Me ya sa SSL VPN da VPN daga wuri zuwa wuri ba sa gaba da juna
SSL VPN da VPN daga wuri zuwa wuri suna bayyana gatura daban-daban: wa ke shiga cibiyar sadarwa da yadda ake gina ramin. Ambaton duka biyu tare kuskure ne na rukuni.
Ka ce da masu gudanarwa biyu su bayyana VPN guda ɗaya, ɗaya na iya amsa “SSL VPN” yayin da ɗayan ya ce “daga wuri zuwa wuri”, kamar su biyun zaɓuɓɓuka ne masu fafatawa a cikin menu. Amsoshin tambayoyi daban-daban ne, kuma ɗaukar su a matsayin madadin yana haifar da kwatancen da ba za a iya warware su ba. Ɗaya daga cikin alamar yana faɗin waɗanne ƙarshen maki ne ake haɗawa; ɗayan kuma yana faɗin me ke ɗaukar zirga-zirga tsakanin su. Ka raba gatura ɗin da juna kuma yawancin muhawarar za ta ɓace.
Alamu biyu, tambayoyi biyu daban-daban
Topology yana amsa wa ke shiga me. Tsarin shiga daga nesa yana haɗa ɗaiɗaikun masu amfani ko na'urori zuwa ƙofar shiga, yawanci tare da asalin kowane mai amfani da tarin adireshi. Tsarin daga wuri zuwa wuri yana haɗa cibiyoyin sadarwa biyu ta ƙofofin shiga, don haka asalin da ke da ban sha'awa shi ne ƙofar abokin tarayya maimakon mutumin da ke gaban maɓallin rubutu. Waɗannan matsalolin aiki ne daban-daban, daga shirye-shiryen adireshi har zuwa wanda zai iya soke damar a ƙarfe 2 na dare.
Mekanizim yana amsa yadda ake gina ramin da tabbatar da shi. IPsec tare da IKEv2, samfurin tushen TLS da ke ɗaukar IP a cikinsa, da tashar aikace-aikacen da ke fuskantar burauza zaɓuɓɓukan mekanizim ne, kuma kowanne yana da nasa tattaunawar, saitin sirri da yanayin gazawarsa. Babu ɗayansu da ke nuna topology, kuma topology ba ya zaɓar mekanizim.
Ka sanya gatura biyu a cikin tebur ɗaya kuma ruɗani zai bayyana, domin kowane ɗaki na grid za a iya cika shi. Abin da grid ba zai iya yi shi ne ya gaya maka wace haɗuwa mai sayar da kai ya kawo, tunda sunayen samfuri suna haɗa gatura biyu cikin jumlar talla ɗaya.
Daga ina kuskuren rukuni ya fito
Masu sayarwa sun sayar da “SSL VPN” tsawon shekaru a matsayin kishiyar “IPsec VPN”, wanda ya sa kwatancen mekanizim ya yi kama da zaɓin topology. Jumlar kuma ta tsufa sosai bisa ƙa'idodinta, tunda sabbin tsare-tsare suna amfani da nau'ikan TLS da ake tallafawa kuma sunan SSL ya rayu musamman a matsayin rukunin samfuri.
| Axis | Question it settles | What it cannot tell you |
|---|---|---|
| Topology | Whether users join a gateway or two networks join each other | Which protocol carries the traffic, or how peers prove identity |
| Mechanism | Which protocol suite builds the tunnel and negotiates keys | Whether the endpoints are people, devices or routers |
| Access surface | Whether the client sees a routed network or a set of published applications | Which topology or mechanism is underneath the portal |
| Authentication | What proof each side presents, and to whom | Whether the traffic is later authorized per resource |
Tatsuniyoyi biyu masu alaƙa sun biyo baya daga wannan haɗuwar. Na farko shi ne cewa IPsec na nufin daga wuri zuwa wuri; an tsara IKEv2 don dangantakar abokin ciniki-da-ƙofa kuma, don haka kwamfutar tafi-da-gidanka ɗaya za ta iya shiga da IPsec. Na biyu shi ne cewa samfurin tushen TLS na nufin damar shiga daga nesa kawai; OpenVPN ana amfani da shi akai-akai don ɗaukar zirga-zirga tsakanin wurare biyu, kuma amfani da TLS ɗinsa ya ta'allaka ne a musayar sarrafawa da tabbatarwa maimakon zaman burauza.
Gwajin da ya dace ga kowane bayani: idan musanya kalma ɗaya ya canza duka ƙarshen maki da ka'idar, jumlar tana haɗa gatura ɗin. “SSL VPN da daga wuri zuwa wuri” ba ya cin wannan gwajin, domin kalmar farko tana ambaton iyali na mekanizim ɗaya kuma ta biyu tana ambaton topology.
Ka bayyana turawa ta yadda za a iya kwatanta ta
Rubuta filaye huɗu ka cika su: ƙarshen maki, mekanizim, tabbatarwa da fuskar shiga. Haɗin reshe na iya karantawa a matsayin biyu na ƙofofin IKEv2 tsakanin manyan layi biyu da aka ambata tare da tabbatar da takardar shaida kuma babu tashar matakin mai amfani. Sabis ɗin shiga daga nesa na iya karantawa a matsayin abokin ciniki na tushen TLS wanda ke ba da adireshi ga kowane mai amfani, yana buƙatar abu na biyu a lokacin shiga kuma yana buga yankin DNS na ciki kawai.
Waɗannan jumlolin ana iya kwatanta su ta hanyar da sunayen samfuri ba za su iya ba. Ana iya auna tsare-tsaren shiga daga nesa biyu da irin wannan aikin mai amfani da irin wannan hanyar soke, kuma ana iya auna tsare-tsare biyu tsakanin wurare da irin wannan jerin manyan layi, manufar zirga-zirga da buƙatun gazawa. Alamu suna tsara kwatancen; ba sa maye gurbinsa.
Kalmomin suna da tushen da aka buga kuma. Takardar kalmomin VPN ta IETF ta raba nau'o'in sabis da yawa, ciki har da shiga daga nesa da daga wuri zuwa wuri, daga mekanizim ɗin da ake amfani da su wajen gina su, kuma wannan shi ne ainihin bambancin da ke ci gaba da ɓacewa.
Karanta ka'idar da aka tattauna, ba sunan samfurin ba
Alamar da ke kan akwatin ba ta tabbatar da abin da rami mai gudana ya amince da shi ba. Tambayi abokin tarayya kai tsaye, a gefen TLS, ka karanta sigar ka'ida da sirrin da musafaha ya samar maimakon sigar da ke cikin ƙasida.
openssl s_client -connect vpn.example.net:443 -tls1_3 -briefGa ƙofar IPsec, lura daidai take ta fitowa daga fitowar matsayin aiwatarwa kanta, wanda ke ba da rahoton shawarwarin IKE da ESP da ake amfani da su. Ko ta yaya, batun ɗaya ne: dole ne a karanta gatar mekanizim daga zaman da ke raye, domin abokin ciniki da ƙofa na iya yin shawarwari zuwa wani abu da ya tsufa fiye da yadda kowane ɗaya daga cikin masu gudanarwa biyu ya yi tsammani.
ipsec statusall | grep -E "IKE|ESP"Bayan haka, tambayoyin da suka rage su ne waɗanda babu alamar da ke amsa su. Wadanne sigogin ka'ida har yanzu ana karɓa, yaya ake tabbatar da asalin ƙofar, wane saitin algorithm aka yarda da shi, wa ke ba da izini ga wani mai amfani don wani albarkatu, kuma me ke soke damar shiga idan na'ura ta ɓace. Zanen topology da sunan mekanizim su ne farkon wannan jerin, ba madadinsa ba.
Don haka ka riƙe alamu biyu, amma yi amfani da su don abin da suke: hanya gajere ta faɗin waɗanne ƙarshen maki ake haɗawa da yadda ake gina ramin. Lokacin da aka yi amfani da ɗaya don ware ɗayan, bayanin ya daina bayyana wani abu.