Ukushintshana kwe-IKEv2 kuyasebenza, bese ukuqinisekiswa kwehluleka: yikuphi lapho ubheka khona

Iklayenti elithola impendulo ye-IKEv2 selifakazele ukuthi ingosi iyafinyeleleka, ukuthi izinhlangothi zombili zingaxoxisana ngesiphakamiso nokuthi ukushintshana kokhiye kokuqala kuqediwe. Kodwa akufakazelanga ukuthi ukhona oqinisekisiwe. Ukushintshana okulandelayo kuthwala ubunikazi, izitifiketi noma i-EAP, futhi yilapho ukuxhumana kuvame ukuma khona. Ukufunda ukuthi yikuphi kwalokhu kuhlola okwehlulekile yikho konke ukuxilonga, futhi umyalezo wephutha uwodwa awuvamile ukusho lokho.

Ukuhlola 1: funda isigaba, hhayi umyalezo

Ukwenqaba kungavela ezindaweni ezintathu: iklayenti lenqaba ubunikazi besiphakamiso, ingosi inqaba ubufakazi beklayenti, futhi insizakalo yokuqinisekisa yangaphandle inqaba i-akhawunti.

Ngakunye kukhiqiza umugqa wokubhalwa ohlukile emshinini ohlukile, futhi ngakunye kunesixazululo esihlukile. Ukwenqatshwa kwesitifiketi sesiphakamiso ohlangothini lweklayenti kuyinkinga yokuthembana noma yokuqanjwa eklayentini; ukwenqatshwa kwesitifiketi seklayenti ohlangothini lwengosi kuyinkinga yokuthembana engosini; ukwehluleka kwe-EAP kuyinkinga ye-akhawunti noma ye-backend. Umyalezo owubonayo uvame ukuba isifinyezo seklayenti mayelana nokukodwa kwalokho, yingakho ilogi yengosi ibaluleke njengelogi yeklayenti.

Ukuhlola 2: yibuphi ubunikazi obuhloliwe

Iklayenti lingenqaba isitifiketi sesiphakamiso noma ubunikazi obulindelekile ngaphambi kokuba noma yiluphi ubuqiniso bomsebenzisi bunikezwe, futhi ikheli lesiphakamiso elisebenzayo alithathi indawo yalokho kuhlola. Isihlonzi iklayenti esilindele kufanele sihambisane nalokho okwethulwa yingosi, lokhu kuyiqiniso lokucushwa hhayi iqiniso lenethiwekhi.

Ngamagama e-strongSwan lokho rightid kuklayenti kanye nobunikazi bengosi uqobo ngaphesheya, futhi ukungafani kwehluleka ngisho ngaphambi kokuba kuxoxwe nge-EAP.

Ingosi ngokwahlukana ingenqaba isitifiketi seklayenti, ubufakazi bokhiye wayo noma ukuqinisekiswa kwe-akhawunti, futhi lokhu kuthathu akushintshani. Ukusetha kabusha iphasiwedi yomsebenzisi akukuvuseleli isitifiketi sedivayisi, futhi ukufaka kabusha isitifiketi sedivayisi akulungisi ubunikazi besiphakamiso obungalungile. Ezingabunjini zezitifiketi, hlola iwashi kuqala, bese uchungechunge lokuthembana, bese isihlonzi esilindelekile; iklayenti elinewashi elihluke ngamaminithi ambalwa lehluleka ekuhloleni kokusebenza okubonakala njengokwehluleka kokuthembana. swanctl --list-certs ezinhlangothini zombili kukhombisa ukuthi uhlangothi ngalunye lunakho ngempela.

Ukuhlola 3: uma i-EAP ihilelekile

Iklayenti nesiphakamiso kufanele zivumelane ngendlela esekelwayo, futhi i-backend kufanele yamukele ubunikazi obunikeziwe.

Igama lomsebenzisi lingadinga isijobelelo sesizinda noma ifomethi ye-akhawunti ethile edingwa ukusatshalaliswa, futhi ifomethi ibhaliwe hhayi ukuqagelwa. Ukunikeza izinkambu ezibhaliwe zomqhubi kushesha kunokuzama izinhlobo ezahlukene, futhi kugwema inkinga yesibili: imizamo ephindaphindiwe ingabangela ukuvalwa kwe-akhawunti, okubese kufihla isigaba sokuqala ngemuva kokwehluleka okusha. Uma indlela iyi-EAP-MSCHAPv2 ngokumelene nekhithalogi, ukwehluleka kungase kube kwekhithalogi hhayi kwe-VPN.

Ungahloli izinkinga zobunikazi ngokuvala ukuhlola kobunikazi. Lokho kuguqula ukwehluleka okutholakele kube okungatholakali futhi kushiye ukuxhumana kubuthaka kunakuqala.

Ukuhlola 4: kwenzekani ngemuva kokungena okuphumelelayo

Lapho i-IKE_AUTH isiqedile, ukuxoxisana kwe-CHILD_SA kunquma ukuthi yiziphi izikhethi zethrafikhi ezifakwayo, futhi yilapho ukuxhumana kungaphumelela kanti akudlulisi lutho.

Ukungena okusanda kusebenza kuvame ukuveza inkinga yesikhethi noma yomzila eyayifihliwe ngemuva kokwehluleka kokuqinisekisa. Uma ithuneli likhuphuka kanti uhlelo lokusebenza lusalokhu lungafinyeleli lapho liya khona, bheka izikhethi nemizila okuxoxiswene ngayo hhayi ubunikazi futhi. Ukushintsha izilungiselelo zobunikazi ngaleso sikhathi kuqondisa isigaba esingalungile futhi kuvame ukuphula ukungena okusebenzayo. Qinisekisa nge-swanctl --list-sas, ekhombisa izingane nezikhethi zazo ngokuhlukana ne-IKE SA.

Ukuhlola 5: yini okufanele inikezwe ukusekelwa

Uhlu lwezikhathi oluhlanzekile kanye nokwenqaba okunembile kubaluleke kakhulu kunokukhishwa kokuxilonga okugcwele, futhi ukukhishwa kungaqukatha okhiye abayimfihlo noma ubuqiniso okungafanele ukwabelana ngakho.

Bhala phansi isikhathi nesigaba sesikhathi, izinguqulo zeklayenti nengosi, indlela, uchungechunge lobunikazi obunikeziwe hhayi iphasiwedi, kanye nesigaba esiqondile esanqabayo. idokhumenti yokucushwa kwe-IKEv2 ye-strongSwan ichaza izilungiselelo zobunikazi ne-EAP ezinquma le miphumela, futhi iyisibonelo okufanele sifundwe ngaphambi kokushintsha inkambu. Bese ushintsha into eyodwa futhi uhlole kabusha ukuxhumana okusha, ngoba iseshini egciniwe izokutshela ngokucushwa kwakudala.