Dib-u-dhigista peer ee ASA waxay tirtiraa IPsec SA, ma aha xaaladda IKE ama fadhiyada
Hal clear oo ku xaddidan peer wuxuu burburiyaa kaliya wadada xogta IPsec. Eeg waxa hadha, sababta tunnel-ku ugu dib u dhismayo ilbiriqsiyo gudahood iyo lakabka aad halkii ka nadiifin lahayd.
Tunnel-ku wuu dhacaa hal ab ka, qof ayaa ordaya IPsec clear oo ku xaddidan peer, tikitna waa la xiraa sababta oo ah amarka waa la aqbalay. Wax ka mid ah isku xigxigaas ma muujinayo in cilladda la hagaajiyay. ASA, erayga reset wuxuu daboolaa saddex meelood oo kala duwan, clear-ka ku xaddidan peer-na wuxuu taabtaa mid kaliya oo ka mid ah, taasina waa sababta isla tunnel-kaas badanaa dib u soo baxo ka hor inta aan shaqaaluhu dhammaystirin akhrinta natiijada.
Saddex meelood oo ku qarsoon hal eray
Lammaanaha IPsec SA waa wadada xogta lafteeda, hal xiriir jiho kasta, oo leh lambarrada isku xigxiga iyo tirakoobka. IKE SA waa kanaalka wada-hadalka ee abuuray xiriirkaas oo weli isku haysta xiriirka peer-ka. Fadhi VPN waa diiwaanka ku yaal keydka fadhiyada ee isticmaale, peer goob-ilaa-goob ama xiriir aan macmiil lahayn.
| Scope | What a clear removes | What usually survives |
|---|---|---|
| IPsec SA | Data-path associations for the matching peer or selector | IKE SA, session records, crypto-map or tunnel-group config |
| IKE SA | Negotiation channel and the IPsec children derived from it | Session records until they age out or are cleared |
| VPN session | Session-database entry for that user or peer type | Configuration, and any SA that is not tied to the session |
Meelaha ayaa ku filan madax-bannaan yihiin in nadiifinta mid ka mid ah ay ka tagto kuwa kale shaqeynaya, madax-bannaanidaasna waxay abuurtaa badan jahwareerka. Nadiifi IPsec SA inta IKE SA caafimaad qabo, taraafikuna ilbiriqsiyo gudahood ayuu abuuraa xiriiryo cusub, sidaas darteed tunnel-ku wuxuu u muuqdaa mid is-bogsaday. Laakiin ismaandhaafka soo-jeedinta, bannaanida wadada ama guul-darrida xaqiijinta ayaa weli halkaas ah.
Haddii cilladdu ku jirto wada-hadalka, IPsec clear ma beddelo wax la arki karo.
Akhri xaaladda inta ay weli jirto
Qor ciwaanka peer-ka, nooca IKE ee la isticmaalayo, shabakadaha la ilaaliyay iyo tirakoobka jihooyinka ka hor inta aanad taaban wax. Muuqaallada la taageeray way ku kala duwan yihiin nooca, laakiin qaababku waa xasilloon yihiin: show crypto ipsec sa peer, show crypto ikev2 sa detailed ama u dhigma IKEv1, iyo show vpn-sessiondb lakabka fadhiyada.
Qor shaabadda waqtiga iyo cilladda saxda ah ee isticmaaluhu arko natiijadaas agteeda. Hal peer badanaa wuxuu qaadaa dhowr shabakadood oo la ilaaliyay, sidaas darteed baaxadda clear-ka ku xaddidan peer waa selektor kasta oo peer-kaas ah, ma aha hal abka tikit-ka. Dib-u-dhigis aan sawir hore lahayn lama ogaan karo hadhow, sababta oo ah clear-ku wuxuu tirtiraa tirakoobka aad isbarbardhigi lahayd.
Marka hore ururi caddaynta. Clear-ku wuu tirtiraa, shaashad sawir ah oo hadhow la qaato waxay kuu sheegaysaa waxa dib loo dhisay, ma aha waxa jabnaa.
Waxa clear-ka ku xaddidan peer uu dhab ahaan sameeyo
Tixraaca amarraha clear ee Cisco waxay diiwaangelisaa qaabka IPsec ee ku xaddidan peer. Marka ciwaanka dokumentiga la geliyo, wuxuu u eg yahay sidan:
clear crypto ipsec sa peer 198.51.100.42Amarkaas wuxuu burburiyaa xiriirka IPsec ee u dhigma peer-ka. Ma tirtiro IKE SA, ma tirtiro habaynta, mana dib-u-dejiso keydka fadhiyada. Ka ordso waddo maamul oo aan ku tiirsanayn tunnel-ka aad beddelayso, sababta oo ah fadhi SSH oo lagu qaado tunnel-kaas ayaa la dhiman doona isaga, waxaana laga yaabaa in aanu iskiis u soo noqon. Wax kasta oo kale oo qalabka ku yaal way sii shaqeynayaan, taasina waa sababta amarku u dareemo mid aan wax yeelaysayn.
Marka raadinta bartilmaameedka aanay hubaal ahayn, ha u noqon clear aan shuruud lahayn. Qaabka ballaadhan wuxuu gaaraa peer kasta oo qalabka ah, jahwareerka aad abuurto-na wuu ka weynaan doonaa kan laguugu yeedhay.
Xaqiiji lakabka aad rabtay inaad hagaajiso
Ka dib clear-ka, xaqiiji in xiriirku ku soo noqday tirakoob cusub halkii aad ka fikiri lahayd in reset-ku shaqeeyay sababta oo ah liiska peer-ka dib buu u buuxsamay. Kadib tijaabi abka tikit-ku sheegay, sababta oo ah ping guulaystay waxna kama sheegayo fasax adeeg ama fadhi dhacay.
Haddii xiriirku dib u dhismaan oo abku weli guul-darraysto, musharraxiinta hadhay waa lakabka IKE iyo lakabka fadhiyada. Dooro kan aad weli baari karto xaaladdiisa. Isticmaal hawlgalka bartilmaameedka ah nooca dhab ahaan socda, ha ahaado clear IKEv2, clear IKEv1 ama clear keydka fadhiyada oo ku xaddidan nooca fadhiga saxda ah. Tirtiridda iyo dib-u-abuuridda habaynta crypto-map ee joogtada ah si loo qasbo dib-u-dhis waa qiyaas leh dib-u-noqosho dheer.
U gudbi labada sawir, ka hor iyo ka dib, halkii aad mar kale nadiifin lahayd.
Marka reset-ku dheereeyo jahwareerka
Clear-yaal soo noqnoqda waxay qariyaan cilladaha uusan reset hagaajin karin: waddo maqan, selektor aan hadda ku habboonayn shabakadda hoose ee cusub, fure hore loo wadaagay oo dhinac ka mid ah lagu beddelay, ama cusboonaysiinta fure oo si isdaba-joog ah ugu guul-darraysta soo-jeedin aan peer-ku aqbali doonin. Clear kastaa wuxuu jaraa taraafik caafimaad qaba selektor kasta oo peer-kaas ah, halka sababta dhabta ah ay tahay mid aan la taaban. Sidaas ayaa baaritaan shan daqiiqo ah u noqdaa daaqad isbeddel.
Reset xaddidan wali waa faa'iido leh. Nooca faa'iido leh waa mid bartilmaameed ah, la diiwaangeliyay oo ay raacdo baaritaan lakabka ay ahayd inuu hagaajiyo.
Nidaamka shaqada: qor peer, nooca, selektors iyo tirakoobka; xaqiiji meesha cilladdu ka tirsan tahay; ordso clear-ka ugu cidhiidhsan ee u dhigma; xaqiiji xiriirka iyo abka; u gudbi caddayn haddii lakabku soo kabsado laakiin calaamaddu aanay tagin.