IKEv1 ngokumelene ne-IKEv2 ngokhiye eyabiwe ngaphambili: kuhluke ngani ekuqinisekiseni

Ama-gateway amabili alungiselelwe ngokhiye eyodwa eyabiwe ngaphambili aqeda i-handshake, futhi irekhodi lamaphakethe alibonisi mfihlo udlula ocingweni. Leyo yingxenye abantu abayikhumbulayo. Ingxenye ethakazelisayo yilokho inguqulo ngayinye ekubala ngempela ukuze ibonise ukuthi imfihlo iyaziwa, ngoba i-IKEv1 ne-IKEv2 zakha lobo bufakazi ngezinto ezahlukile zokufaka futhi zidalula imininingwane ehlukile ngenkathi zikwenza. Funda imikhondo emibili ndawonye futhi umehluko uyeka ukuba ngowokuhlobisa.

Okumele kubufakazi kukufeze

I-Diffie-Hellman inikeza izinhlangothi zombili inani elabiwe okungxenye zalo zomphakathi ezingabalwa nanoma ubani obukayo. Iyodwa ayibonisi lutho mayelana nobuwena: umhlaseli oqeda ukushintshaniswa kokhiye unenani elifanayo elabiwe njenge-gateway yakho. Isinyathelo sokuqinisekisa sikhona ukuze sihlanganise lokho kushintshaniswa nemfihlo ephethwe yizinhlangothi ezihlosiwe kuphela, kanye nobuwena namapharamitha abavumelana ngawo.

Lokho kuxhumanisa yikho okwenza i-hash ihlanganise okungaphezu kokhiye. Ukube yayihlanganisa imfihlo kuphela, umhlaseli wayengayidlala futhi ekushintshanisweni okunye ngobuwena noma iziphakamiso ezahlukile.

IKEv1 Main Mode: khipha i-SKEYID, bese uyibonisa

I-Main Mode isebenzisa imilayezo eyisithupha. Ipheya lokuqala lixoxisana ngokuhlangana kokuphepha, elesibili lishintshanisa amanani omphakathi e-Diffie-Hellman nama-nonce, kanti elesithathu lithwala ubuwena nama-hash okuqinisekisa ngaphansi kokubethelwa okusanda kusungulwa. I-RFC 2409 ichaza ukwakheka: ngokuqinisekisa ngokhiye eyabiwe ngaphambili, i-SKEYID ikhishwa emfihlweni nakuma-nonce womabili, futhi izinto zokhiye zakamuva zikhishwa ku-SKEYID, inani elabiwe le-Diffie-Hellman, amakhukhi namaconsoni.

I-hash emilayezweni yesihlanu neyesithupha ibalwa phezu kwenani le-Diffie-Hellman, amakhukhi amabili, isiphakamiso nobuwena bomthumeli, ngokhiye i-SKEYID. Umamukeli uyibala kabusha ngemfihlo yakhe elungiselelwe. Ukungafani kuqeda ukushintshaniswa, futhi imfihlo ngokwayo ayikaze ibe umthwalo.

I-Aggressive Mode icindezela umsebenzi ofanayo emilayezweni emithathu, okusho ukuthi ubuwena ne-hash yokuqinisekisa zihamba ngaphambi kokuba isiteshi esibethelwe sibe khona. Lokho kuwukuchayeka kwangempela emfihlweni eqagelekayo, futhi kuhlukile embuzweni wokuthi imfihlo yathunyelwa yini. I-IKEv1 isiphelelwe yisikhathi nge-RFC 9395, ngakho umkhondo wakudala uwumsebenzi wokuxilonga, hhayi umgomo wokusabalalisa.

IKEv2: ukukhipha okuhlukile nomthwalo we-AUTH ohlukile

I-IKEv2 ayisebenzisi kabusha uhlelo lokhiye lwe-IKEv1. Okhiye bokuqala be-IKE bavela embewini eyakhiwe ngama-nonce nanenani elabiwe le-Diffie-Hellman, futhi ukuhlangana kokuphepha kwengane kukhishwa kulokho. Ukhiye owabiwe ngaphambili awunikezi imbewu nhlobo.

Ukuqinisekisa bese kuvela njengomthwalo we-AUTH. Ekuginisekiseni ngokhiye owabiwe, i-RFC 7296 ichaza uhlobo olugcwele lwemfihlo, olutholakala ngokwenza i-hash yemfihlo ngomucu ogxilile Key Pad for IKEv2, bese kwenza i-hash yedatha yokushintshanisa esayiniwe nobuwena ngalokho khiye ogcwele. Umqinisekisi angakha kabusha inani elifanayo; obukayo akakwazi, ngaphandle kwemfihlo.

Qaphela okwashintshile. Ku-IKEv1 imfihlo ishiselwe ohlelweni lokhiye ngaphambi kokuba i-hash yokuqinisekisa ibekhona; ku-IKEv2 uhlelo lokhiye luzimele kuyo imfihlo futhi ubufakazi umthwalo ohlukile oboshelwe kuma-octet asayiniwe. Isiqinisekiso esifanayo somqondo, umshini ohlukile, futhi yikho amagama amapharamitha namarekhodi angahambisani ngqo.

Obukayo ufunda ini ngempela

Amanani omphakathi e-Diffie-Hellman, iziphakamiso, ama-nonce namakhukhi abonakala kuzo zombili izinguqulo. Ubuwena bubonakala ku-IKEv1 Aggressive Mode futhi buvikelwe kwezinye izimo. Imfihlo ayibonakali neze.

Lowo musho wokugcina unomkhawulo okufanele ushiwo. Imfihlo ebuthakathaka ekhethwe umuntu ingahlaselwa ngokuqagela: umhlaseli ubala ukuthi inani lokuqinisekisa lingaba yini ngenxa yemfihlo eyisihloko bese eqhathanisa. I-IKEv1 Aggressive Mode yenza lokhu kube okushibhe kakhulu ngoba ubufakazi busobala, futhi amazinga axwayisa ngemfihlo enamandla aphansi. Ukungayithumeli neze imfihlo akufani nokwenza imfihlo embi ibe yephephile.

Ukwenzani ngalokhu kuqhathanisa

Sebenzisa imfihlo eyodwa ehlukile kubhangqa ngalinye lombhangqwana, yikhiqize emthonjeni ongenamkhawulo, futhi uyiphendule ngendlela efanayo yokuhlinzeka eyayisabalalisa. Uma imfihlo igcinwe kuthempulethi yokumisa ethunyelwa egatsheni ngalinye, ukuphazamiseka endaweni eyodwa ukuphazamiseka kuyo yonke indawo.

Khetha ukuqinisekisa okusekelwe esitifiketini lapho izindleko zokusebenza zamukeleka, ngoba kususa inkinga yokuqagela imfihlo eyabiwe futhi kunikeza iqembu ngalinye ubuwena obuhlukile. Lapho ukhiye owabiwe ngaphambili usahlala khona, uwenze ube mude, unciphise ububanzi, futhi uthathisa inguqulo ye-IKE njengesinqumo sokuphepha, hhayi imininingwane yokuxhumana.