Izimpendulo ze-DPD zikhombisa ukuthi umlingani we-IKE uyaphila, hhayi ukuthi idatha yakho iyageleza
Izimpendulo zokuphila, isaziso se-padding kanye nezinketho eziqoshiwe kuchaza izinto ezintathu ezihlukene. Zifunde ngokwehlukana ngaphambi kokusola enye yazo ngokuma.
Amalogi e-IPsec angakhombisa izimpendulo zokuphila ngesikhathi uhlelo lokusebenza olungaphambi kwawo lumile, futhi womabili amaqiniso angaba yiqiniso ngesikhathi esisodwa. Impendulo ye-DPD iqinisekisa ukuthi ukucutshungulwa kwe-IKE komlingani kuphendule ngaleso sikhathi; ayisho lutho mayelana nokuthi i-SA yengane ithwala iphakethe olikhathazayo yini. Ukuthatha wonke isexwayiso eduze kokuhluleka njengesizathu sakho kuyindlela okuxilongwa ngayo inkinga yesikhethi njengephutha lephrothokholi. Kunezinto ezintathu eziqashelwayo ezididaniswa kakhulu, futhi ziphendula imibuzo emithathu ehlukene. Zifunde ngokuhambisana nenhloso ngaphambi kokuzifunda ngophawu lwesikhathi.
Yini okufakazelwa wukubona ngakunye
Ithebula lihlukanisa lokho okusungulwa wukubona ngakunye kulokho okuhamba nakho nje.
| Observation | What it establishes | What it leaves open |
|---|---|---|
| DPD replies arrive | The peer's IKE process answered | The child SA, forwarding path and application reply |
| TFC padding notification | The peer will not accept padding for that child SA | Whether ordinary ESP protection still works, which it does |
| Selectors reported as narrowed | The accepted traffic set is a subset of the offer | Whether the subset includes the flow the user needs |
Akukho kwezintathu okuyiphutha ngokwako. Ngakunye kuba okuthakazelisayo kuphela eduze komgudu oyilungisayo, futhi umugqa ongakwazi ukuxhunyaniswa nomgudu othile uwumongo, hhayi ubufakazi.
Ukuphila akukhona impilo yedatha
I-DPD isebenza njengokushintshana kwe-INFORMATIONAL, ingxoxo yezinga lokulawula phakathi kwama-daemon e-IKE. Impendulo ifakazela ukuthi inqubo ye-IKE yomlingani iyafinyeleleka futhi izimisele ukuphendula, futhi ukuphela kwesikhathi kufakazela ukuthi akunjalo. Akukho miphumela ehlola i-SA yengane, izikhethi, indlela yokudlulisa noma impendulo yohlelo lokusebenza, ngakho i-DPD enempilo eduze kokudluliswa okumile kuyisithombe esihambisanayo, hhayi ukuphikisana.
Yingakho imigqa yokuphila iyingxenye engasizi kakhulu yetikiti lezinga ledatha, noma ngabe ibukeka ivikelekile kangakanani phezulu kwelogi.
Isaziso se-padding siyisitatimende mayelana ne-padding
I-padding ye-TFC iwumugqa ofundwa ngokweqile kakhulu kulezi zingxelo. Ithi i-padding yokugcinwa kwemfihlo kokugeleza kwethrafikhi ngeke yamukelwe kuleyo SA yengane, okuyisitatimende mayelana nesici se-padding esingakhethwa hhayi ukwenqaba ukuvikelwa kwe-ESP. Ukuyithola eduze kokuhluleka ngokuvamile kungukuhlangana kwenzalo yamagama amaningi, futhi ukuvula noma ukuvala i-padding akushintshi lutho ekumbozeni kwezikhethi.
Isicaciso se-IKEv2 sichaza kokubili isaziso nokuxoxisana kwezikhethi, futhi ilebula lesexwayiso lokuqaliswa akuthathi indawo yencazelo yephrothokholi kuzo zombili izimo.
Ukunciphisa kuthule kakhulu futhi kungenzeka kube okubalulekile
Ophendulayo angamukela isethi engaphansi yezikhethi eziphakanyisiwe, futhi isethi eyamukelwe ingaphrintwa ezintweni ezimbalwa, esisodwa sifaneleka ngembobo yesikhathi kanti esinye sihlanganisa zonke izimbobo. Ukufunda kuphela umugqa wokuqala ofaneleka ngembobo kubukela phansi okwamukelwe; ukufunda kuphela umugqa obanzi kukubukela phezulu. Qhathanisa isiphakamiso esiphrintiwe nenqubomgomo efakiwe, ngoba isiphakamiso yilokho okushiwo abalingani kanti inqubomgomo yilokho okuzofaniswa yisikhungo. Uma zingavumelani, umhubhe ukhona futhi ithrafikhi ayikho, okuyisikhalo esivamile sezikhathi. Guqula umbono wendawo nowokude uma uqhathanisa abalingani, ngoba owendawo wohlangothi ngalunye uwokude kolunye.
Izingeniso eziqondene nomsingathi ezinesithiyo sembobo kufanele zifundwe kabili, ngoba yizo ezikhipha i-ICMP noma umbobo wesibili kuyilapho i-ping eya esangweni iqhubeka isebenza.
Yakha irekhodi elilodwa lomgudu ohlulekayo
Rekhoda umthombo, indawo eya kuyo, umndeni wamakheli, iphrothokholi nombobo njengoba kubonakala esinqumweni sokuvikela, kuhlanganise noma yikuphi ukuhunyushwa ngamabomu. Lawa amanani okufanele afane nesikhethi, futhi lawa futhi amanani abantu abawabhala kabusha ngokukhumbula lapho itikiti lifika kubhanqi besithathu sezandla.
Bese khomba i-SA yengane nezibali zayo eziqondiswe eceleni: swanctl --list-sas inikeza isifinyezo senhlangano kumsingathi we-strongSwan, futhi ip -s xfrm state inikeza izibali. Zifunde ngemva kwesicelo esisha esigunyaziwe hhayi ngesikhathi uhlelo lungasebenzi. Ukungabi nokwanda kwethrafikhi ephumayo kukhombisa ukukhetha noma indlela yendawo; ukuphuma ngaphandle kokungena okuhambisanayo kukhombisa umlingani, ukudluliswa kwakhe noma izimpendulo zakhe.
Ukushintshana kohlelo lokusebenza okuqediwe kudlula noma yisiphi isibali, ngakho ukuhlolwa kufanele kuphele ohlelweni lokusebenza hhayi esikhombisini somhubhe.
Khetha isilungiso ngemva kwalokho
Kuphela lapho lelo rekhodi likhona khona kunokulungisa okungakhethwa: izikhethi ezamukelwe, umzila, ukuhlunga, ukuqaliswa komlingani, noma umngcele osanda kuwukhombisa. Ukusetha kabusha umlingani kushintsha izimo ezimbalwa ngesikhathi esisodwa futhi kuvame ukubuyisela ithrafikhi ngaphandle kokuchaza ukuthi yikuphi okwakungalungile, ngakho ukuhluleka kuyabuya. Gcina izithombe zesimo sesikhungo ngaphandle kwamatikiti, ngoba zingaqukatha okhiye futhi isifinyezo esincane sanele kunoma ubani odinga ukusiza.
Uma irekhodi liphikisana nombono wakho wokuqala, kholwa yirekhodi bese ubhala kabusha umbono; lowo mkhuba ubaluleke kakhulu kunanoma yimuphi umugqa welogi owodwa okuxoxwe ngawo lapha.