I-ESP ifikile kodwa akukho okususiwe ekubhalweni? Landela izigaba zokungena

Lapho isibali sokubethela se-firewall sikhuphuka kuyilapho umhubhe ungalethi lutho, umuzwa wokuqala ukunweba umthetho wokufinyelela. Lowo muzwa weqa ukulandelana kwezinto ezihlolwayo komamukeli uqobo. Iphakethe le-ESP elingenayo lidlula ezigabeni eziningana, futhi isigaba ngasinye singaphetha impilo yephakethe ngesizathu esihlukile: akukho ukuhlangana okufanayo, ukwehluleka kokuphinda noma kobuqotho, noma iphakethe langaphakathi lilungile kodwa alivunyelwe ukuqhubeka. Ukusho isigaba esihlulekile kuguqula isitatimende esingacacile sokuthi i-IPsec yephukile sibe yisibali esithile nokulungiswa okuthile.

Ukufika kuwukubona okukodwa, hhayi kuthathu

Ukubanjwa kwangaphandle okubonisa ukuthi i-ESP ifinyelela esangweni kufakazela kuphela ukuthi iphakethe langaphandle lifikile. Ukwamukela kusho ukuthi umamukeli uthole ukuhlangana futhi waqinisekisa iphakethe. Ukulethwa kusho ukuthi iphakethe langaphakathi elibuyisiwe lahlelwa endaweni yalo futhi laphendulwa. Le yimiphumela ehlukene, futhi idashibhodi ehlanganisa le miphumela isita ngqo ulwazi oludingayo.

Umehluko ofanayo uchaza umbiko ojwayelekile: isibali sokubethela sohlangothi olulodwa siyakhuphuka kuyilapho olunye lungabiki noma yikuphi ukuxhumana okususiwe okusebenzayo. Zombili izitatimende zingaba yiqiniso ngasikhathi sinye, ngoba zichaza izigaba ezihlukene zomzamo ofanayo.

Ukufunwa kokuhlangana kwenzeka ngaphambi kokususa ekubhalweni

Umamukeli uhlanganisa izingcezu uma kudingeka, bese ethola ukuhlangana kwezokuphepha kwephakethe. Ku-unicast ejwayelekile, i-SPI nendawo yokufika ziyakhetha. Ngaphandle kokuhlangana okuvumelekile akukho ukucutshungulwa okunye, yingakho i-SPI endala noma engafani iletha ukuthula esikhundleni sephutha elibonwa uhlelo.

Ukuhlangana kunomkhombandlela futhi kungashintsha ngesikhathi sokuvuselelwa kokhiye, ngakho bhala uhlangothi olwamukelayo, i-SPI nesigxivizo sesikhathi eceleni kokuhlangana okungenayo ocabanga ukuthi kwamanje. Ukuhlangana okuphumayo okubonisiwe, noma ubuhlobo be-IKE obunempilo, akuthathi indawo yalokho obekufanele kwamukele le phakethe.

Ukuhlolwa kokuphinda nobuqotho kwenqaba ngaphambi kokuba kube nokuthunyelwa

Lapho ukuhlangana kutholakele, umamukeli usebenzisa ama-algorithms akuchazayo. Uma ukuvikelwa kokuphinda kuvuliwe, inombolo yokulandelana engaphandle kwewindi iyenqatshwa. Ukwehluleka kokuhlolwa kobuqotho nakho kuqeda ukucutshungulwa, ngoba i-ICV ayihambisani nephakethe njengoba lamukelwe. Akukho cala elikhiqiza iphakethe langaphakathi elisusiwe, ngakho akukho okufinyelela ekuhlelweni, kunqubomgomo noma kuhlelo.

Kulezi zimo sebenzisa amaphutha nezibali ezibhaliwe zokusetshenziswa, esikhundleni sokuthatha konke ukwehluleka kokwamukela njengokwenqatshwa kuhlu lokufinyelela. Ukucisha ubuqotho noma ukuvikelwa kokuphinda ukuze kubonakale ukuxhumana akufakazeli ukuthi iphakethe elingenayo lalivumelekile; kususa ukuhlolwa obekukhuluma iqiniso.

I-UDP port 4500 iyisitsha, akusona isinqumo

Ukudlula kwe-NAT kuthwala i-ESP ngaphakathi kwe-UDP, futhi i-port efanayo ithwala nemiyalezo ye-IKE nokugcina uxhumano. Ngakho umsebenzi ku-4500 usho ukuthi kukhona okusebenzisa i-port, hhayi ukuthi uhlelo lukhiqize iphakethe le-ESP. Hlukanisa umthwalo ngaphambi kokuwabela ukuxhumana kwedatha.

Lokhu kubalulekile lapho ukubanjwa kuwubufakazi obukuphela kwabo. Umyalezo wokugcina uxhumano ofika ngesikhathi ungabonisa umhubhe ofile njengophilayo, futhi umyalezo we-IKE ungabonisa ukubanjwa njengokumatasa ukwedlula indlela yedatha yangempela.

Kuphela ngemuva kokukhipha kusebenza ukuhlelwa kanye nenqubomgomo

Lapho ukususa ekubhalweni kuphumelela, iphakethe langaphakathi elibuyisiwe lingena endleleni evamile: ukuhlolwa kwenqubomgomo, ukuhlelwa, imithetho yokudlulisela kanye nomsingathi wendawo. Iphakethe lingadlula zonke izivivinyo zokuphepha futhi lilahliwe lapha, futhi indlela yokuphendula kufanele ibe khona. Lokho kwehluleka kungokwedlulisela, hhayi kwe-ESP.

Gcina izibali ziboshelwe esigabeni sazo esibhaliwe. Ukwamukela ku-interface, i-ESP eyamukelwe, amabhayithi asusiwe kanye namaphakethe angaphakathi adlulisiwe akudingeki abe yinombolo efanayo, ikakhulukazi lapho indlela esheshayo ibamba indiza yedatha futhi indiza yokulawula ibika ngokwehlukana. Ilebula ledashibhodi elijwayelekile akusona ubufakazi bokuthi izibali ezimbili zisho into efanayo.

Emsebenzini owodwa omutsha ogunyaziwe, gcina umngcele wokugcina oqinisekisiwe kanye nephutha lokuqala elihlobene. Leyo mbhangqwana itshela umphathi olandelayo ukuthi kufanele aphenye ini: ukulethwa kwezokuthutha, ukuhlangana nobuqotho, noma ukudlulisela kwangaphakathi okujwayelekile, futhi kugwema ukulungiswa okujwayelekile kokwenza wonke umthetho uvume ukuze kunyakaziswe inombolo.