IKEv2 NO_PROPOSAL_CHOSEN: yisiphi isigaba esenqabe isethi?

I-NO_PROPOSAL_CHOSEN kulogi ithumela abantu kukhiye owabiwe ngaphambilini, futhi iphutha liyaphila ngemuva koshintsho. Kwakungelona neze inkinga yezinkombandlela: umlingani wenqaba zonke iziphakamiso ezanikezwa ngalokho kushintshana, okuyisitatimende ngama-algorithms hhayi ngobuwena. Umbuzo wokuqala owusizo awuwona ukuthi iyiphi i-algorithm okufanele ihlelwe, kodwa ukuthi yikuphi ukushintshana okwenqatshwa. Phendula lokho ngaphambi kokuqhathanisa noma yini. Bese uqhathanisa isethi ephelele enikeziwe nesethi ephelele evunyelwe umlingani.

Okokuqala: yikuphi ukushintshana okwenqatshwa

I-IKEv2 ixoxa ngezinhlobo ezimbili zokuhlangana. I-IKE SA ivikela ukuxoxa ngokwako, futhi i-CHILD SA ivikela ithrafikhi. Ngakunye kunesethi yaso yeziphakamiso, futhi ngakunye kungahluleka ngesaziso esifanayo. Ukwenqatshwa ngesikhathi sokuxoxa kokuqala kwe-IKE nokwenqatshwa ngesikhathi sokuxoxa kwe-CHILD kudinga izilungiso ezihlukile, futhi ilogi ivamise ukusho ukushintshana ngomugqa owodwa noma emibili ngenhla kwesaziso. Funda leyo migqa emibili ndawonye, ngaphandle kwalokho uzohlela uhlu lweziphakamiso olungalungile.

Isaziso sisodwa asikuboni ukushintshana. Umugqa ongenhla waso usho i-SA exoxwayo, futhi lelo gama likhomba ohlwini lweziphakamiso okufanele luhlolwe.

Qhathanisa amasethi aphelele, hhayi amagama angukhiye angawodwa

Isiphakamiso siyinhlanganisela: i-algorithm yokubethela, ubuqotho noma i-AEAD, iqembu lokushintshanisa ukhiye, nanoma yimuphi umsebenzi we-pseudo-random. Ukuqhathanisa igama lokubethela kuphela iyiphutha elivamile, ngoba abalingani ababili bangavumelana nge-AES-256 kodwa basahluke nge-SHA-1 uma kuqhathaniswa ne-SHA-256. Bhala amasethi anikeziwe navunyelwe eceleni kwesinye esigabeni esihlulekile, bese ufuna ukuhlangana okungenalutho.

offered:   aes256-sha256-modp2048
permitted: aes256-sha1-modp2048

Futhi hlola ukuthi zombili izinhlelo zokusebenza ziyakusekela lokho okulungiselelile. Igama elikopishwe kwesinye isiteji lingabonakala lijwayelekile ngokwe-syntax kuyilapho i-plugin noma ukusetshenziswa kungakho ngokuphelele.

Isethi ye-IKE nesethi ye-ESP ziyizinto ezihlukile

Ukuhlela isiphakamiso se-IKE ngeke kulungise isiphakamiso se-CHILD esenqatshwa, futhi okuphambene nakho kuyiqiniso. Ku-strongSwan lezi zilungiselelo ezihlukene, cishe i-proposals = aes256-sha256-modp2048 ye-IKE SA kanye nohlu lwe-ESP oluhlukile lwe-CHILD SA. Shintsha uhlu oluhambisana nokushintshana okuhlulekile, bese ufunda ilogi futhi esikhundleni sokucabanga ukuthi isilungiso sisebenzile.

Ku-CHILD SA, isilungiselelo esifanele wuhlu lweziphakamiso ze-ESP, hhayi uhlu lwe-IKE. Ukukopisha umugqa we-IKE kuwo kwakha ukulungiselelwa okuhlaziywayo kodwa okuxoxa ngento engalungile.

Ithube elisebenzayo elihluleka ekuvuseleleni ukhiye

Uma ithube lasebenza ihora bese lahluleka, ukuxoxa kokuqala akusona inkinga. Ukuvuselela ukhiye kungahlola ezinye izimo: iqembu lokushintshanisa ukhiye elihlukile ngemuva kokushintshana kokuqala, ukungafani kwesikhathi sokuphila phakathi kwabalingani, noma inqubomgomo yomphethi eshintshile. Gcina isigxivizo sesikhathi sokuvuselela kanye nezihlonzi zokuhlangana kusuka ezinhlangothini zombili. Leyo phethini idinga ukuqhathanisa iziphakamiso ngesikhathi sokuvuselela, hhayi isikhathi sokulinda eside. Ukushintsha isikhathi sokulinda kufihla uphawu futhi kushiye ukungafani endaweni yako.

ipsec statusall kukhombisa ukuhlangana ngakunye kanye nama-algorithms okuxoxwe ngawo ngempela. Lokho okukhiphayo kuyindlela esheshayo yokuqinisekisa ukuthi yiluphi uhlu olusetshenzisiwe, futhi ihlukanisa iphutha lokulungiselela nethube elidala elingakaze lixoxwe kabusha.

ipsec statusall | grep -E "IKE:|ESP:"

Khetha ukuhlangana, bese uqinisekisa izigaba zombili

Cela umphathi ukuthi akhethe ukuhlangana kwesimanje okubhaliwe okusekelwa abalingani bobabili, futhi akubhale phansi. Ungayixazululi iphutha ngokunika amandla wonke ama-algorithms amadala noma ngokukhubaza ukuqinisekiswa kobuwena, ngoba akukho kokubili okuvela ekwenqatshweni. Ngemuva koshintsho, sungula ukuxhumana okusha bese uphoqa ukuvuselela ukhiye. Ukuxhumana kokuqala kuphela akufakazi ukuthi indlela yokuvuselela iyasebenza.

Gcina inhlanganisela eyamukelekile kanye nezinguqulo ze-firmware. Uma iphutha elilandelayo liphathelene nezikhathi zokukhetha ithrafikhi, liphathe ngokwehlukile, ngoba isivumelwano nge-cryptography asisho lutho mayelana nokuthi yimaphi amasubneti avikelwa ithube. I-strongSwan idokhumenti yeziphakamiso ihlanganisa i-syntax yamahlu womabili.