Ukuthi ukuqinisekisa okuxubile kwe-IKEv1 kudlulela kanjani ekuqinisekiseni kwabasebenzisi kwe-IKEv2
Imodi exubile yayihlukanisa ubufakazi begethiweyi nobufakazi bomsebenzisi. Ukudlulela ku-IKEv2 kugcina lokho kuhlukanisa kodwa kushintsha ukushintshana, indlela ye-EAP kanye nokuhlolwa kwesitifiketi.
Iphrofayela ngayinye yakudala ye-VPN ecela isitifiketi seseva bese icela igama lomsebenzisi ithwala izehlakalo ezimbili zokuqinisekisa ekushintshaneni okukodwa, futhi leso simo siphila isikhathi eside kuneprotokholi eyasethula. Imodi exubile ye-IKEv1 yakhelwe lokhu ngqo: igethiweyi iziqinisekisa ngokhiye womphakathi kuyilapho umsebenzisi eziqinisekisa kamuva nge-XAuth. I-IKEv2 iveza umqondo ofanayo wezinyathelo ezimbili ngomshini ohlukile, futhi kulezo mehluko ukufuduka kwehluleka khona. Ayikho inombolo yenguqulo eguqula enye ibe kwenye, futhi ukukopisha amagama wakudala ezinketho kuphrofayela entsha kuveza iklayenti elixoxisanayo bese lingaqinisekisi lutho.
Imode exubile yenzani ngaphakathi kwe-IKEv1
Kuphrofayela exubile uhambisani ophendulayo usayina ukushintshana kwesigaba sokuqala ngesitifiketi saso kuyilapho umqalisi ngamabomu engavezi sitifiketi. Ngakho-ke ubufakazi bobunikazi abulingani, futhi yikho okwavumela igethiweyi ukuthi igcine i-PKI yayo ekhona kuyilapho abasebenzisi begcina amaphasiwedi abo edayirekhithri. Lapho isigaba sokuqala siphela, i-XAuth isebenza njengesicelo nempendulo ethwala izimfanelo zegama lomsebenzisi nephasiwedi ngaphakathi kwesiteshi se-ISAKMP esibethelwe.
Qaphela ukuthi ukuthembana kugcina kuphi. Isitifiketi siphendula ukuthi iklayenti lafika kuyiphi igethiweyi; i-XAuth iphendula ukuthi yimuphi umsebenzisi ofuna ukufinyelela. Akukho okunye okuthatha indawo yokunye, futhi iklayenti elisethwe ukwamukela noma isiphi isitifiketi seseva selahle ngasese impendulo yokuqala. Ilebula elithi exubile lisetshenziswa futhi emodini enolaka onokhiye owabiwe ngaphambili kanye ne-XAuth, okunye ukuhlelwa okunamava afanayo omsebenzisi, ngakho-ke funda iphrofayela hhayi igama. Zombili izinhlobo zivela emibhalweni engakaze ibe amazinga, futhi yikho abakhiqizi ababili bangasebenzisa imodi exubile futhi bangasebenzisani nanoma ubani.
I-IKEv2 ifinyelela kanjani kulezi zinto ezimbili zobufakazi
I-IKEv2 ihlukanisa umsebenzi phakathi kwe-IKE_SA_INIT ne-IKE_AUTH. Ukushintshana kokuqala kuvumelana ngeziphakamiso nokhiye ngaphandle kobunikazi nhlobo; okwesibili kuthwala i-IDi, i-IDr kanye nemithwalo ye-AUTH. Ngaphansi kwe-EAP umthwalo wokuqala we-AUTH womqalisi uphuma ungenalutho, ophendulayo uqinisekisa yena kuqala ngesitifiketi sakhe ngesiginesha, bese ingxoxo ye-EAP iqhubeka ngaphakathi kwemiyalezo ye-IKE_AUTH.
Indlela eyenza lokhu kuphephe yinto yokhiye. Indlela ye-EAP ephumelelayo ikhipha ukhiye wesikhathi, futhi umthwalo wokugcina we-AUTH womqalisi ubalwa kusukela kuwo, ngakho-ke ubufakazi bomsebenzisi nokhiye bomhubhe ziboshwa ndawonye. I-XAuth ayinakho okulingana nakho: izimfanelo zayo zifika ngemva kwesigaba sokuqala futhi azifaki lutho kukhiye. Leyo gebe yilokho uhlaka lwe-IKEv2 olwakhelwe ukuyivala, futhi yikho ukungena kwe-IKEv2 okusebenzayo kuqinisekisa isitifiketi seseva ngaphambi kokucela noma yini.
Lokhu kuhleleka kuwukuxilonga okusizayo futhi. Uma iklayenti likhononda ngezifakazelo ngaphambi kokukukhombisa isitifiketi, alikwenzi nhlobo ukushintshana kwe-EAP kwe-IKEv2.
Gcina ubunikazi obuthathu buhlukene
Ukufuduka kuya kabi uma ubunikazi obuthathu buwela endaweni eyodwa. Kukhona ubunikazi begethiweyi obuqinisekiswa iklayenti, ngokuvamile igama le-DNS ku-subject noma i-SAN yesitifiketi. Kukhona ubunikazi bomsebenzisi obwethulwa ku-EAP, mhlawumbe ukungena kwesizinda, ikheli noma umucu ocacile wobunikazi be-EAP. Futhi kukhona umthombo wemvume ohambisa lowo msebenzisi eminethini nasemizileni.
Isintaksi ye-swanctl ye-strongSwan yenza ukuhlukanisa kubonakale: ukuxhumana kusetha i-remote { auth = pubkey } yegethiweyi ne-local { auth = eap-mschapv2 } yomsebenzisi, kuyilapho ubunikazi be-EAP buthwalwa ngokwehlukile.
Uma ubunikazi bomsebenzisi kuphrofayela entsha buhlukile kuzimfanelo zakudala ze-XAuth, isibonelo i-UPN esikhundleni segama elifushane, iseva yokuqinisekisa ibona umsebenzisi ongaziwa futhi ukwehluleka kubonakala njengephasiwedi engalungile. Hlola umucu wobunikazi ngaphambi kokuhlola izifakazelo.
Hlela izinketho bese ulindela izicupho
Ukuhlela kufushane futhi umugqa ngamunye unesicupho esivela kuphela ngesikhathi sokuqinisekisa.
| Legacy hybrid element | IKEv2 equivalent | Where it bites |
|---|---|---|
| Gateway certificate, no client certificate | Responder authenticated with pubkey, initiator with EAP | The server needs an EAP method configured, not just a certificate |
| XAuth username and password | EAP-MSCHAPv2 or an inner method | Password policy and account format differ from the old directory field |
| XAuth attribute replies | IKEv2 configuration payload | Attribute numbering is unrelated; nothing is renamed |
| Proxy IDs from quick mode | TS_i and TS_r in IKE_AUTH | Narrowing on the responder can leave an IKE SA with no child SA |
Awukho umugqa kuleyo engeyona nje ukushintshwa kwegama. Umthwalo wokucushwa uletha amakheli nezixazululi ngohlu lwezimfanelo ezinohlobo, kuyilapho indawo yezimfanelo ye-XAuth yayiwukusungula kwayo; ukuzithatha njengezishintshiswayo yiyo indlela iphrofayela egcina ngayo icela isethingi igethiweyi engasoze iyithumele.
Izinketho zokuthutha zifanelwe isexwayiso sazo. I-IKEv1 yayiveza ukuthutha okuthakazelayo ngobunikazi be-proxy obuboshelwe ekushintshaneni kwe-quick mode, kuyilapho i-IKEv2 ixoxisana ngezinketho phakathi ne-IKE_AUTH futhi ophendulayo angazinciphisa. Ukungafani kuveza i-IKE SA esunguliwe ngaphandle kwe-child SA, abanye abaklayenti abayikhombisa ngentokozo njengexhumekile.
Thatha ukuxhumana kwakudala njengomngcele
I-RFC 9395 imemezela i-IKEv1 njengenganingiwe, ngakho ukuxhumana kwakudala okuxubile kungumngcele wokuhambisana onosuku, hhayi isisekelo. Gijimisa zombili iziphrofayela ndawonye ngesikhathi soshintsho, ngoba ukuhlolwa okubalulekile akukona ukuthi iphrofayela entsha iyaphuma yini, kodwa ukuthi umsebenzisi ofanayo kudivayisi efanayo ufinyelela izinsiza ezifanayo yini.
Gcina ukuqinisekiswa kwesitifiketi kuqinile kusukela ekuqaleni kuze kube sekugcineni. Uma iklayenti liyeka ukwethula isitifiketi salo, isilingo siwukukhulula ukuhlolwa kweseva kuze kuphele ukuxhawana, futhi lokho kushintsha ubufakazi obukodwa obusele ngesithonjana esiluhlaza.
Bhala izinto ezine ngaphambi kokuthatha umhlalaphansi kwephrofayela endala: indlela ye-EAP, umucu wobunikazi, umthombo wemvume kanye nosuku okuphela ngalo ukusekelwa.