I-peer reset ku-ASA isusa ama-IPsec SA, hhayi isimo se-IKE noma izikhathi
I-clear eyodwa ekhawulelwe ku-peer iqhekeza kuphela indlela yedatha ye-IPsec. Bona okusalayo, kungani i-tunnel yakhiwa kabusha ngemizuzwana nokuthi iyiphi ingqimba okufanele ihlanzwe.
I-tunnel iyawa kuhlelo lokusebenza olulodwa, othile usebenzisa i-IPsec clear ekhawulelwe ku-peer, futhi ithikithi liyavalwa ngoba umyalo wamukelwe. Akukho lutho kulolo hlelo olubonisa ukuthi iphutha lalungisiwe. Ku-ASA igama reset lihlanganisa izigaba ezintathu ezihlukene, futhi i-clear ekhawulelwe ku-peer ithinta esisodwa kuphela sazo, yingakho i-tunnel efanayo ivame ukuba phezulu futhi ngaphambi kokuba umqhubi aqede ukufunda okuphumayo.
Izigaba ezintathu ezifihlekile ngemuva kwegama elilodwa
Ipheya le-IPsec SA iyona ndlela yedatha ngokwayo, ukuhlangana okukodwa ngakunye uhlangothi, ngezinombolo zokulandelana nezibali. I-IKE SA iyisiteshi sezingxoxo esakha lokho kuhlangana futhi esisabambe ubudlelwano ne-peer. Isikhathi se-VPN siyirekhodi kusizindalwazi sezikhathi somsebenzisi, i-peer yendawo-kuya-endaweni noma uxhumano olungenalo iklayenti.
| Scope | What a clear removes | What usually survives |
|---|---|---|
| IPsec SA | Data-path associations for the matching peer or selector | IKE SA, session records, crypto-map or tunnel-group config |
| IKE SA | Negotiation channel and the IPsec children derived from it | Session records until they age out or are cleared |
| VPN session | Session-database entry for that user or peer type | Configuration, and any SA that is not tied to the session |
Izigaba zizimele ngokwanele ukuthi ukuhlanza esisodwa kushiye ezinye zisebenza, futhi lokho kuzimela kuveza iningi lokudideka. Hlanza ama-IPsec SA ngesikhathi i-IKE SA iphikile, futhi ithrafikhi izodala ukuhlangana okusha ngemizuzwana, ngakho i-tunnel ibonakala sengathi izelaphe yona. Kodwa ukungafani kwesiphakamiso, igebe lomzila noma ukwehluleka kokuqinisekisa kusekhona.
Uma iphutha likusezingxoxweni, i-IPsec clear ayishintshi lutho olubonakalayo.
Funda isimo ngesikhathi sisakhona
Bhala ikheli le-peer, inguqulo ye-IKE esetshenziswayo, amanethiwekhi avikelwe nezibali zomkhombandlela ngaphambi kokuthinta noma yini. Ukubuka okusekelwayo kuyahluka ngenguqulo, kodwa izimo ziqinile: show crypto ipsec sa peer, show crypto ikev2 sa detailed noma okulingana ne-IKEv1, kanye ne-show vpn-sessiondb yengqimba yezikhathi.
Bhala isigxivizo sesikhathi kanye nephutha eliqondile elibonwa umsebenzisi eceleni kwalokho okuphumayo. I-peer eyodwa ivamise ukuthwala amanethiwekhi amaningi avikelwe, ngakho ububanzi be-clear ekhawulelwe ku-peer yiwona wonke umkhethi kuleyo peer, hhayi uhlelo olulodwa kuthikithi. I-reset engenaso isithombe sangaphambili ayikwazi ukuxilongwa kamuva, ngoba i-clear isusa izibali ozobe uziqhathanisa nazo.
Qoqa ubufakazi kuqala. I-clear iyabukhipha, futhi isithombe-skrini esithathwe kamuva sitshela okwakhiwe kabusha, hhayi okwakugqekile.
I-clear ekhawulelwe ku-peer yenzani ngempela
I-referensi yemiyalo clear ye-Cisco ibhala uhlobo lwe-IPsec olukhawulelwe ku-peer. Uma kufakwe ikheli ledokhumenti, kubonakala kanje:
clear crypto ipsec sa peer 198.51.100.42Lowo myalo uqhekeza ukuhlangana kwe-IPsec okuhambisana ne-peer. Awususi i-IKE SA, awususi ukucushwa futhi awusethi kabusha isizindalwazi sezikhathi. Yisebenzise kusukela endleleni yokuphatha engathembeli ku-tunnel oyishintshayo, ngoba isikhathi se-SSH esithwalwa ngaphakathi kwaleyo tunnel sizofa nayo futhi kungenzeka singabuyi sodwa. Konke okunye kudivayisi kuqhubeka kusebenza, futhi yikho kanye okwenza umyalo uzwe ungenabungozi.
Uma ukucinga komgomo kungaqinisekile, ungabuyeli ku-clear engenamibandela. Isimo esibanzi sifinyelela yonke i-peer kudivayisi, futhi ukuphazamiseka okukudalayo kuzoba kukhulu kunalokho okushiwo ukubizwa kwakho.
Qinisekisa ingqimba obuhlose ukuyilungisa
Ngemuva kwe-clear, qinisekisa ukuthi ukuhlangana kubuyile nezibali ezintsha esikhundleni sokucabanga ukuthi i-reset isebenzile ngoba uhlu lwama-peer lwagcwala futhi. Bese uhlola uhlelo olushiwo ithikithi, ngoba i-ping ephumelelayo ayisho lutho ngemvume yesevisi noma ngesikhathi esiphelile.
Uma ukuhlangana kwakhiwa kabusha futhi uhlelo lusahluleka, abazongenela abasele yingqimba ye-IKE nengqimba yezikhathi. Khetha lowo ongasakwazi ukuhlola isimo sakhe. Sebenzisa umsebenzi oqondiwe wenguqulo esebenzayo ngempela, kungaba i-clear ye-IKEv2, i-clear ye-IKEv1 noma i-clear yesizindalwazi sezikhathi ekhawulelwe ohlotsheni olulungile lwesikhathi. Ukususa nokwakha kabusha ukucushwa okuhlala njalo kwe-crypto-map ukuze kuphoqeleke ukwakhiwa kabusha wukuqagela okunokuhlehla okude.
Khwezela ngezithombe zombili, ngaphambi nangemuva, esikhundleni sokuphinda uhlanze.
Uma i-reset yandisa ukuphazamiseka
Ama-clear aphindaphindiwe afihla amaphutha i-reset engakwazi ukuwalungisa: umzila ongekho, umkhethi ongasahambisani nesubneti entsha, ukhiye owabiwe ngaphambili oshintshiwe ohlangothini olulodwa, noma ukuvuselelwa kokhiye okuhluleka njalo esiphakamisweni i-peer engasoze yasamukela. Yonke i-clear iphazamisa ithrafikhi ephelele kumkhethi ngamunye waleyo peer ngenkathi imbangela yangempela isala ingathintwanga. Yileyo ndlela uphenyo lwemizuzu emihlanu oluphenduka iwindi loshintsho.
I-reset ekhawulelwe isewusizo. Inguqulo ewusizo iqondiwe, ibhaliwe futhi ilandelwa ukuhlolwa kwengqimba obekufanele iyilungise.
Ukulandelana komsebenzi: bhala i-peer, inguqulo, abakhethi nezibali; qinisekisa ukuthi iphutha lingeliphi igaba; sebenzisa i-clear encane kunazo zonke ehambisanayo; qinisekisa ukuhlangana kanye nohlelo; khwezela ngobufakazi uma ingqimba ilulama kodwa uphawu lungapheli.