Iphrofayili ye-IKEv2 ichaziwe kodwa ayixhunyiwe: landela uchungechunge

Iphrofayili ye-IKEv2 isekuqeqesheni okugciniwe, indandatho yokhiye nayo ikhona, futhi ithuneli ayikhuphuki. Ku-Cisco IOS XE iphrofayili iyinto ethwala izinketho zokufaniswa kobunikazi nokuqinisekisa, futhi into ayenzi lutho kuze kube yilapho enye into iyikhomba futhi isixhumi esibonakalayo sixhumanisa leyo nto nendlela. Iningi lamaseshini okulungisa esigaba 1 ahlulekile ashiya obunye balokhu kubhekisela. Funda uchungechunge kusukela endandathweni yokhiye ukuya ngaphandle ngaphambi kokushintsha noma isiphakamiso noma inqubomgomo.

Uyini ngempela into yephrofayili

Iphrofayili ye-IKEv2 igcina ukufaniswa kobunikazi obukude, izindlela zokuqinisekisa zasendaweni nezakude, kanye nokubhekisela endandathweni yokhiye yezakhiwo ezinokhiye okwabelwana ngakho ngaphambili. Ichaza ukuthi i-peer ibonakala kanjani nokuthi iziqinisekisa kanjani, futhi ayisho noma isiphi isixhumi esibonakalayo.

Indandatho yokhiye iyinto ehlukile egcina okhiye ababelwana ngabo ngaphambili. I-crypto map noma iphrofayili ye-IPsec iyinto yesithathu ebhekisela kuphrofayili ye-IKEv2 futhi ihlinzeka ngezilungiselelo zokuvikela. Ukuxhumeka kwesixhumi esibonakalayo kuyisinyathelo sesine, lapho kusetshenziswa khona i-crypto map noma kuvulwa i-tunnel protection. Ukugxuma ngakunye kuwukubhekisela okuhlukile, futhi ukugxuma okungekho kushiya into ngayinye ibonakala ilungile uma ibhekwa yodwa.

Landela uchungechunge lwezinto ezibhekiselwayo ngokulandelana

Qala endandathweni yokhiye ekhonjwa iphrofayili, bese uqinisekisa igama lephrofayili elibhekiselwa kulo yi-crypto map noma iphrofayili ye-IPsec, bese uthola isixhumi esibonakalayo esisebenzisa leyo nto yokugcina. Bhala igama ngalinye eceleni kwento elisebenzisayo; lolo hlu olufushane luwusizo ukwedlula ukuhlola ukuthi yonke ibhlokhi elindelekile ikhona ndawana thizeni kuqeqesho.

Ukuphuka okuvamile kungokomshini. Igama lephrofayili lihluka ngohlamvu olulodwa kulelo elibhekiselwa kulo yi-crypto map. I-crypto map ikhona kodwa ayikaze isetshenziswe kusixhumi esibonakalayo. Umyalo we-tunnel protection ukhomba iphrofayili ye-IPsec ebhekisela kwenye iphrofayili ye-IKEv2. I-responder engenakho ukuxhumeka okucacile iyicala elibhaliwe, kodwa i-initiator engenakho ukuxhumeka ayikho nje elungiselelwe leyo ndlela.

crypto ikev2 keyring KR-SITE
 peer SITE-B
  address 203.0.113.9
crypto ikev2 profile IKEV2-SITE
 match identity remote address 203.0.113.9 255.255.255.255
 keyring local KR-SITE
crypto ipsec profile IPSEC-SITE
 set ikev2-profile IKEV2-SITE
interface Tunnel100
 tunnel protection ipsec profile IPSEC-SITE

Funda lesi siqephu njengochungechunge hhayi njengesifanekiso. Isixhumi esibonakalayo sisho iphrofayili ye-IPsec, iphrofayili ye-IPsec isho iphrofayili ye-IKEv2, futhi iphrofayili ye-IKEv2 isho indandatho yokhiye. Phula noma yiliphi kulawa magama futhi uqeqesho lusahlaziywa, yingakho umzila uwamukela futhi ithuneli lihlala phansi.

I-crypto map ne-tunnel protection ziyizindlela ezehlukene

I-Cisco ibhala izinhlelo ezimbili zokuxhumeka. I-crypto map ingasetshenziswa kusixhumi esibonakalayo futhi ingabhekisela kuphrofayili ye-IKEv2 ngomyalo wayo we-set. I-tunnel protection ixhumanisa iphrofayili ye-IPsec nesixhumi sesithuneli. Zombili zivumelekile, futhi azihloselwe ukufakwa ndawonye njengesinyathelo sokuvikela okukabili.

Umthombo nendawo okukhona kuyo ithuneli kubonisa ukuhlelwa kokulethwa kwangaphandle, futhi kuhlukile ekuxhumekeni kokuvikela. Isixhumi se-LAN, isixhumi sethuneli nesixhumi somthombo wangaphandle sidlala izindima ezintathu ezihlukene. I-crypto map esixhumini se-LAN ayivikeli ithuneli, futhi ithuneli elinokuvikela okuvuliwe kodwa elingenakho ikheli lomthombo elifinyelelekayo alisoze lithumele i-peer yalo iphakethe.

Hlola isimo esilayishiwe, hhayi umbhalo kuphela. Ukukhishwa okufakiwe kunemiyalo ehlanganisa izinto eziqeqeshiwe neseshini okuxoxiswene ngayo, futhi yilokho okufanele kucashunwe kuthikithi. Uqeqesho olugciniwe lubonisa inhloso; ithebula lamaseshini libonisa indlela.

Okushiyiwe kwe-responder akusona isimiso sama-initiator

Umhlahlandlela we-IOS XE uphawula ukuthi ukuxhumeka okuyisobala kokuphrofayili ye-IKEv2 kungaba yinto ozikhethela yona ku-responder. Lokho kushiya akususi ukuqinisekisa noma izahluko zobunikazi, futhi akwenzi iphrofayili ibe yinto ozikhethela yona ohlangothini oluqala ukuxhumana.

Uma umzila wakho uqala, thatha ukuxhumeka njengokuyisibopho futhi ukulandele kusukela ekuqaleni kuze kube sekupheleni. Uma umzila wakho uphendula kuphela, qinisekisa ukuthi iyiphi iphrofayili eyafaniswa ngempela ne-peer engenayo, ngoba i-responder ingakhetha iphrofayili ngobunikazi hhayi ngokubhekisela kwesixhumi esibonakalayo.

Hlola indlela, hhayi uqeqesho olugciniwe

Lapho ukuxhumeka kufana khona, hlola uhlelo olulodwa oluvunyelwe futhi urekhode umthombo wangaphakathi, indawo okukhona kuyo kanye nomzila. Isicelo esiqalwe umzila singasebenzisa ikheli lomthombo elihlukile kunethrafikhi edluliswa isuka ku-LAN, futhi ubukhulu bokuvikela bungase buhlanganise okukodwa kuphela kukho.

Incazelo exhunyiwe ngendlela efanele ayibonisi ukuthi izikhethi, indlela yokubuya kanye nenqubomgomo yesixhumi ihlanganisa ukugeleza kwakho. Thumela ithrafikhi yangempela futhi ufunde isimo okuxoxiswene ngaso, bese uphinda ngemva kokuxhuma kabusha ukuze wazi ukuthi uchungechunge luyasinda ezingxoxweni ezintsha. Gcina incazelo ngaphakathi kwe-IOS XE IKEv2; ukusetshenziswa komlando kwe-crypto map ye-IKEv1 kunomodeli wezinto ohlukile futhi akufanele kulungiswe ngalolu chungechunge.

Bhala lawo magama amane kurekhodi lwezinguquko lapho ithuneli lisebenza. Umuntu olandelayo ozothinta i-crypto map uzowadinga, futhi uchungechunge luyingxenye yokuklama uqeqesho olusebenzayo olungayichazi.