Windows VPN Group24 iyo MODP3072: koox tee ayaad u baahan tahay?
Lambarka kooxuhu waa diiwaangelin gelin, ma aha kala-saarid cabbir. Ku xidh magaca parameters-kiisa, ka dib hubi kooxaha uu parameter-ka Windows muujin karo.
Group24 iyo MODP3072 labaduba waa magacyo koox is-weydaarsi fure, mana aha isla koox xoog kala duwan. Group24 wuxuu isku daraa modulus 2048 bit ah iyo koox-hoosaad amar-bilow 256 bit ah, halka MODP3072 uu yahay kooxda 15 ee 3072 bit. Mid doorashada marka kan kale la cayimay waxay beddelaysaa shuruudda halkii ay buuxin lahayd. Afar arrimood ayaa go'aamiya natiijada, mana jiro mid ka mid ah oo u baahan in la aamminsado magac u eg.
Lambarku waa diiwaangelin gelin, ma aha darajo
IANA waxay lambareeyaa kooxaha is-weydaarsi fure sida ay u diiwaangashanaayeen, sidaas darteed lambar weyn macneheedu waa gelin diiwaangelin dambe, ma aha koox xoog badan. Kooxda 14 waa MODP 2048 bit, kooxda 15 waa MODP 3072 bit, kooxda 24-na waxay isku daraysaa modulus 2048 bit ah iyo koox-hoosaad amar-bilow 256 bit ah. Akhrinta aqoonsiga sida kala-saarid cabbir waxay abuurtaa isla khaladaadka ah in 24 loo arko mid ka weyn 15. Magacu waa calaamad, parameters-ka ka dambeeyaana waa waxa gorgortanku dhab ahaan isticmaalo.
| IANA group | What the group is | Expressible as Windows DHGroup | What a mismatch looks like |
|---|---|---|---|
| 14 | A 2048-bit finite-field modulus | Group14 | The gateway reports modp2048, which is the same group in other vocabulary |
| 15 | A 3072-bit finite-field modulus | Not in the documented enumeration | You cannot request it from this parameter; a gateway reporting modp3072 was configured elsewhere |
| 24 | A 2048-bit modulus with a 256-bit prime-order subgroup | Group24 | The gateway reports modp2048s256, so the two names differ while describing one group |
| 20 | The NIST P-384 curve | ECP384 | The gateway reports ecp384, and that 384 counts a field size rather than a modulus |
Kooxaha qalooca elliptical waxay ku daraan jahawareerkooda, sababtoo ah tirada bit ee qalooca waxay qeexdaa berrin ma aha modulus. Isbarbardhigga P-384 iyo koox berrin xaddidan 3072 bit sida tirooyinku isku shay cabbirayaan waxba kuma sheegaan.
Waxa tirinta Windows muujin karto
Diiwaanka IKE iyo parameter-ka macmiilka Windows waa interface kala duwan oo leh eray bixin kala duwan. Tixraaca cmdlet-ka VpnClient ee Microsoft wuxuu diiwaangelinayaa in DHGroup uu aqbali karo None, Group1, Group2, Group14, ECP256, ECP384 iyo Group24. Group15 kama muuqdo kooxdaas diiwaangashan, taas oo macneheedu yahay parameter-ku ma muujin karo kooxda lagaa codsaday. Kani waa xaddidid interface, ma aha bayaan ku saabsan kooxaha uu borotokoolku taageero.
Bixinta xaraf-qoraal aan liis ku jirin, tiro dhan ama xaraf-si aan la koobiray waxay kordhin maayso tirinta. Hubi tixraaca nooca Windows ee aad dhab ahaan geynayso, haddii kooxdu aan la heli karin, natiijada daacadda ah waa siyaasad kale oo la ansixiyay ama macmiil kale.
Kala sooc DHGroup, PfsGroup iyo nooca shahaadada
DHGroup wuxuu doortaa kooxda is-weydaarsi fure IKE, PfsGroup-na wuxuu maamulaa qarsoodiga horay u socda ee ururrada taraafikada la ilaaliyay ee soo socda. Waa berrinno gooni ah, sidaas darteed mid si sax ah u dhigista waxba kama sheegto kan kale. Furaha RSA ama ECDSA ee shahaadadu waa astaamaha saddexaad, wuxuuna ka tirsan yahay xaqiijinta ma aha is-weydaarsiga muddada gaaban. Sidaas darteed hal profile wuxuu noqon karaa mid sax ah lakabka mid ka mid ah oo khalad ah mid kale, xiriirka guulaystana ma muujin doono midka.
Warbixinnada sheegaya in nooc shahaado gaar ah uu ku qasbay koox ECP xiriir kasta IKEv2 waxay qeexaan hal isku-dhaf oo habaynno. Ma dejinayaan qaanuun borotokool, u qaadashooda qaanuun-na waa dariiqa ay wax-yar-yaqaan maxalli ah u noqoto siyaasad.
Akhri kooxda ay gorgortamka ku sameysay gateway-ga
Module-ka VpnClient wuxuu bixiyaa Set-VpnConnectionIPsecConfiguration sida interface qoraal-keliya, kumana jiro Get- cmdlet u dhigma oo dib u akhriya siyaasaddaas host-ka. Qor qiimayaasha DHGroup iyo PfsGroup ee aad isticmaashay, ka dib gateway-ga ka akhri waxa is-weydaarsigu dhab ahaan isticmaalay. Amarrada ku socodsii xiriir cusub ka dib, ma aha dib-u-xiriir isticmaalay urur hore.
swanctl --list-sas
ipsec statusallProfile sheegaya Group24 halka gateway-gu sheegayo modp2048s256 waa mid iswaafaqsan, sababtoo ah waa isla koox laba eray-bixin. Gateway sheegaya modp3072 halka profile-ku yiraahdo Group24 ma iswaafaqsana, oo dhinac ma fulinayo waxa aad u maleyneyso. Sadarka shahaadadu wuxuu ka jawaabaa su'aasha xaqiijinta gooni ah, berrinka PFS-na saddexaad. Isbarbardhig saddexda ka hor inta aadan qorin qoraal u hoggaansanaan.
Qor kooxda la codsaday, kooxda lagu gorgortamay iyo interface-ka aqbalay ama diiday habaynta. Saddexdaas ayaa ah waxa uu dib-u-eegaha u baahan yahay, waxbana kama mid ah lama qiyaasi karo magaca siyaasadda.