Daidaita abokin ciniki na VPN na Linux da yarjejeniyar tsohuwar na'ura

Iyalai huɗu na yarjejeniya suna rufe kusan kowace na'ura da ke cikin raki, kuma kowace tana gazawa daban a Linux. Tashoshin da aka wallafa da shawarwarin da aka saita na ƙarshen nesa ne ke ƙayyade fakitin ka, ba rarraba da kake gudanar ba da gangan. Shirya abin da wani rubutu a dandalin ya ambata sannan a gyara har wani abu ya haɗu shi ne hanyar da rana ke ɓacewa. Karanta na'urar, shirya na biyu, tabbatar na uku.

Rubuta abin da ƙarshen nesa ke wallafawa

Rubuta yarjejeniya, tashoshi da tabbaci da na'urar ke tsammani kafin ka buɗe mai sarrafa fakiti. Iyalai huɗu suna rufe yawancin tsofaffin kayan aiki, kuma teburin da ke ƙasa shi ne dukan shawarar a kan allo ɗaya.

Littafin jagora da ka'idojin tacewar wuta na na'urar kanta sun fi sunan yarjejeniya a shafinta na shiga abin dogaro. Na'urar da ke tallata IPsec watakila tana magana da IKEv1 kawai, kuma fitowar firmware da babu wanda ya yi amfani da ita watakila ita ce ke ƙara IKEv2 a ƙarshe. Tabbatar da hanyar bayanai da tashar saiti, domin a nan ne tsofaffin kayan aiki da hanyoyin zamani suka bambanta. Kuskure a wannan mataki yana nufin gyara matsalar abokin ciniki naka a kan wani fasali da ɗayan gefen bai taɓa samu ba.

PPTP: tabbatar da GRE kafin ka gyara pppd

PPTP a Linux ba daemon ba ne da kake farawa, kira ne na pppd, kuma sigogin haɗin suna rayuwa a cikin fayil ɗin peer mai suna wanda pppd ke karantawa lokacin da aka kira shi. Rarraba suna har yanzu suna tattara shi, ko da yake sanannun raunin yarjejeniyar sun sa ya zama mara dacewa ga duk wani abu mai muhimmanci, don haka riƙe shi sosai ga na'urar da ba ta bayar da wani abu ba. Kula da GRE yayin da abokin ciniki ke tattaunawa, da ɗan gajeren rikodi maimakon zato. Gazawar da ke ɓata lokaci mafi yawa ba tabbaci ba ce, sai hanyar bayanan da ta ɓace.

pppd call branch-office
tcpdump -ni any proto gre -c 5

Idan saitin ya kammala kuma hanyar ba ta taɓa ɗaukar zirga-zirga ba, yi zargin hanyar GRE kafin ka taɓa bayanan shiga. Ƙungiyoyin tsaro na girgije suna buƙatar ƙa'ida bayyananna don yarjejeniya 47, kuma wasu hanyoyin suna toshe ta gaba ɗaya ba tare da bayyananniyar kuskure ba. Gwada daga hanyar da za ka yi amfani da ita da gaske, ba daga dakin gwaji da ke ba da izinin komai ba.

L2TP/IPsec: shawara ɗaya da ta dace ta fi ƙoƙari goma

Karanta log ɗin daemon maimakon tattaunawar tebur, domin tattaunawar tana haɗa gazawa daban-daban da yawa cikin saƙo ɗaya. Kuskuren NO_PROPOSAL_CHOSEN na matakin farko ne: abokin ciniki ya ba da ɓoyewa, hash ko ƙungiyar Diffie-Hellman da uwar garken ba zai karɓa ba. Lissafta abin da na'urar ke tallafawa ka rubuta shawara ɗaya da ta dace da shi, domin haɗuwa da ba da gangan ba yawanci suna ba da kuskure ɗaya a hankali. A tebur, abokin ciniki mai amfani shi ne plugin ɗin NetworkManager L2TP tare da strongSwan ko Libreswan a ƙasa.

Zaɗin shawara da ke nufin abu ɗaya ga plugin ɗin tebur na iya nufin wani abu ga daemon da ake ba da aikin, don haka riƙe tsarin da ya dace da layin da kake gyarawa. Idan na'urar tana buƙatar sirrin tunnel kuma, wannan mataki ne daban daga maɓallin IPsec. Tabbatar wanne daga cikinsu interface ɗin ke tambaya kafin ka rubuta wani abu a ciki.

IKEv1 mai tsanani tare da XAuth, da yanayin tashar

Ƙarshen irin FortiGate yawanci yana son yanayi mai tsanani tare da XAuth da adireshin yanayi da aka saita, abin da plugin na hoto watakila ba zai nuna kwata-kwata ba. Daemon na asali yana iya jurewa, kuma block ɗin da ke ƙasa siffa ce ta wannan saitin ba cikakken fayil ba. Duba takardun mai samarwa na yanzu don ƙimar shawarar.

conn branch
    keyexchange=ikev1
    aggressive=yes
    leftauth=psk
    leftauth2=xauth
    leftsourceip=%config
    right=203.0.113.10

Tsofaffin fitowar strongSwan suna amfani da xauth=client inda siga 5 ke amfani da leftauth2=xauth, don haka guntun da aka kwafa na iya gazawa a kan tsari kawai. Don tashar TLS, openconnect mai magana da yarjejeniyar AnyConnect yana jure wa Cisco da yawancin samfuran da aka sake yi wa suna, kuma yana buƙatar na'urar TUN da izinin daidaita ta. Ba da adireshin tashar daidai yadda mai bincike ke nuna shi, haɗe da duk wata hanya da na'urar ke tsammani, sannan duba adireshin da aka keɓe kafin ka gwada wani abu a bayansa. Ƙirƙirar interface ɗin a gaba yana kawar da nau'in mamaki ɗaya yayin saitin.

sudo ip tuntap add dev tun0 mode tun
sudo openconnect --protocol=anyconnect vpn.example.com

Haɗa, sannan tabbatar a cikin tsari tabbatacce

Gudanar da mai sarrafa VPN ɗaya daidai a lokaci ɗaya, domin bayanan NetworkManager da daemon da aka fara da hannu za su yi faɗa a kan hanyoyi da DNS. Sauke bayanin kafin ka gwada haɗin hannu, ka tabbatar babu tsohon interface ɗin tunnel da ya rayu. Sannan tabbatar a cikin wannan tsari: adireshin tunnel, hanya zuwa ga cibiyar cikin gida ɗaya da kake buƙata, warware suna, sannan a ƙarshe buƙata ta gaske. Alamar kore tana tabbatar da tabbaci kuma ba wani abu ba.

ip -4 addr show tun0
ip route get 10.20.30.10
getent hosts app.internal

Idan mataki ya gaza, tsaya a nan maimakon gwada na gaba, domin gazawar DNS a ƙasan hanyar da ta lalace ba ta koya maka komai. Ajiye kwafin bayanin da ke aiki kafin yin gwaji, domin fayil ɗin haɗin da aka goge yana ɓacewa cikin sauƙi kuma yana da wahala a sake gina shi. Riƙe ƙimar shawarar a cikin wannan rubutu ɗaya da samfurin na'urar da sigar firmware, domin wannan rubutu shi ne bambanci tsakanin ƙaura da aikin ilimin kayan tarihi idan an maye gurbin akwatin.