I-VPN ye-Android iya ku-Cisco IOS: isivumelwano okufanele usithole kuqala
Ngaphambi kokufaka iklayenti le-Android legethiweyi ye-Cisco IOS, qoqa iphrothokholi, ukuqinisekisa, ubunikazi kanye nomzila. Umhlahlandlela waleso sigaba.
Ucingo kufanele lufinyelele igethiweyi ye-Cisco. Othile usevele washo iklayenti okufanele lifakwe. Lowo uwumkhawulo ongafanele wale nqubo, futhi yingakho umhubhe wehluleka ngemuva kwehora lokubhala kabusha izifakazelo.
Okudingayo kuqala isivumelwano sokuxhumana: iphrothokholi, ukuqinisekisa, ubunikazi, into yokuthembela, ukwabiwa kwamakheli kanye nomzila, okubhalwe ngumuntu ophethe igethiweyi.
Kuthole ngokubhaliwe futhi ukukhethwa kweklayenti kuba ukusesha nje. Kweqa lokho futhi konke ukwehluleka kubonakala njengephasiwedi engalungile.
Qoqa ulwazi ngaphambi kokufaka noma yini
Thumela uhlu kumnikazi wegethiweyi futhi ucele izimpendulo, hhayi igama lomkhiqizo. Izinto eziyisishiyagalolunye zihlanganisa ngokuphelele iphrofayili yokufinyelela kude:
- Igama lomsingathi noma ikheli legethiweyi okufanele iklayenti lishaye kulo, nokuthi kufinyeleleka yini ngaphandle.
- Iphrothokholi nenguqulo: IKEv2, esinye isizukulwane se-IPsec, noma isevisi esekelwe ku-TLS.
- Ubunikazi bozakwabo obulindelwe igethiweyi, nokuthi yona iveza ini emuva.
- Into yokuthembela: iyiphi i-CA esayina isitifiketi segethiweyi, noma kusetshenziswa ukhiye owabiwe ngaphambili.
- Ukuqinisekisa umsebenzisi: isitifiketi, igama lomsebenzisi nephasiwedi ye-EAP, noma ukhiye owabiwe ngaphambili.
- Iphuli lamakheli okungena kulo iklayenti, kanye nesifihli kanye negethiweyi.
- Amaseva e-DNS azosetshenziswa ngaphakathi komhubhe, nokuthi iklayenti kufanele iwamukele yini.
- Iziqalo zendawo eziyiswa ezivunyelwe, nokuthi ukuhamba ngaphandle kwazo kufanele kuvinjwe yini.
- Izinguqulo zeklayenti ezisekelwe kanye nezinguqulo zohlelo lokusebenza locingo, kanye nanoma yisiphi isidingo sokubhalisa.
Ezimbili kulezi zinto zibangela iningi lokwehluleka okungagwemeka. Ngaphandle kwento yokuthembela awukwazi ukuqinisekisa igethiweyi, ngakho iklayenti elilungile libonakala lifile. Ngaphandle kweziqalo ezivunyelwe awukwazi ukuhlukanisa umkhawulo womzila nenkinga yesevisi.
Igama lomthengisi aliyona iphrothokholi
I-Cisco IOS ne-IOS XE zinikeza izinhlelo ezimbalwa zokufinyelela kude, futhi azabelani ngefomethi eyodwa yokudlulisa. I-IKEv2 enephrofayili yesitayela se-FlexVPN akuyona isevisi efanayo nokuhlelwa kwakudala kwe-IKEv1, futhi isevisi yeklayenti esekelwe ku-TLS ingomunye umkhiqizo futhi, ngokuvamile kwenye ipulatifomu endaweni efanayo.
Ngakho iklayenti elinegama elisho umthengisi werutha alifakazeli lutho. Lingase lisebenzise kahle eyodwa yalezo zinsizakalo kanti akukho nezinye. Buza ukuthi iyiphi isevisi ehleliwe, bese uhlola ukuthi imibhalo yeklayenti iyayibiza leyosevisi njengesekelwe yini.
Imibhalo ye-IKEv2 ye-Cisco ngokwayo yehlukanisa isiphakamiso, inqubomgomo, iphrofayili kanye nendandatho yokhiye njengezinto ezihlukene. Leso sakhiwo siwusizo lapho ufunda ukuhlelwa okunamathiselwe kuwe ngothile: kukutshela ukuthi iyiphi into ephethe izilungiselelo ezibalulekile ocingweni olukude, esikhundleni sokuthatha ifayela lonke njengeqoqo elilodwa.
Okuhlanganiswa isitaki esakhelwe ngaphakathi se-Android
I-Android iveza iphrofayili ye-IKEv2/IPsec yepulatifomu nge-Ikev2VpnProfile, enezinhlobo zokuqinisekisa ezihlukene zokhiye owabiwe ngaphambili, isitifiketi se-RSA, kanye negama lomsebenzisi nephasiwedi ye-EAP. Isethenjwa se-Ikev2VpnProfile siyigunya lokuthi umakhi wamukela ini, kuhlanganise negama lomsingathi wegethiweyi kanye ne-CA yezimpande yeseva esetshenziselwa ukusiqinisekisa.
Leyo API iyisitatimende sekhono, hhayi isethembiso sokuhambisana. Ithi ipulatifomu ingenza i-IKEv2 ngalezo zinhlobo zokuqinisekisa. Ayithi isikrini sezilungiselelo se-OEM esithile siveza yonke inkambu, futhi ayithi ifayela lephrofayili elikhishwe komunye umkhiqizo lizongeniswa.
Lokhu futhi kusho ukuthi isitaki esakhelwe ngaphakathi ngeke sikusindise uma igethiweyi igijima isevisi ipulatifomu engayisebenzisi. Uma kunjalo udinga iklayenti lomthengisi elisekelwe umhlinzeki, elifakwe futhi lahlelwa ngendlela umhlinzeki ayibhala, hhayi indlela yokuzungeza eyakhelwe kuphrothokholi ocingo olungayikhulumi.
Hlola ngokulandelana okubhalwe ngakho isivumelwano
Qinisekisa ungqimba olulodwa ngesikhathi futhi ume ekwehlulekeni kokuqala, ngoba izivivinyo zakamuva azinanjongo kuze kudlule ezangaphambili.
Ukwethemba. Uma iklayenti lenqaba isitifiketi segethiweyi, akukho okunye okubalulekile. Qinisekisa ukuthi i-CA oyinikiwe isayina isitifiketi esivezwa igethiweyi, nokuthi igama lomsingathi olidayile likhona kuso. Gcina ukuqinisekisa kuvuliwe; ukuvala kwaso kuguqula inkinga yobunikazi ibe ingozi yokugqilazwa.
Ukuqinisekisa. Izifakazelo ezenqatshiwe kanye nesiphakamiso esingahambisani kuletha amaphutha ahlukene kodwa ukwehluleka okubonakala kufana. Ilogi yegethiweyi iyona enqumayo: izothi isiphakamiso sasamukelekile yini ngaphambi kokusho lutho ngomsebenzisi.
Ikheli ne-DNS. Qinisekisa ukuthi ucingo luthole ikheli kusuka kuphuli olubhaliwe, bese uxazulula igama elilodwa langaphakathi. Umhubhe okhuphuka unekheli kodwa ungenasixazululi ubonakala uxhumekile futhi uziphatha sengathi akukho okusebenzayo.
Ukufinyeleleka. Hlola indawo eyodwa evunyelwe ngekheli, bese ngokwegama. Uma ikheli lisebenza kodwa igama lingasebenzi, ubuyele ku-DNS. Uma kokubili kungasebenzi, qhathanisa isiqalo osihlolayo nohlu oluvunyelwe ngaphambi kokuthinta iklayenti.
Izimo zokwehluleka kanye nokuhlehlisa
| Symptom | Contract item to re-check |
|---|---|
| Profile rejected at import | Protocol or client release unsupported for that service |
| No proposal chosen | IKE version or encryption proposal mismatch |
| Certificate error, correct credentials | Trust material or peer identity |
| Tunnel up, no address | Address pool or authorization on the gateway |
| Tunnel up, names fail | DNS servers or split-tunnel DNS behaviour |
Gcina iphrofayili yokusebenza yangaphambili ikhishiwe futhi ibhaliwe ngaphambi kokushintsha noma yini, kuhlanganise isiteketiso se-CA kanye nephuli lamakheli. Ukuhlehlisa-ke kusho ukubuyisela iphrofayili eyaziwayo, hhayi ukuyivuselela kusukela enkumbulweni ngesikhathi sokuphazamiseka.
Uma isisebenza, bhala izimpendulo eziyisishiyagalolunye zokuqoqa eceleni kwephrofayili. Ucingo olulandelayo, ukubuyekezwa kohlelo olulandelayo kanye noshintsho lwegethiweyi olulandelayo konke kuba ukuqhathanisa nombhalo esikhundleni sendlela yokucabanga.