NO_PROPOSAL_CHOSEN L2TP? Marka hore iska baadh gateway-ga

Weydiinta magaca isticmaalaha weligeed ma muuqato, macaamilkuna wuxuu soo sheegaa NO_PROPOSAL_CHOSEN. Waqtigaas aqoonsiga iyo furaha hore loo wadaagay midkoodna macno ma leh, sababtoo ah labada dhinac kama heshiin sida weji 1 loo ilaaliyo. Dadka badankood waxay ku jawaabaan iyagoo dhejinaya xarig sir ah oo ay internetka ka heleen. Baadhidda gateway-ga waxay ka jawaabtaa isla su'aashaas caddayn, waxayna qaadataa waqti la mid ah.

Waxa fariintu ka reebto

Diidmadu waxay dhacdaa qaabka ugu weyn, ka hor wax kasta oo is-dhaafsiga L2TP ama PPP, sidaas darteed tunnel-ka iyo keydka isticmaalayaasha lama weydiin. Weji 1 wuxuu ka wada hadlaa sir-gelinta, daacadnimada iyo koox Diffie-Hellman. Weji 2 wuxuu ka wada hadlaa soo jeedinta ESP ee xogta. Guuldarada weji 1 laguma hagaajin karo in la beddelo dejinta PFS ee weji 2, iyo isku-xirka IKE oo dhammaaday ma caddeeyo in soo jeedinta ESP ku habboon tahay.

Diiwaangeli backend ka hor inta aadan tafatirin qaab-dhismeedka: ipsec --version. libreswan iyo strongSwan waxay aqbalaan qoraallo kala duwan oo soo jeedinta ah isla algorithms-kaas.

Kadib akhri diidmada iyada oo la xiriirta journalctl --no-hostname _COMM=nm-l2tp-service _COMM=ipsec _COMM=pluto _COMM=charon _COMM=kl2tpd _COMM=xl2tpd _COMM=pppd.

Baadh gateway-ga ururkiisa beddelaadda

Baadhuhu wuxuu si toos ah gateway-ga u weydiiyaa beddelaadaha uu ka wada hadli doono. Marka hore jooji adeegga IPsec ee maxalliga ah si baaritaanku ula tartamin macaamilkaaga, kadib akhri sadarrada SA. U qaado liiska caddayn ku saabsan dhinaca kale, ma aha menu si wadajir ah loo shido.

sudo ipsec stop
sudo ike-scan --trans=3des-sha1-modp1024 10.10.10.250 | grep SA=

Qalabka duugga ah waxay inta badan bixiyaan 3DES, SHA1 iyo MODP1024, sababtoo ah kuwaas waxay ahaayeen qiimaha caadiga ah markii alaabta la diray oo qofna dib uguma eegin. Kaydi soo-saarka ceyriinka ah ee baaritaanka, waayo waa diiwaanka kaliya ee waxa dhinaca kale bixiyay maalintaas. Haddii taasi tahay is-dulsanaanta ugu xoogga badan ee la heli karo, kor u qaadista saxda ah waa loo jeediyaa milkiilaha gateway-ga, ma aha qaabeynta macaamilka ee dib u shida sir-gelinta daciifka ah qof walba.

Isku-dubbarid is-dulsanaanta adigoon damin badbaadada

Geli kaliya beddelaadaha ka muuqda baaritaanka iyo siyaasaddaada labadaba. Tusaalaha hoose wuxuu ka tarjumayaa gateway bixiya 3DES, SHA1 iyo MODP1024 weji 1. Fiiri digniinta backend-ka: libreswan 4.x ma ururiyo kooxda modp1024, sidaas darteed tani waxay khusaysaa strongSwan ama dhismo libreswan oo leh taageerada DH2. Xaqiiji nooca ka hor inta aadan go'aansan in macaamilku xumaaday.

Phase 1: 3des-sha1-modp1024
Phase 2: aes256-sha1,aes128-sha1,3des-sha1

Calaamadda yaabka ee dhamaadka waxay xajinaysaa hal soo jeedin. U isticmaal inaad go'doomiso tijaabo, kadib ka saar si gateway-gu mar dambe uga wada hadli karo wax ka xoog badan.

Hubi daemon-ka iyo dekedda ka hor inta aadan dib u dayin

NetworkManager-l2tp wuxuu bilaabaa xl2tpd u gaar ah. Haddii adeegga nidaamku horey u leeyahay UDP 1701, macaamilku wuxuu u noqdaa deked isha ku meel gaar ah, taas oo RFC 3193 ogolaatay qaar ka mid ah serveryaduna si aamusan u tuuraan. Hubi milkiilaha socket-ka ka hor isku dayga xiga.

sudo ss -unlp | grep 1701
sudo systemctl stop xl2tpd.service
sudo systemctl disable xl2tpd.service

Sirta duugga ah ee la soo saaray waa sabab kale oo aamusan. Faylasha ku yaal /etc/ipsec.d/ oo loogu magac daray isku xirka duugga ah waxay ka sii noolaan karaan profile-ka abuuray, sidaas darteed ka saar kuwa aan waxba tilmaamayn oo dib u day.

Ugu dambeyntii, hubi halka talada ka timid. ipsec.conf oo loo qoray IKEv1 XAuth wuxuu sharraxayaa nooc VPN kale, soo jeedintiisuna ma aha sadarka kaliya ee khalad ka noqon doona profile L2TP. Diiwaangeli ururka beddelaadda aad gashay profile-ka agtiisa, si qofka xiga uusan u celin baaritaanka.