iPhone IKEv2 ilaa RouterOS: aqoonsiga kee ayaa xaggee tagaa
Afar sheegasho oo kala duwan ayaa go'aansada tunnel-ka IKEv2 ee iOS: cinwaanka la waco, aqoonsiga server-ka la filayo, aqoonsiga macmiilka la sheegto iyo maaddada shahaadada.
Gaaritaanka gateway-ka MikroTik waxay xallinaysaa oo kaliya qaybta gaadiidka ee hirgelinta IKEv2 iyo wax kale ma aha. Kadib afar sheegasho oo kala duwan ayaa go'aansada in tunnel-ku samaysmo: cinwaanka telefoonku waco, aqoonsiga server-ka uu filayo, aqoonsiga uu isagu sheegto, iyo maaddada shahaadada ee taageerta sheegashadaas. Ku hubi iyaga sidaas oo kale, oo ku joogso midda ugu horreysa ee aan la jaanqaadin waxa gateway-ku soo bandhigo. Mid kastaa meel kale ayaa laga tafatiraa, taas ayaa keenta in tafatir qalad ah uu badanaa dhaqaajiyo cilladda halkii uu hagaajin lahaa.
| Setting | What it decides | What it has to agree with |
|---|---|---|
| Remote address | where IKE packets are sent | a reachable name or address for the gateway |
| Remote Identifier | which server identity is expected | the gateway certificate name and the peer identity RouterOS presents |
| Local Identifier | who the phone claims to be | the client certificate name and the RouterOS identity entry |
| Certificate payload | trust plus proof of key possession | the issuing chain and a usable client private key |
Hubi goobaha profile-ka sida ay isdhaafsigu u isticmaasho
Cinwaanka fog waa halka uu tagayo xirmada IKE ee ugu horreysa oo wax kale ma aha. Aqoonsiga fog waa waxa telefoonku filayo in gateway-ku caddeeyo inuu yahay, waana magac, ma aha waddo. Labadaba ku buuxin isla magac host-ka ah waxay shaqaysaa marka shahaadada gateway-ku ay waddo magacaas, waana guuldarraystaa si u eg mushkilad waddo marka aysan wadin. Profile-ka u akhri sida taxane sheegashooyin ah, ma aha liis goobo la buuxiyo.
Aqoonsiga gudaha waa sheegashada telefoonka laftiisa, waana inuu noqdaa magac ay gateway-ka RouterOS ee aqoonsiga u aqbalo shahaadada macmiilka ee telefoonku soo bandhigo. Haddii labada aysan is waafaqin, gateway-ku wuu diidaa xiriirka ka dib markii shahaadada laftiisu la xaqiijiyay, log-ka wuxuu u eg yahay mushkilad ogolaansho ee ma aha magac.
Hubi aqoonsiga waxa gateway-ku soo bandhigo
Diiwaanka lammaanaha RouterOS ee loo habeeyay xaqiijinta shahaadada wuxuu soo bandhigaa shahaadadiisa, aqoonsigiisana waxaa laga soo qaataa shahaadadaas haddii aadan si kale u habeyn. Haddii aqoonsiga fog ee telefoonku sheego magaca DNS ee gateway-ka, shahaadada gateway-ku waxay u baahan tahay magacaas meel uu telefoonku aqbalo, badanaa magac kale oo mawduuca ah. Shahaadada loo bixiyay magac kale oo guud ma xaqiijinayso xitaa haddii furaha iyo silsiladdu sax yihiin.
Profile-yada Apple ee la maareeyo waxay sidoo kale qaadi karaan xaddidaad magac shahaadeed oo lagu qiimeeyo goobaha aqoonsiga ka sokow. Baar waxa ku jira halkii aad ka qiyaasi lahayd magaca xaqiijinta waxa shaashadda dejinta muujiso, maxaa yeelay labaduba isku dejin ma aha.
Hubi in shahaadada macmiilku tahay fure, ee ma aha oo kaliya saldhig kalsooni
Soo dejinta shahaadada CA waxay telefoonka siisaa wax uu ku xaqiijiyo gateway-ka. Kuma siiso aqoonsi macmiil, xaqiijinta shahaadaduna waxay u baahan tahay shahaadada caleenta macmiilka iyo fureheeda gaarka ah oo la wada geeyo iyada oo loo marayo waddada diiwaangelinta la ansixiyay. PKCS#12 oo aan furaha gaarka ah lahayn waxay soo saartaa profile nadiif u rakiban oo aan waxba xaqiijin.
Caleenta macmiilka waxay sidoo kale u baahan tahay aqoonsi ay dhanka RouterOS filayso, taas oo macnaheedu yahay in mawduuca ama magaca kale ee mawduucu uu waafaqo habeynta aqoonsiga ee u dhigma. Soo saarista shahaadooyinka macmiilka iyo server-ka isla CA waxay silsiladda ka dhigtaa mid fudud oo kama dhigto labada caleen mid la isku beddeli karo.
Hubi in siyaasadda RouterOS ay aqbasho magacaas
Gateway-ka, diiwaanka lammaanahu wuxuu dejiyaa habka isdhaafsiga iyo habka xaqiijinta, diiwaanka aqoonsiguna wuxuu ku xiraa aqoonsiga fog ee la aqbalay shahaado iyo siyaasadda ku xigta. RouterOS v7, lammaanahaas waxaa lagu muujiyaa diiwaannada lammaanaha iyo aqoonsiga IPsec, tusaale ahaan lammaane IKEv2 oo leh auth-method=digital-signature. Hubi waxa dhabta ah ee menu-ga ku jira nuqulka aad rakibtay, ee ma aha hagaha loo qoray mid hore.
Halkan sidoo kale ayaa isqabsi ku yar tahay in la hagaajiyo, maxaa yeelay gateway-ku wuxuu kuu sheegi karaa aqoonsiga uu helay iyo kii uu doonayay. Ballaarinta aqoonsiga la aqbalay si khaladka loo aamusiiyo waxay meesha ka saartaa xidhiidhka hirgelinta macne u siiyay.
Hubi tallaabada kee ayaa guuldarraystay ka hor inta aadan wax tafatirin
Akhri isku dayga labada dhinac oo kala saar ka hor inta aadan beddelin soo jeedin. Isqabsi soo jeedin, fure saxeex oo maqan, soo saare aan lagu kalsoonaan karin, aqoonsi lammaane oo khaldan iyo ogolaansho macmiil oo la diiday dhammaantood waxay u eg yihiin tunnel dhintay marka telefoonka laga eego, mid kastaana wuxuu leeyahay milkiile kale. Beddelka shanta dejin oo dhan hal mar waxay dammaanad qaadaysaa inaadan waxba ka baran natiijada.
Diiwaangeli aqoonsiga la soo bandhigay, aqoonsiga la filayo, soo saaraha shahaadada iyo lambarka taxanaha iyo magaca siyaasadda khuseeya, adigoo furayaasha gaarka ah iyo sirta profile-ka ka fogaanaya diiwaankaas. Marka xaqiijintu guulaysato, tijaabi adeeg gaar ah iyo jawaabtiisa, maxaa yeelay qoondaynta cinwaannada, doorashooyinka, DNS iyo siyaasadda gelitaanka wali waa inay shaqeeyaan ka dib marka isdhaafsiga IKE dhammaado.