NO_PROPOSAL_CHOSEN a L2TP? Da farko a duba ƙofar cibiyar sadarwa

Tambayar sunan mai amfani ba ta taɓa bayyana ba, kuma abokin ciniki yana bayar da rahoton NO_PROPOSAL_CHOSEN. A wannan lokacin bayanan shiga da maɓallin da aka riga aka raba ba su da mahimmanci, domin ɓangarorin biyu ba su amince da yadda za a kare mataki na 1 ba. Yawancin mutane suna amsawa ta hanyar liƙa igiyar sirri da suka samu a kan layi. Duba ƙofar yana amsa wannan tambaya da hujja kuma yana ɗaukar kusan lokaci ɗaya.

Abin da saƙon ya ware

Ƙin ƙarshe yana faruwa a babban yanayi, kafin kowane musayar L2TP ko PPP, don haka ba a tuntuɓi rami ko bayanan masu amfani ba. Mataki na 1 yana tattaunawa kan ɓoyewa, amincin bayanai da ƙungiyar Diffie-Hellman. Mataki na 2 yana tattaunawa kan shawarar ESP don bayanai. Ba za a iya gyara gazawar mataki na 1 ta hanyar canza saitin PFS na mataki na 2 ba, kuma haɗin IKE da ya kammala ba ya tabbatar da cewa shawarar ESP ta dace.

Yi rikodin backend kafin gyara rubutun: ipsec --version. libreswan da strongSwan suna karɓar rubutun shawara daban-daban don algorithms iri ɗaya.

Sannan a karanta ƙin a mahallin tare da journalctl --no-hostname _COMM=nm-l2tp-service _COMM=ipsec _COMM=pluto _COMM=charon _COMM=kl2tpd _COMM=xl2tpd _COMM=pppd.

A duba ƙofar don sanin jerin canjin ta

Na'urar dubawa tana tambayar ƙofar kai tsaye waɗanne canje-canje za ta tattauna. Da farko a dakatar da sabis ɗin IPsec na gida don kada gwajin ya yi takara da abokin cinikinka, sannan a karanta layukan SA. A ɗauki jerin a matsayin hujja game da wanda ke gefe guda, ba a matsayin menu da za a kunna gaba ɗaya ba.

sudo ipsec stop
sudo ike-scan --trans=3des-sha1-modp1024 10.10.10.250 | grep SA=

Tsofaffin na'urori suna yawan bayar da 3DES, SHA1 da MODP1024, domin su ne tsoffin zaɓuɓɓukan lokacin da aka aika samfurin kuma babu wanda ya sake duba su. A adana fitarwar duba ɗanyen, domin ita ce kawai rikodin abin da wanda ke gefe guda ya bayar a ranar. Idan wannan shine mafi ƙarfin haɗuwa da ake da shi, haɓakawa daidai tana zuwa ga mai ƙofa, ba ga saitin abokin ciniki da ke sake kunna ƙarancin sirri ga kowa ba.

A daidaita haɗuwar ba tare da kashe tsaro ba

Shigar da canje-canjen da suka bayyana a cikin duba da manufofinka kawai. Misalin da ke ƙasa yana nuna ƙofar da ke bayar da 3DES, SHA1 da MODP1024 a mataki na 1. Lura da kariyar backend: libreswan 4.x ba ya haɗa ƙungiyar modp1024, don haka wannan ya shafi strongSwan ko ginin libreswan mai goyon bayan DH2. Tabbatar da sigar kafin ka yanke shawarar cewa abokin ciniki ya lalace.

Phase 1: 3des-sha1-modp1024
Phase 2: aes256-sha1,aes128-sha1,3des-sha1

Alamar mamaki a ƙarshe tana ɗaure shawara ɗaya. Yi amfani da ita don ware gwaji, sannan a cire ta domin ƙofar ta iya tattauna wani abu mafi ƙarfi daga baya.

A duba daemon da tashar kafin sake gwadawa

NetworkManager-l2tp yana fara nasa xl2tpd. Idan sabis ɗin tsarin ya riga ya mallaki UDP 1701, abokin ciniki yana komawa zuwa tashar tushe ta wucin gadi, wanda RFC 3193 ya yarda da shi kuma wasu sabar suna watsi da shi cikin shiru. A duba mai socket kafin yunƙuri na gaba.

sudo ss -unlp | grep 1701
sudo systemctl stop xl2tpd.service
sudo systemctl disable xl2tpd.service

Tsoffin sirrin da aka ƙirƙira wata dalili ce ta shiru. Fayilolin da ke ƙarƙashin /etc/ipsec.d/ waɗanda aka sanya wa tsohuwar haɗi suna iya rayuwa fiye da bayanin da ya ƙirƙira su, don haka cire waɗanda babu abin da ke magana da su kuma sake gwadawa.

A ƙarshe, duba daga ina shawarar ta fito. ipsec.conf da aka rubuta don IKEv1 XAuth yana bayyana wani nau'in VPN, kuma shawararsa ba ita ce kawai layin da zai yi kuskure a cikin bayanin L2TP ba. Yi rikodin jerin canje-canjen da ka shigar a gefen bayanin, domin mutum na gaba kada ya sake gwajin.