IKEv2 ikheli leseva uma liqhathaniswa nobunikazi: lokho iklayenti elikuhlolayo ngempela
Ikheli lithi ukudayela kuphi; ubuwena busho ukuthi yimuphi untanga okufanele wamukele. Ukuzixuba yingakho isango elinyakazayo noma isitifiketi esisha siphuka IKEv2.
Isango elishintsha ikheli lingaqhubeka nokusebenza ngenkathi isango elifanayo elingemuva kwesitifiketi esisha lima, futhi okuhlanekezelwe nakho kwenzeka. Ikheli litshela iklayenti ukuthi liwathumele kuphi amaphakethe; ubunikazi obuqinisekisiwe butshela iklayenti ukuthi untanga ophendulayo nguye okufanele amethembe. IKEv2 igcina lezo njengezinkambu ezimbili ezihlukene, okuwusizo uma uyeka ukuziphatha njengeyunithi yezinhlamvu eyodwa. Ziphinde zicushwe ezindaweni ezihlukene, ngakho-ke eyodwa ingaba ilungile ngenkathi enye ingalungile.
Wahlole ngale ndlela futhi ume ekungafanini kokuqala, ngoba amasheke akamuva acabanga ukuthi angaphambili adlulile.
Okokuqala, yiliphi inani ikheli
Ikheli lokuxhumana yinoma yini iklayenti elidayela yona: i-IP, igama elithi DNS elixazululeka kwelinye, noma isiphetho esingaphambili esinomthwalo wokulayisha. Lokho ulwazi lwezokuthutha futhi akukho okunye. Umazisi ugibela ekulayishweni kwe-ID ye-IKEv2 bese ufaniswa nesitifiketi sontanga. Igama elithi DNS ebhokisini lekheli alibi ubunikazi obulindelwe, futhi i-IP eluhlaza ayibi ubunikazi ngenxa nje yokuthi isokhethi lixhunywe kuyo.
Ngokwemigomo ye-strongSwan, ikheli lithi right noma left, futhi ubunikazi obulindelekile yi-rightid noma leftid, futhi yilokho IKEv2 amadokhumenti okumisa akuchazayo. Uma uke wahlela kuphela ikheli, ulungise uhhafu wokubhanqwa.
Okwesibili, lokho isitifiketi esingakufakazela
Umazisi unohlobo, futhi isitifiketi kufanele siphathe igama elifanayo. Ubunikazi be-DNS buneliswa ukufakwa kwe-dNSName kusandiso segama elihlukile lesihloko; i-IP identity idinga ukufakwa iPAddress. Isitifiketi esikhishelwe i-vpn.example.com asifakazeli lutho mayelana nekheli langempela 203.0.113.10, futhi esikhishelwe lelo kheli akufakazeli lutho mayelana negama. Ukukhipha kabusha igama elihlukile ngakho-ke akukhona ukumiselela kokungena, ngisho noma ukhiye ofanayo kanye ne-CA ziphinda zisetshenziswa.
Amaklayenti esimanje alinaki igama elivamile uma kunelinye igama lesihloko, futhi abaningi balishaya indiva ngokuphelele. Uma uhlu SAN lungenalo inani iklayenti elihlolwayo, ukuxhawula kuyehluleka ngemva kokuthi isitifiketi sesamukelwe kakade njengesithembekile, yingakho ilogu ifundeka njengephutha lobunikazi kunephutha lokwethenjwa.
Okwesithathu, ukuthi iklayenti ngalinye lisho kanjani lokho okulindelekile
Windows ithatha igama leseva noma ikheli olifakile futhi idinga isitifiketi ukuze ifane nalo, ngakho ukuthayipha i-IP kudala okulindelekile kwe-IP. Android IKEv2 iklayenti liziphatha ngendlela efanayo, futhi womabili enqaba isitifiketi esivumelekile, esethenjwa esidlangalaleni esiqamba umsingathi ohlukile. Iphrofayela ingaqala ukwehluleka ngenxa nje yokuthi othile ubeke ikheli lalo esikhundleni segama lomethuleli ngesikhathi sokuthutha. Bheka lokho iklayenti elikucelile ngaphambi kokuthi ubheke ukuthi isitifiketi siqukethe ini.
Ku-strongSwan okulindelekile kucacile: setha rightid kubunikazi obulethwa iseva, obungase buhluke kwesokudla. Ukuyimisa kokuthi %any yamukela noma yini enikezwa ontanga futhi kususa isheke ozama ukuligcina.
Okwesine, hlukanisa ukungena ngemvume komsebenzisi kusukela ekuhlonzeni kontanga
EAP ukuqinisekiswa kanye nobunikazi beseva baphendula imibuzo ehlukene. EAP ubunikazi obufana nokuthi [email protected] busho ukuthi umsebenzisi ungubani, ngemva kokuba iklayenti linqume ukuthi iseva iyona elungile. Ukuzungezisa leyo phasiwedi akukwazi ukulungisa ukungafani kobunikazi bontanga, ngoba uxhumo alufinyeleli esigabeni sokungena ngemvume komsebenzisi.
Umbiko ohlanziwe kufanele ubize kokubili: ubunikazi beklayenti obulindelwe, ubunikazi obethulwe yiseva, kanye nokufakiwe kwesitifiketi SAN kwesitifiketi.
Okwesihlanu, yishintshe ngesiteshi esiqinisekisiwe
Lapho isango lihamba ngokusemthethweni, buyekeza ikheli kuqala futhi ushiye ubunikazi bodwa, ngoba kunjalo IKEv2 isingatha kahle. Uma ubuwena bushintsha, buphathe njengomcimbi wokuthenjwa futhi uthole inani elisha emthonjeni osuvele uwethemba, hhayi endaweni yokugcina ehlulekayo njengamanje. Umlayezo olethwe ngoxhumano ozama ukuluqinisekisa akuwona ubufakazi mayelana nalolo xhumo.
Rekhoda ikheli lokugcina, ubuwena kanye nohlu lwe-SAN ndawonye kumanothi ephrofayela. Umuntu olandelayo ozothinta isitifiketi uyobe esebona ukuthi yimuphi kulaba abathathu ovunyelwe ukuhamba.