Jawaabaha DPD waxay caddeeyaan in IKE peer uu nool yahay, ma aha in xogtaadu socoto
Jawaabaha nololeed, ogeysiis padding iyo doorashooyin cidhiidhi ah waxay qeexaan saddex shay oo kala duwan. U akhri si gooni gooni ah ka hor inta aadan mid ka mid ah ku eedayn joogitaan.
Diiwaannada IPsec waxay muujin karaan jawaabaha nololeed inta ay codsiga hortiisa taagan yahay, labadaba run bay noqon karaan isla waqti. Jawaabta DPD waxay caddeysaa in habaynta IKE ee peer-ka ay jawaabtay waqtigaas; wax kama sheegto haddii SA carruurta ay qaado baakadda aad danaynayso. U qaadashada digniin kasta oo u dhow cilad inay tahay sababteeda waa sida dhibaatada doorasho loogu ogaado cilad borotokool. Saddex indho-indheyn ayaa inta badan lagu khaldaa, waxayna ka jawaabaan saddex su'aalood oo kala duwan. U akhri iyaga iyadoo la eegayo xiriirka iyo ujeeddada ka hor inta aadan u akhrin sumadda waqtiga.
Waxa ay indho-indheyn kastu caddeyso
Shaxdu waxay kala soocdaa waxa indho-indheyn kastu dhigto iyo waxa ay kaliya la socoto.
| Observation | What it establishes | What it leaves open |
|---|---|---|
| DPD replies arrive | The peer's IKE process answered | The child SA, forwarding path and application reply |
| TFC padding notification | The peer will not accept padding for that child SA | Whether ordinary ESP protection still works, which it does |
| Selectors reported as narrowed | The accepted traffic set is a subset of the offer | Whether the subset includes the flow the user needs |
Mid ka mid ah saddexda ma aha khalad iskiis. Mid kastaa wuxuu noqdaa mid xiiso leh oo kaliya marka uu ag joogo socodka aad baarayso, safka aan lagu xiri karin socod gaar ah waa macne, ma aha caddayn.
Nolol maaha caafimaadka xogta
DPD waxay u shaqeysaa sida is-weydaarsi INFORMATIONAL, wada-hadal heer kontorool oo u dhexeeya IKE daemons. Jawaabtu waxay caddeysaa in habka IKE ee peer-ku la gaari karo oo diyaar u yahay inuu jawaabo, waqtiga dhammaadkiisuna waxay caddeysaa in aanay sidaas ahayn. Mid ka mid ah natiijooyinka ma tijaabiyo SA carruurta, doorashooyinka, marinka gudbinta ama jawaabta codsiga, sidaas darteed DPD caafimaad qaba oo ag yaal wareejin joogsatay waa sawir iswaafaqsan, ma aha khilaaf.
Taasi waa sababta safafka nololeed ay yihiin qaybta ugu faa'iidada yar ee tikidka heerka xogta, si kasta oo ay ugu qalbi qaboojiso u muuqdaan xagga sare ee diiwaanka.
Ogeysiiska padding waa bayaan ku saabsan padding
Padding TFC waa safka ugu badan ee si xad-dhaaf ah loo akhriyo diiwaannadan. Waxay sheegtaa in padding-ka qarsoodiga socodka taraafikada aan loo aqbalayn SA carruurtaas, taas oo ah bayaan ku saabsan sifo padding ikhtiyaari ah ee ma aha diidmo ka hortagga ESP. Helidda agtii cilad waxay inta badan tahay shil ka dhashay hadal badan, dab-damiska ama damiska padding-na wax kama beddelo daboolka doorashooyinka.
Qeexitaanka IKEv2 wuxuu qeexaa labadaba ogeysiiska iyo gorgortanka doorashooyinka, calaamadda digniinta ee hirgelinna labada xaaladood midna kama beddelo macnaha borotokoolka.
Cidhiidhigu waa aamusnaan badan yahay oo waxay u badan tahay inuu muhiim noqdo
Jawaab-bixiyuhu wuxuu aqbali karaa qayb ka mid ah doorashooyinka la soo bandhigay, kooxda la aqbalayna waxaa lagu daabici karaa dhowr gelitaan, mid port-ku-qalma ah iyo mid kale oo daboolaya dhammaan port-yada. Akhrinta kaliya safka ugu horreeya ee port-ku-qalma ah waxay hoos u dhigtaa waxa la aqbalay; akhrinta kaliya safka ballaaran waxay kor u dhigtaa. Isbarbar dhig soo-jeedinta la daabacay iyo siyaasadda la rakibay, sababtoo ah soo-jeedintu waa waxa peer-yadu yiraahdeen, siyaasadduna waa waxa kernel-ku is waafajin doono. Marka aanay is waafajin, tunnel-ku wuu jiraa taraafikaduna ma jirto, taas oo ah cabashada xilli-xilli ah ee caadiga ah. Marka la isbarbar dhigo peer-yada, rog aragtida maxalliga iyo tan fog, sababtoo ah maxalliga dhinac kastaa waa fogga dhinaca kale.
Gelitaannada martigeliyaha-gaar ah ee leh xaddid port waa in laba jeer la akhriyo, sababtoo ah iyaga ayaa ka reebaya ICMP ama port labaad iyagoo ping-ga xagga iridda u sii shaqeynaya.
Samee hal diiwaan socodka guuldarraysta
Diiwaan gali isha, meesha loo socdo, qoyska cinwaanka, borotokoolka iyo port-ka sida loo arko go'aanka difaaca, oo ay ku jirto wax kasta oo turjumaad ula kac ah. Kuwani waa qiyamka ay tahay in ay la jaan qaadaan doorasho, waxayna sidoo kale yihiin qiyamka dadku ka dib u qoraan xusuusta marka tikidku gaaro saddexda gacan.
Kadib aqoonsi SA carruurta iyo tiriyayaasheeda jihada: swanctl --list-sas wuxuu bixiyaa soo-koobka isku-xirka martigeliyaha strongSwan, ip -s xfrm state wuxuuna bixiyaa tiriyayaasha. Ka akhri iyaga codsi cusub oo la oggolaaday ka dib, ee ma aha inta nidaamku fadhiyo. Kororka taraafikada baxa oo aan jirin waxay tilmaamaysaa xulashada ama dariiqa maxalliga; baxa oo aan lahayn gelitaan u dhigma waxay tilmaamaysaa peer-ka, gudbintiisa ama jawaabihiisa.
Is-weydaarsi codsi oo dhammaaday ayaa ka sarreeya mid kasta oo tiriyayaasha, sidaas darteed imtixaanku waa inuu ku dhammaado codsiga ee ma aha tilmaamaha tunnel-ka.
Kadib dooro sixitaanka
Kaliya marka diiwaankaas jiro ayaa waxaa jira sixitaan la dooran karo: doorashooyin la aqbalay, dariiq, shaandhayn, hirgelin peer ama xad aad hadda muujisay. Dib-u-dejinta peer-ka waxay beddeshaa dhowr xaaladood hal mar oo inta badan soo celisa taraafikada iyada oo aan sharraxin kee khaldanaa, sidaas darteed ciladdu way soo noqotaa. Diiwaannada xaaladda kernel ka fogee tikidka sidoo kale, sababtoo ah waxaa laga yaabaa inay ku jiraan furayaal, soo-koobka cidhiidhina wuu ku filan yahay qof kasta oo u baahan inuu caawiyo.
Marka diiwaanku ka soo horjeedo aragtidaadii ugu horreysay, rumee diiwaanka oo dib u qor aragtida; caadadaas ayaa ka qiimo badan keliya kasta oo saf diiwaan ah oo halkan lagaga hadlay.