IKEv2 ee Windows iyo FortiGate: saddex dejineed oo dadku isku daraan
Isku-beddelka furayaasha IKE, ilaalinta CHILD SA iyo xaqiijinta dhigaha waa saddex saf oo gooni ah. Lambarrada kooxda ee isku mid ah laba wada-hadal kuma mid noqdaan.
Heshiiska IKEv2 ee u dhexeeya macmiilka Windows iyo albaabka FortiGate ayaa sii fashilma, raadinta lambar aan isku mid ahna waxay soo saartaa liis lambarro ah oo dheeraad ah. Liiska waxa uu noqdaa mid la maareyn karo oo kaliya marka loo qaybiyo saddex saf oo si madax-bannaan u fashilma: isku-beddelka furayaasha ee ilaaliya IKE, ilaalinta lagu dabaqo CHILD SA, iyo xaqiijinta caddaynaysa qof kasta oo dhinac ah. Lambarrada kooxdu waxay ka muuqdaan laba ka mid ah safafkaas waxayna leeyihiin macne kala duwan.
Saddex saf oo si madax-bannaan u fashilma
Safka koowaad waa isku-beddelka furayaasha ee gudaha IKE laftiisa, kaas oo soo saara furayaasha ilaaliya gorgortanka. Kan labaad waa soo-jeedinta CHILD SA, oo ilaaliso taraafikada uu tunnel-ku qaado. Kan saddexaad waa xaqiijin, oo go'aamisa waxa dhinac kastaa soo bandhigo iyo sida kan kale u xaqiijiyo.
Fashilmaynta waxay ku dhacdaa meelo kala duwan. Fashilka isku-beddelka wuxuu joojiyaa gorgortanka ka hor inta aan tunnel la hayn. Fashilka CHILD SA wuxuu dhacaa ka dib marka xaqiijintu guulaysato, mararka qaarkood kaliya marka furayaasha la cusboonaysiinayo. Fashilka xaqiijinta waxa uu diiwaannada uga muuqan karaa sida fashilka isku-beddelka haddii aad akhrido qaladka koowaad oo kaliya.
Safafka kala-soocidda ma aha xisaabaad. Waxa ay beddelaa dejinta qaabka ah ee mudan in la beddelo, waxayna ka hortagtaa tallaabada ugu qaalisan dhammaan goobtan, taas oo ah dib-u-soo-saaridda shahaadooyin shaqeynaya si loo hagaajiyo is-maqal-keenka soo-jeedinta. Beddelka saf qudha waa in aanu waligiis qasbin labada kale in ay la beddelaan. Madax-bannaanidaas waa sababta oo dhan ee qoraalka gooni ah.
Waxa labada goobood ee Windows ay maamulaan
Windows waxa uu labada goobood si gooni ah u hayaa: DHGroup waxa uu habeeyaa isku-beddelka IKE laftiisa, halka PfsGroup uu habeeyo siyaasadda IPsec ee ilaaliso taraafikada tunnel-ka dhexdiisa. Waxay ka tirsan yihiin wejiyo kala duwan. Isbarbardhigga goob IKE oo Windows ah iyo qiimaha wejiga 2 ee FortiGate waxa uu tijaabiyaa lammaanaha khaldan, lambarraduna way isku mid noqon karaan iyada oo isku-beddelka hoose uu wali fashilmayo.
Get-VpnConnection -Name "Corp-IKEv2"
Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSAAmarka labaad iyo saddexaad waxay soo sheegaan ururada amniga ee dhab ahaan jira, taasna waa waxa ugu dhow jawaabta macmiilku ku siin karo. Ururka hab-weyn oo aan lahayn ururka hab-degdeg ah waa dhibaatada CHILD SA, waana calaamadda is-maqal-keenka wejiga 2 ee aan ahayn dhibaatada shahaadada.
Diiwaangeli waxa la soo jeediyay iyo waxa la doortay hal isku-day. Liiska la soo jeediyay oo ka kooban soo-jeedin la aqbali karo iyo soo-jeedinta la doortay oo aan waafaqsaneyn siyaasadda albaabka waa is-afgarad la'aan habeyn, ma aha sir gelitaan.
| Agreement row | Where it is configured in Windows | What it does not decide |
|---|---|---|
| IKE key exchange | DHGroup on the VPN connection IPsec settings | The protection used for tunneled traffic |
| CHILD SA protection | PfsGroup in the same policy object | Which certificate the peer presents |
| Peer authentication | Machine or user certificate, or a supported EAP method | Any group number used for key exchange |
| Certificate validation | Trusted CA store on the validating side | The private key of the certificate being presented |
Kooxda qalooca elliptical ma doorato furahaaga saxeexa
Gabagabada khaldan ee ugu adkaysiga badan goobtan waa in doorashada kooxda DH ee qalooca elliptical ay u baahan tahay shahaado qalooca elliptical. Kooxda DH waxay bixisaa maaddada isku-beddelka furayaasha; algorithm-ka saxeexa waxa ka gorgortama qaabka xaqiijinta, labaduna waa laba go'aan oo gooni ah IKEv2 dhexdiisa.
RFC 7427 waxa uu jiraa sababta oo ah go'aannadaas hore ayaa isku qasan, waxaanu qeexaa sida algorithm-yada saxeexa loo dhawaaqo oo loo doorto si ka madax-bannaan isku-beddelka furayaasha. Albaabku waxa uu isku mar taageeri karaa koox qalooc iyo doorasho qaabab saxeex.
Sidaas darteed marka gorgortanku fashilmo ka dib beddelka kooxda, fiiri habka xaqiijinta ka hor inta aanad fiirin nooca furaha shahaadada. Beddelka shahaadadu waa hawl gaabis ah oo khatar leh oo marar dhif ah jawaabta, haddii aad marka hore sameyso waxa aad burburisaa awooddaada aad ku ogaato isbeddelka run ahaantii caawiyay. Akhri safka xaqiijinta ka hor inta aanad taaban kaydka shahaadada.
Labadaba ku hay safafka gooni ah ee xaashida heshiiska oo khaladku ma noqon doono mid soo jiidasho leh. Saf qudha waxa uu taxaa kooxo, kan kalena wuxuu taxaa qaabab saxeex iyo aqoonsiyo, midkoodna ma aha caddayn ku saabsan kan kale.
Furaha gaar ah ee kasta la dhig milkiilaha dhabta ah
Albaabka soo bandhiga shahaadiisa u gaar ah waxa uu u baahan yahay furaha gaar ah ee u dhigma. Dhigaha xaqiijiya silsilad waxa uu u baahan yahay shahaadada CA, gaar ahaanna uma baahna furaha saxeexa CA. Qasan labadan saddexda qaybood ayaa ah sababta dadku u soo dejiyaan furaha gaar ah ee CA qalabka VPN si shahaadadu ugu muuqato qayb kale.
FortiOS dhexdiisa doorarku way kala duwan yihiin: shahaado maxalli ah oo furaheeda la socota, shahaado fog oo loo isticmaalo aqoonsiga dhigaha, iyo gelitaanka CA fog oo aasaasaya kalsoonida shahaadooyinka ay saxeexday CA-daas. Gelitaanka CA fog oo aan lahayn furaha gaar ah ma aha mid aan dhamaystirnayn; waa mid sax ah ujeeddadiisa.
Furayaasha saxeexa CA ee la soo dejiyay waxay ballaadhiyaan awoodda qof kasta oo akhrin kara qalabkaas. Sidoo kale ma xalliyaan xaqiijinta caadiga ah ee dhigaha, sababta oo ah xaqiijintu waxay u baahan tahay shahaadada dadweynaha iyo go'aanka kalsoonida, ma aha awoodda soo saarista shahaadooyin cusub.
Furaha saxeexa CA la hayso habka soo-saaraha laftiisa, oo diiwaangeli qalabka qabta furaha. Shax gaaban oo milkiilayaal ah ayaa ka qiimo badan shax dheer oo algorithm-yo ah marka hubintu waydiiso cidda cidda u ekaan karto. Qofna ma soo dejiyo furaha uu og yahay in uu kaliya tiri ku yahay. Qor tiri ka hor dhacdada, ma aha ka dib.