IKEv1 ne-XAuth ne-OTP: yini edingwa isicelo ngasinye
I-PSK yeqembu, ukushintshana kwe-XAuth komsebenzisi kanye nenselelo ye-OTP kungamagalelo amathathu ahlukene. Hlobanisa isicelo ngasinye nomnikazi waso ngaphambi kokufaka iklayenti elinye.
I-IKEv1 ene-PSK, i-XAuth ne-OTP ayiceli iphasiwedi eyodwa eyinkimbinkimbi. Yenza izingqimba zokhiye owabiwe phakathi kwabalingani, ukushintshana komsebenzisi, kanye nesici sesibili iseva engemuva enquma ukuthi sizocelwa kanjani. Ingqimba ngayinye inomnikazi wayo nomlayezo wayo wokwehluleka. Ukudida lezi kuholela ekutheni abantu baphinde bathayiphe ikhodi yokusetshenziswa kanye enkambu egcina imfihlo yeqembu.
Hlobanisa isicelo ngasinye nengqimba esicela yona ngaphambi kokufaka iklayenti elinye noma ukusetha kabusha ubunikazi.
Izimfihlo ezintathu, abanikazi abathathu
Ukhiye owabiwe ngaphambili ungowobudlelwano babalingani futhi uhlelwa kanye yilowo ophethe iziphetho zombili. Ubunikazi bomsebenzisi bungobeserva yokuqinisekisa futhi buqinisekiswa njalo lapho kungena umsebenzisi. Isici sesibili singesohlelo lwamathokheni olushintsha impendulo yalo njalo lapho kuzanywa. Akukho okuthatha indawo yokunye, futhi ukusetshenziswa okuthatha lezi zintathu njengephasiwedi eyodwa kwehluleka engqimbeni okungekho owayibhala phansi.
Bhala amakholomu amathathu: umnikazi, isikhathi sokusebenza, kanye nomlayezo wokwehluleka okukhiqizwa yilowo nalowo. Ithebula yilona thuluzi lokuxilonga, hhayi amagama ezinkambu aseklayentini.
| Layer | Owner | Lifetime |
|---|---|---|
| Pre-shared key | Peer configuration | Until operators change it |
| XAuth credential | Authentication backend | Per session, per policy |
| One-time code | Token system | Single use |
PSK: eyomlingani, hhayi eyomuntu
Kuleli hlelo lakudala, ukhiye owabiwe ngaphambili uqinisekisa umbhangqwana wamasango, ngakho ukungena komsebenzisi akukaze kuyithathe indawo. Futhi iyona nani elivame ukungalungi ngendlela ekhiqiza iphutha elivamile lokuxoxisana esikhundleni sesicelo. Uma ithaneli yehluleka ngaphambi kokuba kuvele noma isiphi isicelo somsebenzisi, ukhiye noma iziphakamiso yizona ezisolwayo.
Ubunikazi bomsebenzisi abukwazi ukulungisa ukwehluleka kwesigaba sokuqala. Ukubushintsha kumosha ubunikazi obulodwa ongabushintsha ngokuphepha, futhi kuqinisa umqondo ongalungile.
XAuth: ukushintshana komsebenzisi kwakudala
I-XAuth yengeza ukushintshana kokuqinisekisa umsebenzisi phezu kokuqinisekiswa kwabalingani kwe-IKEv1, futhi isango linquma ukuthi iyiphi iseva engemuva eyiqinisekisayo. Kuye ngaleyo seva, ukushintshana kungamukela iphasiwedi yedirekhodi, ubunikazi be-RADIUS noma impendulo yethokheni. Igama elithi XAuth libiza ukuthuthwa kokushintshana, hhayi uhlobo lobunikazi.
Hlola ukuthi isifanekiso sesango sikhomba kuyiphi iseva engemuva. Lokho kukutshela ukuthi umsebenzisi uzocelwa ini nokuthi ukusetha kabusha iphasiwedi kushintsha ini ngempela, futhi kokubili akubonakali kusifanekiso sekhayenti.
OTP: noma yini edingwa yiseva engemuva
Ezinye izindlela zokusabisa zicela ikhodi yokusetshenziswa kanye ehlukile ngemva kwephasiwedi, kanti ezinye zichaza ifomethi yokufaka ehlangene enesihlukanisi esibhaliwe. Zombili zikhona, futhi isifanekiso esiphambi kwakho sinquma ukuthi yikuphi. Ukusungula indlela yokuhlanganisa ngoba yasebenza kwenye indawo iyona ndlela evamile yokushisa ithokheni yokubhalisa. Imibhalo yesango uqobo iwukuphela komthombo okuqondisayo.
Sebenzisa ifomethi ebhaliwe neklayenti elikwazi ukuqedela ukushintshana okunikezwa isango.
Lapho umngcele weklayenti uluma khona
I-Fortinet ichaza ukuthi i-FortiClient 7.4.4 nangemva kwayo ayisayisekeli i-IKEv1 yama-VPN e-IPsec, okuwumngcele womkhiqizo nenguqulo hhayi ukususwa kwakho konke, njengoba kuphawulwa inothi lokuhambisana le-FortiClient. Amaklayenti amanye nawo awakwazi ukushintshana: i-OpenConnect ne-openfortivpn zikhuluma amaphrothokholi athile esango, hhayi isifanekiso se-IKEv1 noma sini. Hlola inguqulo ye-IKE, imodi ye-PSK, ukusekelwa kwe-XAuth kanye nomodeli wokusebenzisana weklayenti elifakiwe ngakunye. Iklayenti elixhumayo ngendlela ehlukile alikufakazelanga ukuthi isidingo sakuqala sahlangatshezwa.
I-IKEv1 ayisasetshenziswa, ngakho ukwethulwa okusha okwakhelwe phezu kweklayenti elidala elingasekelwe kuyisixazululo sesikhashana. Cela indlela yokufuduka esekelwayo kumnikazi wesango, kuhlanganise nokuthi isici sesibili sizophathwa kanjani lapho.
Ukuxilonga ngaphandle kokucisha isici
Hlukanisa izigaba kurekhodi: ukuxoxisana kwabalingani, ukushintshana komsebenzisi, umphumela wesici sesibili, bese kuba ukwabiwa kwekheli nomzila. Bhala ingxenye nesigaba esikhundleni sokuzama ikhodi kuyo yonke inkambu. Ukucisha isici ukuze ukuhlolwa kuphasa kwenza ithaneli engafakazeli lutho mayelana nokusetshenziswa.
Gcina izimfihlo zokubhalisa nokhiye owabiwe endaweni egciniwe evikelwe ngokulandela inqubo yenhangano. Ikhodi yokusetshenziswa kanye esefayeleni elihlala njalo iyisici esiyekile ukuba yisici.