafin interface na rami; a kan na'urar turawa, cire taswirar crypto ko shigarwar bayanin kafin rami.
Bayan sake ginawa, sake maimaita duba huɗu na karɓa ɗaya bayan ɗaya: isa waje, dangantakar IPsec da ta kafu, zaman PPP da ya kafu a inda ƙirar ta haɗa da shi, da turawa ta ciki zuwa ainihin adireshin manufa. Hasken kore ɗaya ba hujja ba ne ga sauran uku, kuma wannan gibin shi ne kasawar da ta fi daɗewa a samarwa — rami da yake aiki, an ɓoye shi, kuma ba ya tura komai domin hanyar ciki ba a taɓa ƙara ta ba.
Ajiye takardar aikin da aka cika kusa da saitin na'urar. Kowane ginshiƙi da ba za ka iya cikawa ba sashe ne marar aiki, kuma sashe marar aiki yawanci sashe ne da bai kamata ya kasance cikin tari ba.