vpnc da Check Point ko Nortel: me ya sa yake tsayawa

Alamar cutar ana iya karanta ta da kuskure cikin sauƙi: vpnc yana farawa, yana neman kalmar sirrin ƙungiya, sannan ya tsaya a wani mataki na tattaunawa har sai ya bayar da rahoton cewa babu amsa daga maƙasudin. Babu wani abu a cikin fitarwar da ya ambaci samfurin ƙofar, kuma asusun yana aiki daga mai bincike, don haka bayyanannen ƙarshe shine kuskuren kalmar sirri ko tashar da aka toshe. A yawancin waɗannan lokuta ƙofar ba abokiyar IPsec ba ce kwata-kwata, don haka musayar ba ta taɓa isa gwajin shaidar shiga ba. Wannan tsarin ya cancanci gwadawa kafin a canza wani abu a cikin bayanan martaba.

Gane samfurin kafin ka gyara wani filin bayanan martaba.

Rashin nasarar yana kama da kuskuren shaidar shiga

vpnc yana farawa da aika IKE zuwa UDP 500 kuma, idan an bayar da hanyar wucewa ta NAT, zuwa UDP 4500. Ƙofar da ke ƙare SSL maimakon IPsec ba ta amsa ko ɗaya, don haka abokin ciniki yana sake gwadawa kuma a ƙarshe ya daina da wani kuskure na gama-gari. Idan wannan asusun yana aiki ta hanyar tashar mai bincike da ke loda ƙaramin manhajar taimako, wannan babbar alama ce cewa ramin yana dogara ne akan SSL kuma abokin ciniki yana yin tambayar da ba daidai ba.

Gwajin da bai yi nasara ba a nan ba ya faɗin komai game da asusun mai amfani, domin ba a taɓa gabatar da wata shaidar shiga ga ƙofar ba.

Duba wane yarjejeniya ƙofar ke bayarwa

Mintuna biyu na bincike suna raba abokiyar IPsec da tashar SSL. Gudanar da su daga wannan hanyar sadarwar da abokin ciniki zai yi amfani da ita, ka karanta waɗanne tashoshi ke amsawa maimakon waɗanda suka bayyana a cikin takarda. Ajiye sakamakon, domin waɗannan tashoshin ne ke yanke shawarar wane abokin ciniki mai ƙofar ya kamata ya tallafa. Yi bincike daga hanyar sadarwar abokin ciniki ba daga na'ura kusa da ƙofar ba.

nc -zvu gw.example.com 500
nc -zvu gw.example.com 4500
nc -zvt gw.example.com 443
curl -sI https://gw.example.com/ | head -5
openssl s_client -connect gw.example.com:443 -servername gw.example.com </dev/null | head -20

Buɗaɗɗen 443 tare da tura zuwa shafin shiga da kuma shiru a 500 da 4500 yana nuni ga SSL VPN. Buɗaɗɗen 500 da 4500 tare da takardar shaidar da ake bayarwa a 443 yana nuna ƙofar IPsec wadda kuma ke tafiyar da gaban yanar gizo, wanda shine yanayin da aka gina vpnc dominsa.

SSL Network Extender na Check Point da abokin ciniki na Aventail na Nortel duka suna cikin rukuni na biyu, kuma ɗayansu ba ya karɓar sirrin ƙungiyar IKEv1.

Abin da bayanan martabar vpnc zai iya bayyanawa da abin da ba zai iya ba

A ƙarƙashin murfin vpnc yana gudanar da IKEv1 akan maɓallin ƙungiya da aka riga aka raba, sannan yana aika shaidar shiga na mutum ɗaya ta hanyar XAuth. Duk abin da ke cikin fayil ɗin saitin sa na wannan musayar ne: ƙofa, sunan ƙungiya, sirrin ƙungiya, sunan mai amfani da kalmar sirrin mai amfani. Waɗannan filayen suna bayanin yarjejeniya ɗaya, kuma babu wani haɗin su da zai sa abokin ciniki ya yi magana da wata.

Shi ya sa faɗaɗa jerin sifofi ko kashe duban takardun shaida ba ya gyara irin wannan rashin nasara. Waɗannan canje-canjen suna raunana tattaunawar da ƙofar ba ta saurare ta.

Zaɓin abokin ciniki da ya dace da ƙofar

Don ƙofar Check Point, yi amfani da fakiti na SNX da aka gina don wannan fitowar ƙofar, wanda mai siyar ke wallafa shi tare da takardun shiga nesa. Tsofaffin ginin SNX suna kasawa akai-akai a rarraba na yanzu domin suna tsammanin ɗakunan karatu na 32-bit waɗanda ba a shigar da su kuma, kuma gyaran fakiti da aka yi watsi da shi yawanci ya fi muni da gudanar da abokin ciniki da ake tallafawa a kan dandamali da ake tallafawa.

Abokan cinikin Aventail sun rasa tallafi tun da daɗewa. Inda irin wannan ƙofar ke aiki har yanzu, zaɓuɓɓukan gaske sune tashar mai bincike idan ƙungiyar ta kunna ta, ko abokin ciniki da mai siyar ke tallafawa a kan tsarin aiki da ake tallafawa.

Tambayi mai ƙofar game da samfurin da sigar, abokin cinikin da suke tallafawa a Linux, da ko akwai bayanan martabar IPsec kwata-kwata. Idan akwai, nemi mai gane ƙungiya da sirrin ƙungiya a matsayin abubuwa daban, domin ba kalmar sirrin mai amfani ba ne kuma jufaɗɗen da aka musanya shine ɗayan sanannen dalilin ramin da ya kasa. Idan haɗin ya yi nasara a ƙarshe, rubuta wace yarjejeniya aka tattauna domin na gaba ya fara daga gaskiya maimakon maimaita wannan zato.