I-Cloud VPN iya ku-Cisco ASA: ukwakha kabusha ngemva kokungafani kwesiphakamiso

I-NEGOTIATION_FAILURE ku-tunnel ye-Cloud VPN ene-Cisco ASA ekugcineni kude cishe njalo ingukungafani kwesiphakamiso noma kwama-selector, futhi iqiniso lokuqala eliwusizo ukuthi akukho ukuhlela okuzokulungisa. I-Cloud VPN igxilisa isiphakamiso se-IKE lapho kwakhiwa i-tunnel object. Ayikho indawo yokushintsha i-algorithm endaweni, ngakho ukulungisa ukususa nokwakha kabusha ngephuzu lokuqala elibhaliwe. Kuthatha njengokwakha kabusha futhi umsebenzi uba uhlu lokuhlola esikhundleni sentambama yokuqagela.

Funda ukwehluleka ngaphambi kokususa noma yini

Ukwehluleka kwengxoxo kuyinkinga yesigaba, futhi ilogi yozakwethu ivamise ukusho isigaba. Ukwehluleka kwesigaba 1 kusho ukuthi iziphetho azikwazanga ukuvumelana ngesiphakamiso noma azikwazanga ukuqinisekisa omunye nomunye. Ukwehluleka kwesigaba 2 kusho ukuthi i-tunnel yenyuka kodwa ama-selector avikelwe awavumelani. Lezi ziyizindlela ezihlukene zokulungisa, futhi kufanele kukhishwe umugqa welogi ngaphambi kokuba othile athinte ukucushwa.

Ukwehluleka kuphinde kukhiphe ezinye izinto. Akuwona umzila we-VPC, akusona isimiso se-firewall ku-interface ye-tunnel, futhi akusona iphutha lokuxazulula amagama ngaphakathi kwenethiwekhi. Ukuzijaha kukhiqiza izinguquko eziqinisekile ezingenakushintsha umphumela, futhi kwenza kube nzima ukuthi ukulungisa kokugcina kubhalwe kumuntu.

Bhala kokubili ukucushwa kusekhona

Ukususa i-tunnel kuthatha uhhafu womzuzu futhi kuchitha ubufakazi obukuphela obunabo. Ngaphambi kwalokho, bhala ama-selector asekhaya nawakude, ikheli lozakwethu, ukuthi imfihlo eyabiwe ingeyabani, kanye ne-crypto map noma iphrofayili ye-IKEv2 ye-ASA. I-ASA iphendula imibuzo emibili ehlukene: yini ecushiwe futhi yini esemoyeni manje:

show running-config crypto ikev2
show crypto ikev2 sa
show crypto ipsec sa | include local ident|remote ident|status

Ohlangothini lwe-Google, funda i-tunnel object esikhundleni sesifinyezo se-console, ngoba ikheli lozakwethu kanye nezinkambu zama-selector yiwona mazinga okufanele uwakhiqize ngokunembile:

gcloud compute vpn-tunnels describe tunnel-to-asa --region europe-west1 \
  --format="yaml(peerIp,localTrafficSelector,remoteTrafficSelector,ikeVersion,sharedSecret)"

Faka lawo mazinga kuthikithi ngaphambi kokususa kokuqala. Ukwakha kabusha okungezansi kusebenza kuphela ngoba ungakwazi ukwakha kabusha into efanayo ngomehluko owodwa wamabomu.

Ama-algorithm izinhlangothi ezithile ezenqaba ukuxoxa ngawo

I-Cloud VPN ayikhethi kuhlu lwama-algorithm e-IKEv1 njengozakwethu wendabuko. Izilungiselelo zozakwethu ezizilindele zimile: i-aes-cbc-128 yokubethela, i-sha1-96 kokubili kweqiniso ne-PRF, iqembu le-Diffie-Hellman 2, imizuzwana engu-36,600 yesigaba 1 kanye nemizuzwana engu-10,800 yesigaba 2. Inqubomgomo ye-ASA kufanele inikeze lelo qoqo ngqo. Isiphakamiso sesibili ku-ASA asilimazi uma leso esihambisana naso sikhona ohlwini.

I-IKEv2 inika izinhlangothi zombili indawo eningi, kodwa imithetho igcina isimo esifanayo: vula i-PFS, khetha iqembu le-DH elisekelwa i-tunnel, futhi gcina uhlu lweziphakamiso lufushane ngokwanele ukuthi ukungafani kubonakale. Uzakwethu we-ASA ku-Cloud VPN usho nokuhlela okungaguquki, ngakho amaphrifikisi avikelwe kufanele ahlelwe futhi abhalwe ohlwini esikhundleni sokushiyelwa i-BGP.

Isikhathi sokuphila esikopishwe kusifanekiso somunye umkhiqizi yikhona ukuphambuka okungalungile okuvamile lapha. I-Google ishicilela la mazinga njengezilungiselelo zozakwethu eziyimpoqo, ngakho wabeke; inani elifushane alixoxwa likhuphuke laze lafinyelela lokho i-ASA ekufunayo.

Susa, wakhe kabusha futhi uhlanze isimo esidala

Susa i-tunnel, hhayi i-gateway, futhi bhala igama i-Cloud VPN elinikeza esikhundleni, ngoba amagama ayabelwa futhi awasetshenziswa futhi. Yakha kabusha ngamazinga abhaliwe kanye nekheli lozakwethu elifanayo, bese wengeza isiphakamiso esihambisanayo ohlwini lwenqubomgomo ye-ASA.

Hlanza izinhlangano zokuphepha ngemva koshintsho ku-ASA nangaphambi kokufunda umphumela. I-ASA ingaqhubeka inikeza inqubomgomo endala kuze kuphele i-SA yamanje, ngakho ukucushwa okulungile kubonakala kuphukile isikhathi sonke sokuphila esidala futhi umqaphi uphetha ngokuthi ukwakha kabusha kuhlulekile kanti kwakungakaqali:

clear crypto ikev2 sa
clear crypto ipsec sa

Qinisekisa ukuthi isigaba 1 siyenyuka ngaphambi kokubheka isigaba 2. Ngesikhathi isigaba 1 siphansi, isiphakamiso noma ukhiye owabiwe ngaphambili awulungile, futhi umsebenzi wama-selector ngeke ukushintshe lokho.

Ama-selector ayabonisa, bese kuthi izibali zinqume

Isigaba 2 sisebenza kuphela lapho iziphetho zombili zivumelana ngamakheli avikelwe, futhi ukuvumelana kuyisibonisi hhayi ukwabiwa. I-selector yasekhaya ye-Google kufanele ihambisane ne-selector i-ASA eyibiza ngokuthi kude, futhi i-selector yase-Google ekude kufanele ihambisane nalokho i-ASA ekubiza ngokuthi kwasekhaya. I-tunnel ene-0.0.0.0/0 ohlangothini olulodwa kanye ne-subnet eyodwa kolunye idlula isigaba 1 bese yehluleka kwesigaba 2 ngephutha elikhulu elifanayo. Alukho uhlangothi olungakhulisa uhlu lolunye.

Kuma-selector asuselwa kunqubomgomo, bhala zonke izinhlanganisela zephrifikisi futhi gcina uhlu kuthikithi. I-subnet engezwa kamuva endaweni idinga ukuhlelwa kuzo zombili iziphetho, ngoba umzila omusha ku-ASA awukhulisi i-selector, futhi umphumela yi-tunnel esemoyeni evumela ukuhamba kuphela kwamaphrifikisi ayekhona ngosuku lokuqala.

Qedela ngokugeleza okukodwa ukusuka kusibungu kuya kusibungu futhi ufunde izibali zamabhayithi kuzo zombili izinhlangothi. Izibali ezikhuphuka ku-ASA kodwa zihlala zilingana ku-Google ngokuvamile zisho ukuthi impendulo iphuma ngenye i-interface, noma ukuthi i-selector ayisibambi iphrifikisi lokubuya. Bhala ama-algorithm, izikhathi zokuphila, ama-selector kanye negama elisha le-tunnel, ngoba ushintsho lwesiphakamiso olulandelayo luphinda lokhu kwakha kabusha futhi lawo mazinga akwenza kube umsebenzi omfishane.