FortiGate Azure ukhiye kabusha: isiphakamiso se-peer SA asihambisani nenqubomgomo yendawo

Ithunela lakhuphuka, ithrafikhi yahamba, kwathi kamuva ilogi ithi peer SA proposal not match local policy. Iningi labantu lifunda lowo mugqa njengobufakazi bokuthi izilungiselelo ezimbili azikaze zihambisane. Ngokuvamile kusho into encane: zahambisana ku-CHILD SA yokuqala futhi zayeka ukuhambisana ekunwetshweni kokuqala, ngoba inhlangano yokuqala ayizange idinge ukushintshana okwenziwa ezilandelayo. Lowo mehluko unquma ukuthi ubheke kuphi.

I-CHILD SA yokuqala izuza ifa, ezilandelayo ziyaxoxisana

Ku-IKEv2 i-CHILD SA yokuqala yakhiwa phakathi ne-IKE_AUTH, futhi izikhiye zayo zisuselwa ezintweni zokhiye ze-IKE SA. Ngaleso sikhathi akukho ukushintshana okwehlukile kwe-Diffie-Hellman, ngakho iqembu le-PFS elingamukelwa yi-peer eyodwa alikahi lihlolwe. Ithunela libonakala liphilile ngoba imfuneko ozokwehluleka kuyo kamuva ayizange ihlolwe.

Ukukhiya kabusha kwe-CHILD_SA kuwukulandelana kwemiyalezo okuhlukile. Uma i-PFS ilungisiwe, ama-peer enza ukushintshana okusha kokhiye futhi kufanele avumelane ngeqembu elamukelwa yizinhlangothi zombili, kanye nesiphakamiso se-ESP senhlangano entsha. Yiso leso sikhathi lapho ukungahambisani kubonakala khona, futhi yingakho iphutha lisho isiphakamiso hhayi umzila.

Ngakho “izolo bekusebenza” akukutsheli lutho ngesiphakamiso. Kukutshela ukuthi ukushintshana kokuqala kuphumelele, okuwinto obevele uyazi.

Funda ukushintshana okwehlulekile, hhayi i-ping yokuqala

Ngaphambi kokushintsha noma yini, qoqa kuzo zombili iziphetho ukuqinisekiswa kwe-IKE okuphumelele, i-CHILD SA yokuqala nokufaka esikhundleni okwehlulekile. Bese usho umsebenzi ngokunemba: ukukhiya kabusha kwe-IKE SA, ukuqinisekisa kabusha kwe-IKE nokukhiya kabusha kwe-CHILD SA yizigameko ezintathu ezihlukile, futhi “isigaba 2” sizihlanganisa zonke engxoxweni evamile.

Qhathanisa izinkambu ezingezansi koxhumano olwehlulekile, hhayi ithunela ngokujwayelekile.

Ku-FortiGate, vula isiphakamiso sesigaba-2, ukulungiswa kwe-PFS namaqembu e-DH elamukelwe kuleyo thunela. Funda amanani alayishiwe esikhundleni sokucabangela kuwo kusuka kuxhumano olwasungulwa ngaphambili. Isithombe-skrini sekhasi le-GUI siwubufakazi obuthambile kunezilungiselelo ezisebenzayo, ngoba kokubili kungahluka ngemuva kokuthuthukiswa. Khipha isigaba osishintshile bese usigcina netikithi.

Inqubomgomo ezenzakalelayo ye-Azure iseyinqubomgomo

Ukungabikho kwenqubomgomo evamile exhunywe kuxhumano akusho ukuthi i-Azure ayisebenzisi neyodwa. Uxhumano lubuyela kusethi yeziphakamiso ezenzakalelayo zesango, engase ibe banzi noma ibe mncane kunalokho okunikezwa yi-FortiGate yakho. Uma amasethi amabili ehlangana ku-IKE kodwa hhayi ku-ESP ene-PFS, uthola kanye lokhu kwehluleka kwephethini.

Lo mbono wokufunda-kuphela ukhombisa inqubomgomo exhunywe ngempela, ngaphandle kokudalula izimfihlo:

Get-AzVirtualNetworkGatewayConnection -Name 'Branch' -ResourceGroupName 'NetworkRG' |
Select-Object Name, ConnectionStatus, IpsecPolicies

Sebenzisa amagama angempela ezinsiza zakho. Uma kudingeka inqubomgomo ecacile, yisethe kusinsiza soxhumano. Akusona iswishi yesango lonke, futhi ayisebenzi ngokuthula kwezinye izithunela ezisesangweni elifanayo.

Kuphothali, ikhasi lika-Configuration lalowo xhumano yilapho kuya khona inqubomgomo evamile ye-IPsec/IKE. Umhlahlandlela we-Microsoft wama-nqubomgomo avamile ubala amapharamitha asekelwayo kanye nezidingo ze-SKU. I-Azure ithatha inhlanganisela eyodwa egcwele ngoxhumano ngalunye, ngakho ucacisa izinkambu ze-IKE kanye nezinkambu ze-IPsec ndawonye, hhayi ngakunye.

I-PFS iyimfuneko, ayisona iswishi yokuphendula

Uma umugqa wakho oyisisekelo wokuphepha udinga i-PFS, isisombululo iqembu elamukelwa yiwo womabili ama-peer ezinhlangothini zombili, elivezwa ngenqubomgomo ehambisanayo. Ukucisha i-PFS ukuze iphutha linyamalale kushintsha isici sokuphepha obuzama ukusigcina, futhi ngokuvamile sibuya kamuva njengokunye ukungahambisani.

Umgibe owodwa oqondene ne-Azure: uma ukhetha i-GCM ye-ESP, izinketho zokubethelela nobuqotho kufanele zisho i-algorithm efanayo ye-GCM nobude bokhiye obufanayo. Ukuhlanganisa isibhali se-GCM ne-algorithm ehlukile yobuqotho kukhiqiza inhlanganisela isevisi eyinqabayo, futhi lokho kubonakala njengokungahambisani kwama-peer kuze kube yilapho ufunda kahle inqubomgomo.

Khetha inhlanganisela enamandla kakhulu esekelwa yiziphetho zombili futhi evunyelwa yimfuneko yakho, bese uyibhala kurekhodi yezinguquko. Umuntu olandelayo uzokuqhathanisa naleyo rekhodi, hhayi ngesikhumbuzo sethunela elalisebenza. Faka iqembu le-PFS nesiphakamiso se-ESP kuyo, hhayi igama lenqubomgomo kuphela. Uma kamuva othile ebuza ukuthi kungani ucwaningo lwehlulekile noma kungani ukukhiya kabusha kunensayo, lowo mugqa uphendula imibuzo yomibili.

Qinisekisa ukushintshana okwehlulekile

Hlela ushintsho ngomzila wokubuyisela, ngoba ukuhlela inqubomgomo kungaphazamisa ithunela olizama ukulilungisa. Uma ithrafikhi ibuyile, linda noma ugqugquzele ukunwetshwa kwe-CHILD_SA bese uqinisekisa ukuthi inhlangano entsha isungulwe neqembu le-PFS elifunwayo. Bese uqinisekisa ukuthi ithrafikhi yezinhlelo iyaqhubeka kulo.

Kunezikhombisi ezimbili ezingamanga okufanele zishiwo. Izikhathi zokuphila ze-SA ziyizimiso zasendaweni, ngakho amanani angalingani avamile futhi ukuwashintsha kuhambisa kuphela ukuthi inkinga ivela nini. I-DPD ithola ukuthi i-peer iyaphila yini; ukukhulisa isikhathi sayo sokulinda akuhlanganisi izinketho ze-ESP noma ze-PFS.

Rekhoda umphumela okuxoxiswene ngawo kanye nesigameko esilandelayo ngemuva koshintsho. Uma uxhumano manje lwehluleka ngaphambi kokuthi ukuqinisekiswa kwe-IKE kuqedwe, ubheka izilungiselelo ze-IKE osanda kuzihlela, hhayi ukwehluleka kwasekuqaleni kokunwetshwa kwe-CHILD.