Ƙirƙirar VPN na IKEv2 a cikin PowerShell da takardar shaidar na'urar

Windows yana zuwa da abokin ciniki na IKEv2 wanda PowerShell ke sarrafa shi gaba ɗaya, don haka ramin da ke aiki ba ya buƙatar GUI ko manhajar wani. Kusan kowane kuskure yana zuwa daga wurare uku: inda takardar shaidar ta tsaya, yadda aka rubuta prefixes ɗin hanyoyi, da abin da hanyar EAP da aka zaɓa ke tsammani. Yi musu magani a wannan tsari, domin kowanne ana iya tantance shi kafin na gaba ya fara kuma kuskuren da ya zo daga baya zai ɓoye na farko.

Ramin takardar shaidar na'ura yana wanzu don ya fara kafin kowa ya shiga, shi ya sa yawanci dole ne asalin ya kasance a ajiyar kwamfutar maimakon ta mai amfani.

Takardar shaidar farko, rami daga baya

Shigo da abubuwa biyu ne ke da muhimmanci. Asalin abokin ciniki yana shiga Cert:\LocalMachine\My ta Import-PfxCertificate, kuma CA mai bayarwa yana shiga Cert:\LocalMachine\Root ta Import-Certificate. Ganye shi kaɗai ba ya tabbatar da wata sarkar, don haka tsallake shigo da na biyu yana barin tabbaci ba tare da wani abin dogaro ba. Ban da kasancewarsa, dole ne a haɗa maɓallin sirri kuma a ba asusun kwamfutar izinin karanta shi. Get-ChildItem Cert:\LocalMachine\My yana lissafin abin da ya iso; kwatanta sawun yatsa maimakon batutuwa, domin kusan iri ɗaya na batutuwa suna da yawa.

Duba faɗaɗɗen amfanin maɓalli kafin ka tura. Tabbatar da abokin ciniki shine buƙatun da aka saba don asalin na'urar IKEv2, kuma dole ne ɓangaren da ke gaba ya amince da CA da ya sanya hannu a kansa. Asalin da ke cikin ajiyar mai amfani ba ya wanzu ga haɗin da ke cikin yanayin kwamfuta.

Ƙirƙiri bayanin martaba da hanyoyinsa

Add-VpnConnection -Name "Office IKEv2" -ServerAddress vpn.example.com -TunnelType Ikev2 -EncryptionLevel Required -AuthenticationMethod MachineCertificate -AllUserConnection yana rubuta bayanin martaba. Maɓallin -AllUserConnection yana wallafa shi a littafin waya na duniya, wanda ya dace da akwatin da aka raba ko da sabis ke sarrafawa; bar shi don mai amfani ɗaya. Duk adireshin da ka wuce dole ne ya yi daidai da sunan DNS a cikin takardar shaidar uwar garke, in ba haka ba kuskuren yana bayyana bayan ramin ya riga ya tashi. Sannan ana ƙara prefixes ɗaya bayan ɗaya da Add-VpnConnectionRoute, kuma kawai waɗanda ƙirar ke buƙata da gaske.

IPv6 yana da wani abin mamaki: Windows ya ƙi ::/0 a matsayin hanyar VPN, don haka ::/1 da 8000::/1 tare suna rufe wurin adireshi ɗaya. Hanyar prefix kuma ba ta ba da komai a bangon wuta na nesa, don haka jerin prefixes da manufar bangon wuta sun kasance takardu daban.

Bayanan shiga na cikin hanyar tabbatarwa

Bayanin martabar takardar shaidar na'ura ba ya buƙatar wani sirrin mai amfani kwata-kwata, yayin da bayanin martabar EAP-MSCHAPv2 yana buƙata. A yanayin na biyu, module VPNCredentialsHelper yana bayar da Set-VpnConnectionUsernamePassword, kuma yana son rubutu bayyananne: $cred.Password SecureString ne, don haka buɗe shi da farko da GetNetworkCredential().Password. Sanya module duk inda umarnin yake gudana, ba kawai a wurin aiki da aka rubuta shi ba. EAP-TLS ko hanyar da aka keɓance ba sa amfani da wannan cmdlet kwata-kwata; a maimakon haka suna ɗaukar XML na saitin EAP.

rasdial "Office IKEv2" yana ɗaga haɗin daga harsashi, wanda ita ce hanya mafi sauri ta ganin sakamako a gaba maimakon a cikin rajistan abubuwan da suka faru.

Abin da ramin da ke haɗe ba ya tabbatarwa

Matsayin haɗe yana rufe musayar IKE da matakin tabbatarwa, ba wani abu fiye da haka. Halin DNS, hanyar zuwa mai masaukin sirri da bangon wuta na nesa duk ba a tabbatar da su ba tukuna. Yi aiki a waje: adaftar rami, sannan binciken hanya don adireshi na sirri, sannan sabis ɗaya da aka ba ka izinin amfani. Farkon abin lura da ya kasa shine ke nuna matakin da za a bincika.

Idan ka canza bayanin martaba, share na baya da Remove-VpnConnection -Name "Office IKEv2" -Force kafin ka sake ƙirƙira shi; in ba haka ba tsoffin saiti da hanyoyi suna wanzuwa bayan gyaran. Idan har yanzu ba ya haɗawa, kwatanta sawun yatsan da aka rubuta a cikin bayanin martaba da wanda ke cikin ajiya, domin Windows na iya riƙe magana ga asalin da aka maye gurbinsa a ƙarƙashin batu da bai canza ba.

Riƙe sawun yatsa, hanyar EAP da jerin hanyoyi kusa da bayanin martaba. Tare suna bayanin yawancin abin da ke ɓata daga baya.