IKE phezu kwe-TCP 4500: hlola iziphetho zombili ngaphambi komthetho wephothi
I-TCP encapsulation ixoxisana ngeziphetho zombili, ayinikezwa umthetho we-firewall. Sebenzisa ukuhlolwa komsindo, ukubamba kanye nezigaba ezine zokwamukela ngokulandelana.
Amathikithi okusekela avame ukufika lapho ushintsho lwe-firewall selugunyaziwe kodwa umhubhe usenqaba ukuphuma. Lona umphumela olindelekile lapho uhlangothi olulodwa kuphela lunalesi sici: i-TCP encapsulation ngokwe-RFC 9329 kufanele isetshenziswe futhi ilungiswe kuzo zombili iziphetho, futhi isivumelwano senzeka ngaphakathi koxhumano ngaphambi kokuba noma yikuphi ukuhamba okukhuselwe kuhamba. Ukuvula iphothi kumemezela umsindo ongase ungabikhona, futhi umsindo ongenaso isilungiselelo esihambisanayo kolunye uhlangothi wamukela uxhumano bese uthula. Ukulandelana okungezansi kubeka ukuhlolwa okungabizi kuqala.
Yazi ukuthi ukukhetha kwengeza ini ngempela
I-IPsec yemvelo ithwala imithwalo efihliwe njenge- protocol IP 50, ngaphandle kwenombolo yephothi okufanele ivunyelwe. I-NAT traversal isonga lawo maphakethe ku-UDP iye ephothini 4500, yingakho imithetho eminingi ye-firewall ikhuluma ngalelo phothi. I-RFC 9329 yengeza ukumelwa komgudu: amaphakethe e-IKE ne-IPsec womabili ahamba ngaphakathi koxhumano olulodwa lwe-TCP, ngokuvamile aya ephothini 4500.
Umgudu awuwona usizo lwewebhu. Uxhumano lwe-TCP oluya ku-4500 alusho lutho nge-HTTP, i-TLS noma ubungane be-proxy, futhi i-proxy ye-HTTP esendleleni ngokuvamile izophula ukwakheka kwezakhiwo esikhundleni sokuyithwala.
Ukuhlolwa kwangaphambi kokuthinta i-firewall
Izinga libeka i-TCP njengendlela yokubuyela emuva yamaxhumano alahla indlela ye-UDP, hhayi njengokuyibuyisela esikhundleni. Thola amaqiniso amabili kumthengisi ngamunye: igama eliqondile lesici kanye nenguqulo esebenzisa i-RFC 9329 esikhundleni sokuhluka kwangasese. Amalebula afana ne-IPsec over TCP asetshenziselwe imiklamo engahlobene, ngakho cela isikhombisi sedokhumenti nokhiye wesilungiselelo oyivulayo. Ngaphandle kwezimpendulo zombili, ungacabangi lutho ngokuhambisana kwentambo.
Kufakazela lokho elabhu lapho iziphetho zombili zingezakho. Igede eliphendula ku-TCP 4500 kodwa lingaqedi i-IKE liyisibonakaliso somsindo ongenaso isilungiselelo esihambisanayo kolunye uhlangothi, futhi ukuthola lokho lapho kushibhe kakhulu kunokuthola ngesikhathi sewindi loshintsho.
Kuhlangothi oluphendulayo: ingabe kukhona okulalelayo
Qala ngesokhethi. I-ss -ltnp | grep 4500 ikhombisa ukuthi ukhona yini umsindo we-TCP nokuthi iyiphi inqubo enayo. Ukungabi khona komugqa kuqeda uphenyo ekulungisweni kwegede hhayi kunethiwekhi.
Uma isokhethi ikhona, bheka ukuxhawula esikhundleni sokuqagela ohlangothini lwekliyenti: tcpdump -ni any 'tcp port 4500'. Ukuxhawula kwezigaba ezintathu okuqediwe okulandelwa ukuthula kusho ukuthi umgudu wamukelwe futhi ukushintshana kwe-IKE ngaphakathi kwawo kwehlulekile, kuyilapho i-SYN engenampendulo ikhomba ekuhlungweni noma ekhelini elingalungile.
Qhathanisa nendlela ye-UDP efasiteleni elifanayo lokubamba ukuze kokubili kungadideki: tcpdump -ni any 'udp port 4500 or proto 50'. Ukuhamba ku-protocol 50 noma ephothini le-UDP 4500 lapho ucabanga ukuthi kusetshenziswa i-TCP kusho ukuthi iziphetho azikaze zavumelana ngendlela yokubuyela emuva. Bamba futhi egedeni uma unakho, ngoba ukubamba ohlangothini lwekliyenti akukwazi ukukhombisa ukuthi isiphetho esikude sithumele ini.
Yamukela ngezigaba ezine ezihlukene
Thatha ukuphuma njengemiphumela emine. Ngayinye ingahluleka ngesizathu esihlukile, futhi ukuphumelela noma ukwehluleka okukodwa kufihla ukuthi ikuphi, ngakho yima esigabeni sokuqala esihlulekayo bese uqala futhi phezulu.
| Stage | What you check | What it proves |
|---|---|---|
| 1 | TCP connection established to 4500 | A listener exists and the path permits it |
| 2 | IKE_SA authenticated in the gateway log | Both peers agreed on the encapsulation |
| 3 | CHILD_SA installed, visible with ip xfrm state | Keys exist for the protected traffic |
| 4 | A new application exchange succeeds | The data path works, not just the control path |
Isigaba sesine yiso esiyekwayo. Isikhathi esikhona singaqhubeka sisebenza esimweni esigciniwe, ngakho vula uxhumano olusha oluya kumsingathi ongemuva kwegede ngaphambi kokuvala ushintsho. Uma isigaba sesibili sihluleka ngesikhathi esokuqala sidlula, ukungavumelani kusephakamweni noma ekulungisweni kwe-encapsulation, hhayi ku-firewall.
Ukuhlehla, kanye nezindleko zokuyishiya ivuliwe
Hlela ukususa ngaphambi koshintsho: vala inketho ye-encapsulation kuzo zombili iziphetho futhi uqinisekise ukuthi umhubhe ubuya nge-UDP. Gcina umthetho we-TCP umjikelezo owodwa wokubuyekeza uma indlela yokubuyela emuva izodingeka futhi, bese uwususa. Umsindo ongasasetshenziswa ku-4500 uyindawo engenanani lokusebenza.
Bheka uphawu lokusebenza uma usuthwala umsebenzi wangempela. I-TCP ngaphakathi kwe-TCP yengeza izingqimba zokuqinisekisa ezima ekulahlekelweni okukodwa, futhi imigudu eyabelana ngoxhumano olulodwa ingavimbana, ngakho linganisa uhlelo oluzosebenzisa umhubhe esikhundleni se-ping.
Uhlu lokwamukela
Qinisekisa igama lenguqulo yesici kuzo zombili iziphetho, umsindo ohlangothini oluphendulayo, ukubamba okukhombisa ukuxhawula okuqediwe, kanye nezigaba ezine ezirekhodiwe ngezimpawu zesikhathi. Engeza isizathu sendlela yokubuyela emuva kurekhodi loshintsho ukuze unjiniyela olandelayo azi ukuthi kungani i-TCP ikhona. Zijwayeze ukuhlehla ngaphambi kokuba ukudinga.
Uma noma yisiphi isigaba sihluleka, lungisa leso sigaba kuphela. Ukushintsha isethi yokubethela noma izilungiselelo zobunikazi ukuze ulandele inkinga yezokuthutha ngokuvamile kwengeza ukwehluleka kwesibili okungahlobene phezu kokuqala.