Kuskuren 789 na L2TP/IPsec a Windows: ƙirƙira bayanin martaba ka kuma daidaita shawara

Kuskuren 789 a haɗin L2TP na Windows yana nufin tunnel ɗin ya mutu a cikin musayar tsaro ta IPsec, wanda ke faruwa da daɗewa kafin Windows ya aika kalmar sirrin mai amfani ko'ina. Sake gwada kalmar sirri, ko sake saita ta a jagorar, ba zai iya ciyar da wannan matakin gaba ba. Abin da ke ciyar da shi gaba shi ne sake gina haɗin daga PowerShell tare da shawarar da ƙofar ke bayarwa da gaske, domin mayaudarin Saituna yana zaɓar sauyin IPsec a asirce kuma ba ya taɓa nuna maka abin da ya zaɓa. Wannan shi ne jagorar aiki don haka: ƙirƙira bayanin martaba, daidaita shawarar, sannan yi amfani da teburin matakai don lambar gaba ta gaya maka wani abu.

Ƙirƙira bayanin martaba ba tare da mayaudari ba

Add-VpnConnection yana rubuta shigarwar littafin waya ta asali, don haka sakamakon shi ne abu ɗaya da aikace-aikacen Saituna ke gyara daga baya. Gudanar da shi daga zama mai haɓaka lokacin da haɗin ya kamata ya kasance ga kowane asusu a na'urar, ko daga mahallin mai amfani lokacin da ya kamata ya kasance na sirri:

Add-VpnConnection -Name "Contoso L2TP" `
  -ServerAddress 203.0.113.10 `
  -TunnelType L2tp `
  -EncryptionLevel Required `
  -AuthenticationMethod MSChapv2 `
  -RememberCredential -Force

Daidaita -AuthenticationMethod da abin da ƙofar ke bayarwa. MSChapv2, EAP da PAP ba sa musanya, kuma bayanin martaba da ke buƙatar hanyar da uwar garken ba za ta karɓa ba yana faɗuwa kafin a duba kowane rikodin mai amfani. Riƙe -EncryptionLevel Required don kowane abu na gaske; Optional yana barin Windows ya karɓi tunnel marar ɓoyewa idan abokin hamayya ya bayar da ɗaya, wanda gajeriyar hanya ce ta ɗakin gwaji ba saiti don aikawa ba.

Idan ka ba da -L2tpPsk, ana rubuta wannan maɓallin da aka riga aka raba a cikin bayanin martaba a faifai, inda duk wanda zai iya karanta bayanin a wannan na'urar zai iya dawo da shi. Yi amfani da takardar shaida don tantance abokin hamayya lokacin da ƙofar ke goyan bayan hakan, kuma idan PSK ba makawa ne, riƙe shi a wajen ajiya da wajen tarihin harsashi maimakon liƙa shi a kowane gudanarwar samarwa.

Daidaita shawarar maimakon karɓar tsoffin dabi'u

Windows yana cika sauyin IPsec da kansa, wanda shi ya sa na'urori biyu da haɗin da ya yi kama da ɗaya ke iya faɗuwa daban-daban a kan ƙofa ɗaya. Set-VpnConnectionIPsecConfiguration ita ce hanyar da aka goyan bayan daidaita su:

Set-VpnConnectionIPsecConfiguration -ConnectionName "Contoso L2TP" `
  -AuthenticationTransformConstants SHA256128 `
  -CipherTransformConstants AES128 `
  -EncryptionMethod AES128 `
  -IntegrityCheckMethod SHA256 `
  -DHGroup Group14 `
  -PfsGroup None `
  -PassThru -Force

Wannan saitin tsarin L2TP/IPsec ne na gama gari, ba amsa ta duniya ba. Kowane ma'auni yana karɓar jerin ƙididdiga na ƙayyadaddun dabi'u, kuma haɗin da dandamali ba zai iya taswira ba yana dawowa a matsayin kuskuren cmdlet maimakon bayanin martaba da aka raunana a asirce. Ɗauki irin wannan kuskure a matsayin magana kan dabi'un, ba kan izininka ba.

Kwafi shawarar daga takardun ƙofar ko daga saitunan mataki na 1 da mataki na 2 nata masu rai, kuma canza fili ɗaya a lokaci ɗaya kawai yayin da ƙofar ke yin rikodin sauyin da ta ƙi. Ketare filaye biyar yana haifar da haɗin da ke aiki kwatsam da rikodin da ba ya bayyana kome ga mutum na gaba.

Karanta gazawa bisa mataki, ba bisa rubutun kuskure ba

789 yana cikin iyalin lambobi waɗanda duk suna kama da juna a tattaunawar abokin ciniki. Sanya lambar gaban matakin da take ciki kafin ka sake taɓa bayanin martaba:

Matsayin shaidar biyu suna da muhimmanci a nan. Maɓallin da aka riga aka raba ko takardar shaida yana tantance abokan zuwa juna, yayin da MSChapv2 ko EAP ke tantance ka a cikin tunnel. Sake saita kalmar sirrin mai amfani ba zai iya gyara na farko ba, sabon sirrin da aka raba ba zai iya gyara na biyu ba, kuma canza duka biyu a lokaci ɗaya yana lalata shaidar wanne ne ya yi kuskure.

A hanyar takardar shaida, duba agogon abokin ciniki, sarkar amincewa da asalin da ƙofar ke tsammani kafin ka yi la'akari da sassauta tabbaci. Kashe tabbaci yana mai da 789 bayyane ya zama tunnel da ke haɗawa yayin da yake amincewa da abokin da bai dace ba, kuma babu abin da ke cikin abokin ciniki zai gaya maka cewa hakan ta faru. jerin kuskuren isa nesa na Microsoft shi ne bayanin da ya shafi lambobin kansu, kuma yana raba gazawar matakin tsaro da gazawar shiga.

Tabbatar daga ɓangarorin biyu kafin ka ce an gyara shi

Karanta bayanin martaba baya, amma kada ka yi tsammanin shawarar a cikin fitarwa. Get-VpnConnection yana ba da rahoton suna, adireshin uwar garke, nau'in tunnel, matakin ɓoyewa da hanyar tantancewa, kuma bai san kome game da sauyi ba, don haka karatun yana tabbatar da cewa shigarwar tana nan kuma tana nuna madaidaicin mai masauki:

Get-VpnConnection -Name "Contoso L2TP" |
  Select-Object Name, ServerAddress, TunnelType, EncryptionLevel, AuthenticationMethod

Yi kira daga layin umarni don samun lamba maimakon tattaunawa: rasdial "Contoso L2TP" yana mayar da kuskuren da ma'aunin zai mayar, kuma rasdial "Contoso L2TP" /disconnect yana share shi tsakanin yunƙuri. Sannan karanta ɓangaren ƙofar don wannan yunƙurin. ipsec statusall na strongSwan ko rikodin IKE na na'urar hanya yana faɗin wace shawara ta zo kuma wace aka ƙi, kuma kwatanta hakan da ƙididdigar cmdlet ita ce kawai mataki da ke tabbatar da cewa ɓangarorin biyu sun yarda.

Haɗi mai nasara ba shine layin ƙarshe ba. Buɗe aikace-aikacen da ke da mahimmanci ga mai amfani, domin hanyoyi, DNS da aka tura da saitunan tunnel da aka raba suna faɗuwa bayan tunnel ya tashi kuma ba sa haifar da tattaunawar kuskure kwata-kwata.

Sarrafa shi kai tsaye, kuma ja da baya da tsabta

Saitin da ba a kula da shi ba shine dalilin rubuta skript na wannan, kuma matakin bugawa shine inda shaidar ke ɓacewa. rasdial yana ɗaukar su a layin umarninsa, inda sauran masu amfani na gida da yawancin masu tattara log za su iya karanta su:

subprocess.run(["rasdial", "Contoso L2TP"], check=True)

Fi son shaidar da aka iyakance ga asusun da ke gudanar da aikin, ko bar bayanin martaba ya adana ta da -RememberCredential, maimakon ba da kalmar sirri a matsayin hujja a cikin aikin da aka tsara. Umarnin samarwa kansu suna da aminci a maimaita da -Force, amma za su lulluɓe tsohuwar shawara da farin ciki, don haka sake gudanarwa yana taimakawa ne kawai idan skript ɗin yana ɗauke da halin yanzu.

Bayanan martaba suna wucewa bayan sake yi, kuma suna rayuwa fiye da tsarin ƙofar da aka gina su dominsa. Idan shawarar ƙofar ta motsa, cire shigarwar kuma sake ƙirƙira ta maimakon ɗora wani saitin dabi'u a kanta: Remove-VpnConnection -Name "Contoso L2TP" -Force, sannan maimaita cmdlet biyu da sabon saitin.

Rufe rufin da dubawa huɗu waɗanda ke zaune kusa da skript ɗin: Get-VpnConnection yana nuna nau'in tunnel da matakin ɓoyewa da ake tsammani; ƙofar tana yin rikodin mataki na 1 da mataki na 2 da aka kammala don adireshin abokin cinikinka; rasdial yana mayar da nasara kuma aikace-aikacen yana buɗewa; kuma shawarar da aka rubuta a cikin skript ɗin ta dace da saitunan ƙofar na yanzu. Idan 789 na gaba ya zo, wannan kwatancen yana ɗaukar mintuna maimakon yammacin rana.