Indlela yokufunda ukushintshana okusha kwe-IKE_SA_INIT ekuthwebuleni

Qala ngokuthwebula okuqala ngaphambi kwephakethe lokuqala lomzamo, ngaphandle kwalokho uzofunda phakathi kwengxoxo. Ukuxoxisana osekuvele kuqhubeka kubonisa ukushintshana okubethelwe nokuvuselelwa kokhiye, futhi akukho kukho okubukeka njengokuqala. Ukuqala yingxenye ongayikhulula ngaphandle kokhiye, yingakho iphendula imibuzo yokufinyeleleka kahle kangaka. Izahlulo ezine ngokulandelana zikususa ekuthwebuleni okusha ziye esitatimendeni esivikelekayo mayelana nokuthi yiluphi uhlangothi olwayeka ukukhuluma.

Okokuqala, qinisekisa ukuthi ukuthwebula kuqala ekuqaleni

Ukuthwebula okuqalwe ngemuva kokukhuphuka komhubhe kuzoba nokugeleza kwedatha okufakiwe kanye ne-keepalive yezikhathi, futhi kokubili kubethelwe noma cishe akunalutho. Qalisa kabusha iklayenti futhi urekhode umzamo ngokwawo, noma udale ngamabomu ukuxhumana okusha ngenkathi ukuthwebula kuqhubeka. Uma ungakwazi ukukhiqiza umzamo omusha, kubhale kumanothi akho, ngoba akukho kukhululwa okungaletha emuva ukuqala ongakaze ukurekhode.

Khawulela ukuthwebula emaphethelweni amabili kanye ne-UDP 500 kanye no-4500 ukuze ifayela lihlale lincane ngokwanele ukufundwa. Kusebenza okumatasa ukuthwebula okungenasihlungi kungcwaba ukuxoxisana ngaphansi kwethrafikhi engahlobene.

tcpdump -i any -n -s 0 -w fresh-ike.pcap 'udp port 500 or udp port 4500'

Gcina ifayela lapho umzamo uthakazelisa, ngoba ukuthwebula okufanayo kuphendula imibuzo emibili elandelayo: ukushintshana kwakuyini, nokuthi ngabe kukhona okwabuya. Faka ilebula ngesikhathi sokuqala kanye nangababili bamaphethelo owahlunga kuwo. Ukuthwebula okungenazo lezi zinto ezimbili akusizi ngemva kweviki, lapho amakheli eseshintshile futhi kungekho okhumbulayo ukuthi wukuphi umzamo olurekhodiwe.

Okwesibili, funda isihloko ngaphambi kwemithwalo

Isihloko se-IKE sithwala izinkomba zamapharamitha okuphepha, uhlobo lokushintshana kanye ne-ID yomlayezo, futhi ekuxoxisaneni okusha lezi zindinganiso zihlukile. Umqalisi uqamba i-SPI engeyona uziro, isicelo sokuqala sithwala i-SPI yomphenduli enguziro ngoba akukabonwa mpendulo, uhlobo lokushintshana yi-IKE_SA_INIT, futhi i-ID yomlayezo inguziro. Konke okunye kungokwesigaba esisemuva salokho kuxoxisana noma komunye umzamo ngokuphelele.

Imithwalo yesiphakamiso, ukushintshana kokhiye kanye ne-nonce kulokhu kushintshana kokuqala iyafundeka obala. Ukufundeka akusho ukuthi kuqinisekisiwe, futhi kulesi sigaba akekho uhlangothi oluqinisekisile ubunikazi baso.

Inani eliyimfihlo le-Diffie-Hellman aliwelanga ucingo, ngakho ukuthwebula akukuvumeli ukuthola okhiye besikhathi. Ukuqinisekiswa kwenzeka ekushintshaneni okulandelayo, kuvikelwe yilokho okwavunyelwana ngakho kokuqala. Uma othile ebuza ukuthi uhlangothi luyangempela yini, lokhu kushintshana akukwazi ukuphendula lowo mbuzo. Kungakhombisa kuphela ukuthi izinhlangothi zombili zavumelana ngesiphakamiso futhi zakha imfihlo eyabiwe okungekho efayeleni.

Okwesithathu, hlehlisa isicelo nempendulo yaso

Hlehlisa ngababili be-SPI, uhlobo lokushintshana kanye ne-ID yomlayezo, bese uhlola ifulegi lempendulo. Ukuthumela kabusha kuphinda i-ID yomlayezo yokuqala futhi akusona isilingo sesibili sokungena. Ukubala amaphakethe esikhundleni sokushintshana yiyo indlela ukuxoxisana okunempilo okuphenduka ngayo ibe umjikelezo oyisipoki.

Impendulo ingaba futhi ukwenqaba: isicelo sekhukhi, isaziso seqembu elingamukeleki, noma iphutha mayelana nesiphakamiso. Lezi ziyizimpendulo ezisemthethweni, futhi zisho ukuthi indlela iyasebenza kuyilapho umgomo ungasebenzi. Khulula isaziso esikhundleni sokuthatha yonke impendulo njengempumelelo. Lapho isaziso sisho iqembu noma isiphakamiso, ukulungiswa kusohlangothini lokucushwa hhayi kudonga lomlilo.

Indlela nayo ibalulekile. Isicelo esingenampendulo nempendulo engafiki neze kuklayenti kuyiziphazamiso ezahlukene, futhi eyesibili kuphela ebonakala njengokuphela kwesikhathi ohlangothini lweklayenti.

Okwesine, hlukanisa i-IKE nakho konke okunye ku-4500

Iphothi engu-4500 ithwala izinto ezintathu ezibukeka zifana embonini efingqiwe: i-IKE ngemva kophawu lwe-non-ESP olunguziro lwamabhayithi amane, i-ESP efakiwe okwesikhala saso sophawu sithwala i-SPI engeyona uziro, kanye ne-keepalive emifushane. Yilowo phawu oluhlukanisa i-IKE ne-ESP efakiwe, ngakho funda lawo mabhayithi ngaphambi kokubiza ithrafikhi nge-IKE. Ilebulu lokuthwebula elifunda u-4500 inombolo yephothi, hhayi iphrothokholi.

I-ESP efakiwe ingumthwalo obethelwe ongakwazi ukuwuhumusha ngaphandle kokhiye, futhi ukuba khona kwayo kungaba uphawu lomhubhe osebenzayo hhayi isiphazamiso.

Bheka zombili izimbobo zomzamo ofanayo, ngoba i-IKE ingase idlulele ku-4500 ngemva kokutholwa kwe-NAT nakuba yavulwa ku-500. Umkhondo ohlungwe ku-500 kuphela ubonakala uthule ngqo lapho ukuxoxisana kuphumelele futhi kwathutha. Khulisa isihlungi futhi ufunde kabusha iwindi lesikhathi elifanayo ngaphambi kokuthatha noma yisiphi isiphetho ekungabikho.

Ukuthula endaweni eyodwa yokubuka kusho ukuthini

Ukungabi nampendulo kuklayenti kufakazela kuphela lokho okwabonwa yileyondlela. Ukuhlunga, ukuhlela imizila, ikheli elikude elingalungile, isevisi emile kanye nokungahambisani kwephrothokholi konke kukhiqiza umkhondo ofanayo ongenalutho.

I-ICMP unreachable efanele yengeza ubufakazi, kodwa funda iphakethe elicashuniwe ngaphakathi kwayo futhi ubhale ikheli ledivayisi eliyithumile.

Ukwenqaba kombhali wemizila kuyisigameko esihlukile kunephutha eliqinisekisiwe elibuyiswa uhlangothi, futhi eyesibili kuphela efakazela ukuthi isevisi iyaphila. Xhumanisa umzamo ofanayo namalogi eseva noma nokubuka okuvunyelwe ukuze wazi ukuthi isicelo safika futhi impendulo yaphuma. Gcina ukuthwebula kukhawulelwe futhi kuyimfihlo, ngoba izinkambu zokuxhawulisana ezifundekayo azenzi ingxenye esele yefayela ingabi yingozi. Umphumela ofanele ukuba nawo iqembu elilodwa elicushiwe lesicelo nempendulo, noma igebe elibhaliwe elinendawo yokubuka eqanjiwe.