Khaladka 789 ee L2TP/IPsec ee Windows: samee profile-ka oo dheji soo jeedinta

Khaladka 789 ee xiriirka L2TP ee Windows macneheedu waa tunnel-ku wuxuu ku dhintay gudaha isdhaafsiga amniga IPsec, taas oo dhacda wax badan ka hor inta Windows uusan meel walba u dirin ereysirka isticmaalaha. Dib u tijaabinta ereysirka, ama dib u dejinta galka, ma hor marin karto tallaabadaas. Waxa hor mariya waa dib u dhiska xiriirka PowerShell oo leh soo jeedinta uu gateway-ga dhab ahaan bixiyo, sababtoo ah wizard-ka Dejinta wuxuu si aamusan u doortaa isbeddellada IPsec oo waligiis kuu muujin waxa uu doortay. Kani waa buugga hagidda arrintaas: samee profile-ka, dheji soo jeedinta, kadib isticmaal shaxda tallaabooyinka si koodka xiga uu wax kuu sheego.

Samee profile-ka adigoon wizard-ka isticmaalin

Add-VpnConnection wuxuu qoraa gelitaan asli ah oo buugga telefoonka, marka natiijadu waa isla shayga uu app-ka Dejinta mar dambe tafatiran doono. Ka socodsii fadhi sare marka xiriirku waa inuu u jiraa akaun kasta oo mishiinka ah, ama ka socodsii macnaha isticmaalaha marka uu qarsoodi ahaan doono:

Add-VpnConnection -Name "Contoso L2TP" `
  -ServerAddress 203.0.113.10 `
  -TunnelType L2tp `
  -EncryptionLevel Required `
  -AuthenticationMethod MSChapv2 `
  -RememberCredential -Force

La jaanqaad -AuthenticationMethod waxa gateway-ga bixiyo. MSChapv2, EAP iyo PAP isma beddeli karaan, profile-ka dalbaya hab uusan server-ku aqbalayn wuxuu guuldareystaa ka hor inta aan la eegin wax diiwaan isticmaale ah. Hayso -EncryptionLevel Required wax kasta oo dhab ah; Optional wuxuu u ogolaanayaa Windows inuu aqbalo tunnel aan sireed lahayn haddii dhinaca kale mid bixiyo, taas oo ah waddo gaaban oo shaybaadhka ah oo aan ahayn dejinta la diro.

Haddii aad gudbiso -L2tpPsk, furahaas hore loo wadaagay waxaa lagu qoraa profile-ka disk-ka, halkaas oo qof kasta oo awood u leh inuu profile-ka ku akhriyo mishiinkaas uu dib u soo ceshan karo. Isticmaal shahaado si aad u xaqiijiso dhinaca kale marka gateway-gu taageero, iyo marka PSK aan laga maarmi karin, ka hay meel ka baxsan kaydka iyo taariikhda shell-ka halkii aad ku dhejin lahayd socod kasta oo bixin ah.

Dheji soo jeedinta halkii aad aqbali lahayd qiimaha caadiga ah

Windows ayaa isagu buuxiya isbeddellada IPsec, taasina waa sababta laba mishiin oo xiriir isku mid ah u eg ay ugu guuldareystaan si kala duwan isla gateway-ga. Set-VpnConnectionIPsecConfiguration waa habka la taageeray ee lagu dhejiyo:

Set-VpnConnectionIPsecConfiguration -ConnectionName "Contoso L2TP" `
  -AuthenticationTransformConstants SHA256128 `
  -CipherTransformConstants AES128 `
  -EncryptionMethod AES128 `
  -IntegrityCheckMethod SHA256 `
  -DHGroup Group14 `
  -PfsGroup None `
  -PassThru -Force

Qaybtaas waa hal habayn L2TP/IPsec oo caadi ah, ma aha jawaab caalami ah. Qayb kastaa waxay qaadataa liis qumman oo qiimayaal ah, isku darka aan platform-ku maabi karin waxay ku soo noqotaa khalad cmdlet halkii profile si aamusan u daciifay. U qaado khaladkaas hadal ku saabsan qiimayaasha, ma aha oggolaanshahaaga.

Koobbi soo jeedinta dukumeentiga gateway-ga ama dejinta fiiqan ee wajiga 1 iyo wajiga 2, oo beddel hal goob markiiba kaliya inta gateway-gu diiwaangelinayo isbeddellada uu diiday. Dhex marista shan goobood waxay soo saartaa xiriir shil ku shaqeeya iyo diiwaan aan waxna u sharraxayn qofka xiga.

Akhri guuldareysta tallaabo ahaan, ma aha qoraalka khaladka

789 wuxuu ka tirsan yahay qoys koodad ah oo dhammaantood isku mid uga muuqda wada-hadalka macmiilka. Kahor inta aadan mar kale taaban profile-ka, dhig koodka wajiga uu ka tirsan yahay:

Halkan laba doorka aqoonsiga ayaa muhiim ah. Fure hore loo wadaagay ama shahaado ayaa labada dhinac isu xaqiijiya, halka MSChapv2 ama EAP ay adiga kugu xaqiijiyaan gudaha tunnel-ka. Dib u dejinta ereysirka isticmaalaha ma hagaajin karto kan koowaad, sir cusub oo la wadaagay ma hagaajin karto kan labaad, labadaba hal mar beddelidduna waxay baabi'isaa caddaynta midka qaldanaa.

Jidka shahaadada, hubi saacadda macmiilka, silsiladda kalsoonida iyo aqoonsiga gateway-gu filayo ka hor inta aadan ka fikirin dabacsanaanta xaqiijinta. Daminta xaqiijinta waxay 789 muuqata u beddelaa tunnel ku xirma isagoo ku kalsoon dhinaca qaldan, waxna kuma sheegayo macmiilka in taas dhacday. liiska khaladaadka gelitaanka fog ee Microsoft waa tixraaca koodadka laftooda, waxayna kala soocaa guuldareysta lakabka amniga iyo guuldareysta gelitaanka.

Xaqiiji labada daraf ka hor inta aadan sheegan in la hagaajiyay

Dib u akhri profile-ka, laakiin ha filanin soo jeedinta wax soo saarka. Get-VpnConnection wuxuu soo sheegaa magaca, cinwaanka server-ka, nooca tunnel-ka, heerka sireedka iyo habka xaqiijinta, waxna kama oga isbeddellada, marka akhrintu waxay xaqiijinaysaa in gelitaanku jiro oo u jeedo martigeliyaha saxda ah:

Get-VpnConnection -Name "Contoso L2TP" |
  Select-Object Name, ServerAddress, TunnelType, EncryptionLevel, AuthenticationMethod

Wac khadka amarka si aad u hesho lambar halkii wada-hadal: rasdial "Contoso L2TP" wuxuu soo celiyaa isla koodka guuldareysta ee interface-ku soo celin lahaa, rasdial "Contoso L2TP" /disconnect wuxuuna tirtiraa inta u dhaxaysa isku dayga. Kadib akhri dhinaca gateway-ga isla isku daygaas. ipsec statusall ee strongSwan ama diiwaanka IKE ee router-ka wuxuu sheegaa soo jeedinta soo gaadhay iyo tan la diiday, iyo in la barbardhigo qiimayaasha cmdlet waa tallaabada kaliya ee dhab ahaan caddaynaysa in labada daraf ay heshiiyeen.

Xiriir guuleysan ma aha khadka dhammaadka. Fur app-ka isticmaalaha danaynaya, sababtoo ah waddooyinka, DNS la riixay iyo dejinta tunnel-ka qaybsan waxay guuldareystaan ka dib marka tunnel-ku kaco oo ma soo saaraan wax wada-hadal khalad ah.

Otomaatigee, oo si nadiif ah dib u celi

Dejinta aan la ilaalin waa sababta loo skiriptay tan, tallaabada wicitaankuna waa halka aqoonsigu ku daadanayo. rasdial wuxuu ku qaataa khadka amarkiisa, halkaas oo isticmaalayaasha kale ee maxalliga ah iyo inta badan ururiyayaasha diiwaanka ay akhriyi karaan:

subprocess.run(["rasdial", "Contoso L2TP"], check=True)

Dooro aqoonsi ku xaddidan akaunka shaqada socodsiiya, ama u ogolow profile-ka inuu ku kaydiyo -RememberCredential, halkii aad ereysirka u gudbin lahayd dood ahaan hawsha qorshaysan. Amarro bixinta laftoodu waa badbaado in lagu celceliyo -Force, laakiin waxay si farxad leh u sarraysiin doonaan soo jeedin duug ah, marka dib u socodsiintu waxay caawinaysaa kaliya haddii skiriptu sido qiimayaasha hadda.

Profile-yadu waxay ku sii jiraan dib u kicinta waxayna ka noolaadaan konfigurashanka gateway-ga ee loo dhisay in ka badan. Marka soo jeedinta gateway-gu dhaqaaqdo, ka saar gelitaanka oo mar kale samee halkii aad ku kor dul dhigi lahayd qayb labaad oo qiimayaal ah: Remove-VpnConnection -Name "Contoso L2TP" -Force, kadib ku celi labada cmdlet qaybta cusub.

Ku xir wareegga afar hubin oo skiriptka agtiisa ku nool: Get-VpnConnection wuxuu muujinayaa nooca tunnel-ka iyo heerka sireedka la filayo; gateway-gu wuxuu diiwaangelinayaa wajiga 1 iyo wajiga 2 oo dhammaaday cinwaanka macmiilkaaga; rasdial wuxuu soo celiyaa guul oo app-ku furmaa; iyo soo jeedinta lagu qoray skiriptka waxay la socotaa dejinta gateway-ga ee hadda. Marka 789 xigta timaaddo, barbardhiggaas wuxuu qaataa daqiiqado halkii galab.