Inda MODP3072 yake a cikin VPN Site-to-Site na AWS
MODP3072 ƙungiya ce ta 15 ta IANA, amma ƙungiyar tana cikin wani mataki. Ka daidaita buƙatar da jerin DH na Phase 1 ko Phase 2 kafin ka gyara tunnel.
Wani yana aiko maka da buƙata da ke cewa IKEv2, ESP da MODP3072, kuma console ɗin ba shi da wani fili mai wannan suna. Kuskure ne ka fara neman irin wannan fili. IKEv2 sigar tattaunawa ce, ESP ita ce hanyar da ke ɗaukar zirga-zirgarka mai kariya, kuma MODP3072 ƙungiyar musayar maɓalli ce, wato ƙungiya ta 15 ta IANA. Waɗannan gaskiya uku suna zama a wurare uku daban-daban, kuma ƙungiyar tana bayyana sau biyu.
Jumlar ba saiti ɗaya ba ce
Ka juya buƙatar zuwa jerin zaɓuɓɓuka kafin ka taɓa wani abu. Teburin da ke ƙasa shi ne dukan taswirar.
| Agreed requirement | AWS option to review | Still a separate decision |
|---|---|---|
| IKEv2 | Allowed IKE versions | Encryption, integrity, key-exchange choices |
| MODP3072 for the IKE exchange | Phase 1 DH groups, group 15 | Phase 2 key-exchange and PFS policy |
| MODP3072 for the protected-traffic exchange | Phase 2 DH groups, group 15 | The initial IKE exchange group |
| A named encryption algorithm | That phase's encryption list | Integrity and DH-group agreement |
MODP3072 ita ce ƙungiya ta 15, kuma AWS a halin yanzu tana karɓar 15 a cikin jerin ƙungiyoyin DH na Phase 1 da Phase 2 duka. Karɓarta a wurare biyu ba ɗaya ba ne da buƙatarta a wurare biyu, kuma tabbas ba yana nufin abokinka ya yi nufin duka biyu ba.
Phase 1 da Phase 2 suna tattaunawa kan abubuwa daban-daban
Phase 1 yana gina haɗin tsaro na IKE: yadda ƙofofin biyu suke tabbatar da kansu, suka amince kan maɓalli kuma suka kare nasu tattaunawar. Phase 2 yana gina CHILD SA wanda ke ɗaukar ainihin zirga-zirgarka, kuma musayar maɓallinsa na iya zama sabo maimakon gado.
Wannan rabuwa ce ta sa yake da muhimmanci lokacin da aboki ya yi magana kan cikakkiyar sirri ta gaba. PFS sifa ce ta Phase 2, kuma ƙungiya a cikin jerin Phase 1 ba ta ba da ita. Ka tambaya wace musayar kowace buƙata ta shafi, tare da yanayin ɓoyewa, ko AEAD cipher ne ke ba da aminci, da kuma abin da ake tsammani game da sabunta maɓalli a ɓangarorin biyu.
Kada ka tsinkayi cikakken saiti mai karɓuwa daga kalmar AES ko daga lambar DH ɗaya. Manufar da aka haɗa daga rabi biyu na tattaunawa biyu ita ce hanyar da tunnel ke ƙarewa da ba da shawarar abin da babu wata ƙungiya da ta amince da shi.
Jerin da aka yarda ba sakamakon tattaunawa ba ne
Jerin zaɓuɓɓuka suna bayyana abin da kowane ɓangare ya shirya ya karɓa. Ba sa bayar da rahoton abin da aka zaɓa. Ka karanta shawarwarin IKE da CHILD-SA da aka zaɓa a zahiri don sabuwar haɗi, sannan ka tabbatar an cika buƙatar ba wai kawai an yarda da ita ba. Zaɓi mai ƙarfi a cikin jeri yana tabbatar da cewa ya kasance akwai shi kawai.
Ka lura da sabuntawa kuma. CHILD SA na farko na IKEv2 da musayar CHILD daga baya mai ɗauke da PFS na iya bayyana yanayin dacewa daban-daban, domin musayar ta biyu tana ƙirƙirar sabon kayan maɓalli tare da ƙungiyar PFS a ciki. Idan gwajin karɓarka ya shafi minti na farko na tunnel kawai, bai gwada ɓangaren da abokinka ya damu da shi ba.
Bayanan zaɓuɓɓukan tunnel na AWS ya lissafa Phase 1 da Phase 2 daban, kuma wannan shine tsarin da ya kamata ka riƙe kafin buƙata ta gaba ta zo.
Ka canza tunnel ɗin da kake nufi da gaske
Haɗin VPN Site-to-Site yana da tunnels biyu da nasu zaɓuɓɓuka da nasu yanayi. Kafin ka duba ko gyara wani abu, ka daidaita adireshin waje na tunnel ɗin AWS da takwaransa a ɓangaren ƙofar abokin ciniki kuma kada ka ɗauka cewa ajiya ɗaya tana sabunta duka biyu.
Canji da aka amince da shi yana buƙatar a shirya ɓangaren ƙofar abokin ciniki don irin wannan manufar da kuma lokacin da za a yi tsayawa da tunnel ɗin da aka zaɓa zai yi. Idan takwaransa bai shirya don ƙungiya ta 15 a matakin da kake canzawa ba, tunnel ɗin zai daina tashi kawai, kuma console ɗin ba zai gaya maka wace ɓangare ta ƙi ba.
Ka rubuta manufar da aka amince da ita a matsayin mataki, sigar yarjejeniya, ɓoyewa, aminci da ƙungiyar DH, sannan ka tabbatar da ita a musayar da ya kamata ta kare. Tushen hanya, masu zaɓen zirga-zirga da izinin aikace-aikace sun kasance daban; wannan taswira ba cikakken tsarin ƙofa ba ne, kuma ba shawara ba ce a kunna ƙarin algorithms don bambancin.