Ingabe insizakalo eyodwa ye-VPN ingahlanganisa amadeskithophu e-Windows, Mac ne-Linux?
Uhlelo olulodwa lokufinyelela lungasebenza kumadeskithophu e-Windows, Mac ne-Linux, kodwa kuphela ngemuva kokunqunywa kobunikazi begeyithi, imininingwane yokungena, imizila kanye nenqubomgomo yesixazululi.
Ama-laptop amathathu eqenjini elilodwa, amamenyu e-VPN amathathu ahlukene, kanye nekhithi ethi ukuxhumana kuyasebenza yonke indawo ngaphandle kwe-Mac. Uhlelo olungemuva kwalawo maklayenti lungafana noma amamenyu engafani. Okumele kuhambisane kuncane kunalokho okucatshangwa ukusatshalaliswa okuningi: ubunikazi obubodwa begeyithi, uhlobo olulodwa lwemininingwane yokungena, isethi eyodwa yemizila kanye nenqubomgomo eyodwa yesixazululi. Bhala lokho okune ngaphambi kokuba noma ubani akhiphe iphrofayela, futhi umsebenzi wepulatifomu uzoba uhlu lokuhlola esikhundleni sophenyo.
Qala ngesivumelwano sokufinyelela, hhayi ngefayela leklayenti
Isivumelwano sokufinyelela siyimigqa emihlanu umhloli angayiqinisekisa ngaphandle kokuvula ikhonsoli yomhlinzeki. Sisho izijobelelo zangasese okumele zifinyeleleke, amagama angaphakathi okumele axazululwe, isixazululi esibaphendulayo, ithrafikhi evunyelwe ukuhlala emzileni wasendaweni kanye nesitifiketi segeyithi okumele iklayenti ilindele ukusibona. Konke okunye ekusatshalalisweni ukuhunyushwa kwaleyo migqa ibe yifomethi yefayela.
Isibonelo sasehhovisi senza isimo sibe sobala: amaseva ezinhlelo ase-10.60.0.0/16, amagama angasese ngaphansi kwe-corp.example, isixazululi sangaphakathi siku-10.61.0.53 futhi ukuphequlula okuvamile kushiywa emzileni okusetshenziswa yiwo idivayisi. Into yokugcina isinqumo senqubomgomo, hhayi okujwayelekile kweklayenti, futhi amaklayenti amaningi azothumela konke ngomhubhe uma kungekho osho okunye. Rekhoda isivumelwano nosuku kanye nomnikazi, ngoba yilowo mbhalo ozokutshela kamuva ukuthi ushintshile umhubhe noma inqubomgomo.
Khetha iphrothokholi eyodwa kanye nekhopho yokuqinisekisa ubunikazi oyedwa ongayivikela
I-IKEv2 enokuqinisekiswa kwegeyithi okusekelwe kusitifiketi kanye ne-EAP yomsebenzisi iyikho okuvame ukukhethwa lapho womathathu amapulatifomu kufanele asebenze ngaphandle kwesofthiwe eyengeziwe, ngoba i-Windows, i-macOS ne-NetworkManager ngayinye ihambisana neklayenti le-IKEv2. Inkinga ukuthi ukusekela i-IKEv2 kuchaza ilebula, hhayi isethi yezici. Izindlela ze-EAP, okhiye abasekelwa yi-hardware, ukumatanisa kwesitifiketi ne-akhawunti kanye nokuxhuma kabusha okuzenzekelayo kusetshenziswa ngayinye ipulatifomu. Inhlanganisela esebenza kokubili kokuthathu ivamile ngokwanele ukuthi uyithathe njengeqiniso kuze kube ihloliwe.
Hlola leyo khopho kuyo yonke ipulatifomu eqondiwe ngaphambi kokuba kubhalwe umhlahlandlela wokusatshalaliswa, hhayi ngemuva. Igeyithi enikeza kokubili i-EAP-MSCHAPv2 ne-EAP-TLS ikunika indawo yomzila wokubuyela emuva, inqobo nje uma lowo mzila ubhalwe phansi njengosekelwayo hhayi otholwe phakathi kwesigameko. Imizila emibili esekelwayo iwumshwalense oshibhile; umzila wesithathu ongabhalwanga phansi uyikhithi yesikhathi esizayo.
Lapho kungekho khopho eyodwa ehlanganisa womathathu amaklayenti, izinketho eziqotho ukuengeza iklayenti, ukwengeza iphrofayela kugeyithi noma ukunciphisa uhlu lwamapulatifomu asekelwayo. Ukucisha ukuqinisekiswa kwesitifiketi kupulatifomu ekhala kakhulu akuyona enye yazo. Lolo shintsho luguqula igebe lokuhambisana lube yingozi yokugadla, futhi asikho isinyathelo sakamuva ekusatshalalisweni esilungisa lokho.
Yakha into yomsebenzi eyodwa ngepulatifomu ngayinye kusukela esivumelwaneni
I-Windows isebenzisa iphrofayela ye-VPNv2, elethwa nge-MDM noma eyakhiwe endaweni nge-Add-VpnConnection kanye nomthwalo wayo we-XML. Okuluma ububanzi nokwethembana. Iphrofayela yobubanzi bedivayisi neyobubanzi bomsebenzisi zifakwa ezindaweni zokugcina ezihlukene, ngakho isitifiketi esidingwa yiklayenti kumele sibe sesikhwameni esihambisana nobubanzi obukhethile. Ukuhlanganisa lokhu ngokungalungile kuveza iphrofayela engena ngokuhlanzekile bese yehluleka ekuxhumakeni kokuqala.
I-macOS isebenzisa iphrofayela yokulungiselela enomthwalo we-VPN ophethwe, esayiniwe futhi isatshalaliswa nge-MDM noma ifakwe ngesandla kuhlelo lokuhlola. Ubunikazi kanye nochunge lwe-CA luhamba njengemithwalo ehlukene, yingakho iphrofayela ingafakwa ngaphandle kwezikhalo bese yehluleka ngesikhathi sokuxhuma. Hlola uhlu lwemithwalo, hhayi umphumela wokufaka kuphela.
I-Linux incike kubhekhendi engemuva kwe-NetworkManager, futhi i-strongSwan kanye nesegezo le-NetworkManager amaphakethe ahlukene. Izakhiwo zokuxhuma ziqondene nesegezo hhayi okhiye be-VPN abajwayelekile, ngakho ukhiye okopishiwe kwesinye isegezo uvame ukugcinwa ngaphandle kwephutha bese uhluleka ekusebenzeni. Yakha ukuxhuma esithombeni esihlanzekile ukuqinisekisa ukuthi isegezo sikhona lapho sizosebenza khona ngempela.
Lezi zinto ezintathu ziyahluka ngefomethi, kodwa ngayinye ibhala imigqa emihlanu yefanelo yesivumelwano. Yilokho ukuhlola ukuthi into yomsebenzi isiqediwe yini: wonke umugqa umelwe endaweni ethile futhi akukho okwengeziwe okwasungulwa endleleni.
| Platform | Artifact | Check before handoff |
|---|---|---|
| Windows | VPNv2 profile or Add-VpnConnection | Scope matches certificate store |
| macOS | Managed VPN payload plus certificate payload | Both payloads present in one profile |
| Linux | NetworkManager connection with strongSwan backend | Plugin package installed on the image |
Qinisekisa imizila, isixazululi nokuxhuma kabusha ku-akhawunti ehlanzekile
Ukuxhumana akulona ukuhlola kokwamukela. Ku-Windows i-Get-VpnConnection ibonisa iphrofayela futhi i-route print ibonisa ukuthi isijobelelo sangasese sehlile yini kusixhumi somhubhe. Ku-macOS i-scutil --nc list iqinisekisa insizakalo esebenzayo kuyilapho i-scutil --dns ibonisa ukulandelana kwesixazululi okuzosetshenziswa ngempela uhlelo.
Ku-Linux i-nmcli connection show --active ifakazela ukuthi ukuxhuma kuvuliwe futhi i-resolvectl status ibonisa i-DNS ngesixhumanisi ngasinye. Isixazululi esikhona efayeleni lokuxhuma kodwa singekho kokuphuma ngesixhumanisi ngasinye sisho ukuthi i-DNS ehlukanisiwe ayisetshenziswa. Lowo umehluko phakathi kwamagama axazululwayo namagama axazululwa ngomhubhe, futhi ushintsha ukuthi yiliphi ithimba losekelo elithatha isinyathelo esilandelayo. Qhathanisa okuphuma ngesixhumanisi ngasinye ngaphambi nangemuva kokuba ukuxhuma kukhuphuke, hhayi ngemuva kuphela.
Sebenzisa lonke ukuhlola nge-akhawunti entsha, ngaphandle kwemininingwane yokungena egciniwe nangaphandle kwesitifiketi esifakwe umlawuli. Bese ukuphinda ngemuva kokumisa nokuqhubeka, kanye futhi ngemuva kokuphoqa ukufakwa kabusha kwemininingwane yokungena. Lezo zinguquko ezimbili ziveza iningi lokwehluleka kokuxhuma kabusha okungakaze kuboniswe ukuxhuma kokuqala.
Nikeza iphakethe inguqulo futhi gcina indlela yokubuyela emuva
Maka iphakethe ngalinye lepulatifomu ngokubuyekezwa kwesivumelwano esikwenzayo, futhi bhala izinguqulo zeklayenti negeyithi oyemukele ngazo. Lapho ukuziphatha kushintsha ngemuva kokubuyekezwa kweklayenti, umaka ukhomba isivumelwano okufanele sihlolwe kabusha hhayi ifayela okufanele liqagelwe.
Gcina iphakethe langaphambilini lepulatifomu ngayinye litholakala futhi bhala umyalo wokulisusa eceleni kwalo. Ukususa iphrofayela ye-VPN akusona isithombe esibonisa ukufakwa kwayo ku-Windows, macOS noma Linux, futhi umehluko uvela ngesikhathi esibi kakhulu. Zijwayeze ukususa kanye kudivayisi yokugcina ukuze ingobo yombhalo ibe uhlelo hhayi ithemba.