Windows VPN Group24 da MODP3072: wace ƙungiya kuke buƙata?
Lambobin ƙungiya shigarwar rijista ne, ba tsarin girma ba. Haɗa sunan da sigoginsa, sannan duba waɗanne ƙungiyoyi sigar Windows za ta iya bayyanawa.
Group24 da MODP3072 duka sunaye ne na ƙungiyar musayar maɓalli, kuma ba ƙungiya ɗaya ba ce da ƙarfi daban-daban. Group24 yana haɗa modulus na bit 2048 da ƙaramin rukuni na oda na farko na bit 256, yayin da MODP3072 ita ce ƙungiya ta 15 mai bit 3072. Zaɓin ɗaya yayin da aka ƙayyade ɗayan yana canza buƙatar maimakon cika ta. Abubuwa huɗu ne ke ƙayyade sakamakon, kuma babu ɗayansu da ke buƙatar amincewa da suna mai kama.
Lambar shigarwar rijista ce, ba matsayi ba
IANA tana lambar ƙungiyoyin musayar maɓalli bisa tsarin da aka yi musu rijista, don haka babbar lamba tana nufin shigarwar rijista ta baya, ba ƙungiya mai ƙarfi ba. Ƙungiya ta 14 MODP ce ta bit 2048, ƙungiya ta 15 MODP ce ta bit 3072, kuma ƙungiya ta 24 tana haɗa modulus na bit 2048 da ƙaramin rukuni na oda na farko na bit 256. Karanta mai gano a matsayin tsarin girma yana haifar da kuskuren ɗaukan 24 a matsayin 15 mafi girma daidai. Sunan lakabi ne, kuma sigogin da ke bayansa su ne abin da tattaunawar ke amfani da shi a zahiri.
| IANA group | What the group is | Expressible as Windows DHGroup | What a mismatch looks like |
|---|---|---|---|
| 14 | A 2048-bit finite-field modulus | Group14 | The gateway reports modp2048, which is the same group in other vocabulary |
| 15 | A 3072-bit finite-field modulus | Not in the documented enumeration | You cannot request it from this parameter; a gateway reporting modp3072 was configured elsewhere |
| 24 | A 2048-bit modulus with a 256-bit prime-order subgroup | Group24 | The gateway reports modp2048s256, so the two names differ while describing one group |
| 20 | The NIST P-384 curve | ECP384 | The gateway reports ecp384, and that 384 counts a field size rather than a modulus |
Ƙungiyoyin lanƙwan ellipse suna ƙara ruɗanin kansu, domin adadin bit na lanƙwa yana bayyana fili ne ba modulus ba. Kwatanta P-384 da ƙungiyar fili mai iyaka ta bit 3072 kamar lambobin suna auna abu ɗaya ba ya gaya muku komai.
Abin da lissafin Windows zai iya bayyanawa
Rijistar IKE da sigar abokin ciniki na Windows muƙamai ne daban-daban da ƙamus daban-daban. Bayanin cmdlet na VpnClient na Microsoft ya rubuta cewa DHGroup yana karɓar None, Group1, Group2, Group14, ECP256, ECP384 da Group24. Group15 baya bayyana a cikin wannan rukunin da aka rubuta, wanda ke nufin sigar ba za ta iya bayyana ƙungiyar da aka neme ku ba. Wannan iyaka ce ta muƙami ba magana ba ce kan waɗanne ƙungiyoyi ka'idar ke tallafawa.
Bayar da rubutun da ba a lissafa ba, lamba cikakkiya, ko igiyar manufa da aka kwafa ba ya faɗaɗa lissafin. Duba bayanin don sigar Windows da kuke da gaske turawa, kuma idan ƙungiyar ba ta samuwa, sakamakon gaskiya shine wata manufa da aka amince da ita ko wani abokin ciniki.
Ka raba DHGroup, PfsGroup da nau'in takardar shaida
DHGroup yana zaɓar ƙungiyar don musayar maɓalli na IKE, kuma PfsGroup yana kula da sirrin gaba don haɗin gwiwar zirga-zirgar da aka kare da ke biyo baya. Filaye ne daban-daban, don haka daidaita ɗaya daidai ba ya faɗi komai game da ɗayan. Maɓallin RSA ko ECDSA na takardar shaida dukiya ce ta uku, kuma tana cikin tabbatarwa ba musayar ɗan lokaci ba. Don haka bayanin martaba ɗaya zai iya kasancewa daidai a wani matakin kuma ba daidai ba a wani, kuma haɗin da ya yi nasara ba zai bayyana wanne ba.
Rahotannin da ke cewa wani nau'in takardar shaida ya tilasta ƙungiyar ECP akan kowace haɗin IKEv2 suna bayyana haɗakar saituna ɗaya. Ba su kafa ƙa'idar ka'ida ba, kuma ɗaukar su a matsayin ƙa'ida shine yadda wani abin mamaki na gida ya zama manufa.
Karanta ƙungiyar da ƙofar ta tattauna
Modul ɗin VpnClient yana bayar da Set-VpnConnectionIPsecConfiguration a matsayin muƙamin rubutu kawai, kuma babu Get- cmdlet daidai da ke karanta wannan manufar a kan mai masauki. Rubuta ƙimar DHGroup da PfsGroup da kuka yi amfani da su, sannan karanta a ƙofar abin da musayar ta yi amfani da shi a zahiri. Gudanar da umarnin bayan sabon haɗi ba bayan sake haɗawa da ya sake amfani da tsohuwar haɗin gwiwa ba.
swanctl --list-sas
ipsec statusallBayanin martaba da ke ba da rahoton Group24 yayin da ƙofar ke ba da rahoton modp2048s256 yana da daidaituwa, domin ƙungiya ɗaya ce a cikin ƙamus biyu. Ƙofar da ke ba da rahoton modp3072 yayin da bayanin martaba ya ce Group24 ba ta da daidaituwa, kuma gefe ɗaya ba ya tilasta abin da kuke tsammani. Layin takardar shaida yana amsa tambayar tabbatarwa daban, kuma filin PFS yana amsa ta uku. Kwatanta duka uku kafin rubuta bayanin bin ka'ida.
Rubuta ƙungiyar da aka nema, ƙungiyar da aka tattauna da muƙamin da ya karɓa ko ya ƙi saitin. Wannan ukun shine abin da mai bita ke buƙata, kuma babu ɗayansu da za a iya gane shi daga sunan manufar.