VPN na Windows da Cisco Secure Client: wanne ne daidai?
Alama ba ta ambaton wata yarjejeniya: Windows na ba da nau'ikan ciki da yawa kuma na'urar Cisco na ɗauke da bayanan martaba fiye da yanayi ɗaya. Karanta bayanin martabar.
Don wannan ƙofa ɗaya umarni biyu na zuwa: haɗa ta da VPN na Windows, ko shigar da na'urar Cisco. Babu ɗayansu da ya ambaci musayar da ƙofar ke tsammani, domin Windows na gabatar da nau'ikan haɗi na ciki da yawa kuma na'urar mai sayarwa na ɗauke da bayanan martaba fiye da yanayi ɗaya. Dukan alamomin biyu suna bayyana manhaja, yayin da ƙofar ke tattauna yarjejeniya, tabbatar da asali da manufa. Amsar tana cikin bayanin martabar, kuma ana iya karanta shi ba tare da haɗawa ba.
Alamar tana ambaton manhaja, ba musayar ba
Alama da tsarin aiki abubuwa biyu ne daban-daban, kuma babu ɗayansu da ke zaɓar tsarin waya. Windows na ba da jerin nau'ikan ciki, kuma na'urar Cisco na ba da injin bayanan martaba wanda zai iya tafiyar da SSL ko IPsec/IKEv2. Haɗa su biyu na haifar da teburi da ke kwatanta kamfanoni maimakon kwatanta musayar.
Teburin da ke ƙasa yana maye gurbin tambayar samfur da wuraren karatu uku da filin da kowanne ke riƙe. Rubuta waɗannan filayen, kuma rashin fahimta zai ɓace:
| Where to read it | Field name to record | What a mismatch looks like |
|---|---|---|
| Native Windows profile | TunnelType and AuthenticationMethod from Get-VpnConnection | The client offers IKEv2 while the gateway answers only on an SSL port |
| Vendor client profile | SSL or IPsec/IKEv2 mode, plus the client and headend version pair | The imported profile negotiates a mode this headend does not serve |
| Gateway configuration | Protocol, authentication policy and the certificate the headend presents | The client authenticates and then drops, because policy expects another method |
Bayanin Microsoft game da nau'ikan VPN na Windows ya lissafa IKEv2 da SSTP cikin nau'ikan ciki, wanda ke kawar da tunanin cewa bayanin martaba na ciki yana nufin PPTP. Takardun bayanan martaba na Cisco sun bayyana yanayin SSL da yanayin IPsec/IKEv2 tare da manufar hedenda da ta dace. Kowanne mai sayarwa na ba da zaɓuɓɓuka da yawa, don haka babu wani suna da ke nuna yarjejeniya ɗaya.
Abin da nau'ikan ciki ke sa a waya
IKEv2 na tattauna ƙungiyoyin tsaro a kan UDP kuma yana ɗaukar zirga-zirga cikin IPsec, wanda ke sa shi daidai da sauran aiwatarwar IKEv2 maimakon ƙirar Microsoft ta musamman. SSTP na naɗe PPP cikin zaman HTTPS, don haka yana ratsa wakilai waɗanda IKEv2 ba zai iya ba kuma a waya yana kama da TLS ba tare da kasancewa yarjejeniyar TLS VPN ba. Waɗannan abubuwa biyu suna bayyana yawancin tikitin da ke faɗin cewa ramin yana aiki a wata cibiya kuma yana gazawa a wata.
L2TP tare da IPsec da tsohuwar shigarwar PPTP suna cikin jerin zaɓi ɗaya, kuma kasancewarsu a wurin ba ya faɗin komai game da tallafin sabar. Jerin zaɓi menu ne na abin da tsarin aiki zai iya gwadawa, ba sanarwar iya aiki daga ƙofar ba. Karanta shi a matsayin jerin tallafi shi ne yadda farautar takardun shiga na awa biyu ke farawa.
Filayen da suka fi muhimmanci a bayanin martaba na ciki su ne nau'in haɗi, hanyar tabbatar da asali da asalin sabar. Nau'in da ba daidai ba yana gazawa a wani mataki dabam da kalmar sirri mara kyau, kuma wannan bambancin shi ne alamar da ta cancanci bi.
Abin da na'urar mai sayarwa ke ƙarawa: bayanan martaba, ba yarjejeniya ba
Na'urar Cisco kwano ce don bayanan martaba. Yanayin SSL da yanayin IPsec/IKEv2 sun bambanta a musayar, tsammanin tashar jiragen ruwa da rubutun kuskure, kuma bayanin martabar da aka shigo da shi yana zaɓa tsakaninsu. Don haka shigar da na'urar ba ya tabbatar da komai game da isarsu.
Ana haɗa nau'ikan biyu don wani dalili. Ana tattauna fasalulluka, hanyoyin tabbatar da asali da binciken matsayi tsakanin na'ura da hedenda, don haka tsohuwar na'ura a gaban sabon hedenda na iya gazawa ta yadda za a karanta shi a matsayin lalacewar hanyar sadarwa. Wannan haɗin yana cikin ma'anar haɗi, ba cikin bayanin haɓakawa ba.
Bayanan martabar da aka fitar daga wata ƙungiya ba safai ya dace da hedenda na gida ba, kuma shigo da shi na iya barin na'urar tana ba da yanayin da ƙofar ba ta hidimawa. Ka fara karanta yanayin daga bayanin martabar, sannan ka kwatanta shi da yarjejeniyar da aka saita da manufar tabbatar da asali ta ƙofar. Bayan sun daidaita ne kawai hanyar sadarwa za ta zama abin tuhuma. Wannan tsari yana ceton ɗaukar fakiti wanda zai nuna zaman TLS lafiyayye da aka nufa zuwa sabis mara kyau.
Karanta bayanin martabar gida kafin ka canza komai
A Windows ana iya karanta saitin ciki ba tare da bugawa ba, kuma fitarwar tana ambaton nau'i da hanyar tabbatar da asali kai tsaye. Kwatanta waɗannan ƙimar da abin da mai ƙofar ya ce hedenda yana ƙarba. Idan nau'in bai dace da tikitin ba, ka fara gyara tikitin, domin hakan ya fi arha fiye da sake shigar da na'urar da ba ta taɓa yin kuskure ba.
Waɗannan umarni huɗu suna rufe bayanin martabar, hanyoyinsa, ƙoƙarin haɗi da isar tashar jiragen ruwa. Gudanar da su cikin wannan tsari a kan na'ura da bayanin martabar ya riga ya shigar:
Get-VpnConnection | Format-List Name,TunnelType,AuthenticationMethod,ServerAddress
Get-VpnConnection -Name 'Corp' | Select-Object -ExpandProperty Routes
rasdial
Test-NetConnection -ComputerName vpn.example.com -Port 443Gwajin tashar jiragen ruwa shi ne wanda ake karantawa fiye da kima. Mai sauraron TCP 443 da ke ba da shafin shiga da wanda ke ƙare IKEv2 suna kama da juna daga waje, domin tashar wuri ce ba yarjejeniya ba.
Rubuta sakamakon a matsayin filaye uku, na'ura, yanayi da ƙofa, kuma ka ajiye su kusa da tikitin. Duk abin da ya fi guntu yana barin na gaba ya sake gano irin wannan rashin fahimta.