FortiGate IPsec ku-Linux: iyiphi iklayenti exhuma ngempela

Uzakwenu kwe-Windows ungenisa iphrofayili ye-FortiGate futhi ube seku-inthanethi ngomzuzu owodwa. Wena ufaka iphakethe elifanayo lomhlinzeki ku-Ubuntu, ufuna ithebhu ye-IPsec, bese uthola iklayenti elazi kuphela ukuvula SSL VPN. Isiphetho esilandelayo ngokuvamile asilungile izikhathi ezimbili: isango alikwenqabi, futhi ukwakhiwa kwe-Linux akukho phansi. I-Fortinet ithumela lelo klayenti ngokweseka i-SSL VPN kuphela, ngakho iphrofayili ye-IPsec yeselula ayinandawo yokuhlala futhi kufanele yakhiwe kabusha endaweni ekhuluma i-IKEv1.

Okokuqala, ncika ukuthi iyiphi iphrothokholi oyinikiwe ngempela

Lokho kwakhiwa kabusha kungumsebenzi womshini lapho usuyeka ukuthatha iklayenti lomhlinzeki njengokwenziwa okuyisibonelo.

Amadivayisi e-FortiGate ashicilela kokubili i-SSL VPN ne-IPsec, futhi i-imeyili yokudlulisela ayivamisile ukusho ukuthi iyiphi oyinikiwe. I-URL yesango kanye nekhasi lokungena lesitayela sesiphequluli kusho i-SSL VPN, futhi ku-Linux impendulo lapho yi-openfortivpn, hhayi ukubalwa kwezinkambu ngezansi. Isihlonzi seqembu kanye nokhiye owabiwe ngaphambilini kusho i-IPsec yeselula, okubhekana nayo i-vpnc ne-strongSwan.

Ukwenza iphutha lapha yisizathu esivame kakhulu sokuthi umzamo we-Linux ufe ngaphambi kokuthi isigaba sokuqala siqede: iklayenti linikeza i-IKEv1 esangweni le-HTTPS noma okuphambene nalokho. Cela umphathi igama lephrothokholi ngokubhaliwe ngaphambi kokufaka noma yini.

Ubufakazi obune buhamba ezinkambini ezine ezihlukene

Igama elithi password livela kabili ekudluliselweni okuningi futhi lisho izinto ezimbili ezihlukene. Ukhiye owabiwe ngaphambilini uqinisekisa uzakwabo uqobo, futhi uyimfihlo yomshini umphathi ayifunda ekucushweni kwesango. Iphasiwedi yakho ye-akhawunti iwubufakazi obuhlukile obukhombisa ukuthi yimuphi umuntu olele ngemuva kwalowo zakwabo.

Amanye amanani amabili kulula ukuwageja. Isihlonzi seqembu wuchungechunge umqondisi ayolubhala entweni yeqembu le-IPsec, futhi u-0 yinani elisemthethweni, hhayi inkambu engenalutho. Isiphakamiso sihlanganisa ukubethela, i-hashing kanye neqembu le-Diffie-Hellman esigabeni ngasinye, kanye nesilungiselelo se-PFS, futhi into ngayinye kuso kufanele ihambisane nesango. Lapho uxhumano lwehluleka esigabeni 1, cishe njalo omunye walabo bane uyicala, ngakho babhale ngokwehlukana kunokuba uwaphonse engxoxweni eyodwa.

Yini okufanele ibe nayo inkambu ngayinye ye-vpnc

Faka iklayenti kanye nesixhumi esibonakalayo somhleli, bese wenza uxhumano lwe-VPNC:

sudo apt install vpnc network-manager-vpnc network-manager-vpnc-gnome

Setha isango ekhelini lomphakathi le-FortiGate, futhi setha igama leqembu ngqo kusihlonzi esisuka esangweni, kuhlanganise noziro ongenalutho. I-Group password ithatha ukhiye owabiwe ngaphambilini, kuyilapho igama lomsebenzisi nephasiwedi kuthatha i-akhawunti yakho, nanoma yiluphi uphawu olwengezwe ngendlela isango elilindele ngayo. Engxoxweni ethuthukisiwe, khetha iqembu le-Diffie-Hellman elishiwo isiphakamiso, hlanganisa i-PFS neqembu elifanayo, nika amandla ukunqamula kwe-NAT lapho iklayenti lingemuva kwerutha yasekhaya, futhi ushiye ukutholwa kukazakwabo ofile kusesinyathelweni esifanayo nesango.

Igama leqembu yinkambu eyeqiwe, ngoba libonakala lingenakho ukubaluleka futhi uziro okuzenzakalelayo ufana nesibambi sendawo. Lithumele lingenalutho bese iklayenti lidlulisa isihlonzi esihlukile kuleso isango elisiqinisekisayo. Uma iphrofayili isahluleka, qhathanisa amanani athuthukisiwe neklayenti le-Windows elisebenzayo hhayi neposi lenkundla lesinye isiza.

Iphrofayili efanayo ebhalelwe i-strongSwan

I-strongSwan iyisitsha esingcono sesikhathi eside salezi zinani, ngoba ukucushwa kuyifayela lombhalo ongayihlola futhi uyigcine:

conn office-fw
    keyexchange=ikev1
    aggressive=yes
    left=%any
    leftauth=psk
    leftauth2=xauth
    xauth_identity=YOUR_USER
    right=GATEWAY_ADDRESS
    rightauth=psk
    rightsubnet=OFFICE_SUBNET
    ike=aes128-sha1-modp1536!
    esp=aes128-sha1-modp1536!

Funda imigqa yesiphakamiso ngaphambi kwebhuloki, ngoba uphawu lwesimangaliso ekugcineni lushintsha incazelo yayo: lucindezela leso siphakamiso esisodwa futhi lususa ezinye izindlela iklayenti ebeziyozinikeza. Isango elicushwe kubhangqana olulodwa lokuguqula lizonqaba iklayenti elivula ngohlu, ngakho ukucindezela yikho okushintsha ingxoxo ibe ukuvumelana. Thatha amagama anembile e-algorithm kusuka ephrofayilini yesango esebenzayo, futhi ushintshe izibambi zendawo ngezinani zakho.

Imigqa emibili yokuqinisekisa ayengeziwe. I-PSK iqinisekisa uzakwabo, ibhuloki le-XAuth liqinisekisa umsebenzisi, futhi ukususa noma yikuphi kushiya isigaba isango elingeke aliqede.

Funda ukwehluleka ngaphambi kokushintsha enye inkambu

Sebenza ubuyela emuva kusukela kuphawu kunokuba uphinde wenze ingxoxo ibe yizimanga. I-IKE SA ephuma ingenalo ikheli elabiwe isho ukuthi ukushintshana kokuqinisekisa umsebenzisi kwehlulekile noma akuzange kusebenze, ngakho hlola i-akhawunti nokuphathwa kophawu. Isigaba 1 esingapheli sikhomba isiphakamiso, isihlonzi seqembu noma imodi enobudlova, futhi ngasinye sazo siqhathaniswa nesango, hhayi neklayenti le-Windows kuphela.

Ithimbu elisungulwayo bese lifa njalo ngemizuzu embalwa ukungavumelani kokutholwa kukazakwabo ofile phakathi kwezinhlangothi ezimbili; hlanganisa isikhathi sesango kunokuba ucishe ama-keepalive kuyo yonke indawo. Ithimbu elisunguliwe lapho izingqimba zasehhovisi zihlala zingafinyeleleki ngokuvamile kusho ukuthi inombolo encane eyadluliselwa ayizange ingene kuthebula yomzila yasendaweni, into iklayenti lenkampani yangaphandle okungenzeka lingayenzi lodwa.

Uma usuqedile, buyisela amanani asebenzayo kumnikazi wesango: iphrothokholi, isihlonzi seqembu, ukhiye owabiwe ngaphambilini, isiphakamiso, i-PFS nesinqumo se-DPD. Khona-ke umshini we-Linux olandelayo uzothatha imizuzu embalwa esikhundleni sobusuku, futhi akekho ozodinga ukuthola kabusha ukuthi igama leqembu laliyi-ziro.