Lapho i-IKEv2 ibuyisela i-TS_UNACCEPTABLE, qhathanisa izinethi zangempela ezingaphansi
Ukwenqatshwa kwesikhethi ukungavumelani ngokumbozeka phakathi kwezinhlangothi ezimbili. Phendula izimpawu zasekhaya nezakude, bese uqhathanisa amabanga aqondile aphakanyiswa uhlangothi ngalunye.
Funda i-TS_UNACCEPTABLE njengokungavumelani ngokumbozeka, hhayi njengephrofayela eyonakele. Isango lithi izinhlangothi ezimbili azikwazanga ukuvumelana ukuthi yimaphi amakheli lo mhubhe ongawathwala. IKE SA kungenzeka ukuthi isivele imile ngaleso sikhathi, yingakho iklayenti lingabonakala lixhunyiwe ngaphandle kwe-SA eyingane ngemuva kwalo. Uma ukubeka ngale ndlela, umsebenzi uba ngowomshini. Bhala iziqalo ezihlosiwe zezinhlangothi zombili, ziqhathanise ohlangothini olulodwa, futhi unciphise kuze kube ziyahlangana.
Qala ngokubhala amabhangqa ahlosiwe
Ngaphambi kokuthinta ukulungiselelwa, bhala amanani amane: ibanga lomthombo lomqalisi, ibanga lendawo aya kuyo, kanye nalelo bhangqa elibonwa ohlangothini lomphenduli. Bhala nomndeni wamakheli wawo wonke. Ibanga le-IPv4 nebanga le-IPv6 izinhlobo ezihlukene zokukhetha, futhi akukho okungagoqwa kumthwalo wokunye.
Engeza noma yikuphi ukukhawulwa kweprothokholi noma kwetheku elithwelwa inqubomgomo. Umthetho ovumela kuphela i-TCP 445 eya kuseva yamafayela uchaza iqoqo elincane kunenethi engaphansi elikuyo. Uma ukushiya lokho ngaphandle kwamanothi akho, umphumela wezingxoxo uzobonakala ungahambisani ngezizathu ongaziboni.
Phendula izimpawu ngaphambi kokuqhathanisa
Okwasekhaya nokwakude kuyizimpawu eziqhathanisayo. Isiqalo sasekhaya sekhayenti ibanga lakude lesango, futhi ibanga lasekhaya lesango ibanga lakude lekhayenti. Yingakho izithombe zesikrini ezivela emikhawulweni emibili azivumelani neze, futhi ukuziqhathanisa ngokwezwi ngezwi iyona ndlela ejwayelekile yokulahlekelwa yintambama.
Umphenduli angase anciphise isiphakamiso sibe yiqoqo elincane elamukelekayo esikhundleni sokulichitha. Lowo mphumela mubi kunokwehluleka okumsulwa, ngoba usebenza ngengxenye. Cela i-10.0.0.0/16 lapho inqubomgomo ivumela i-10.0.5.0/24, futhi ungagcina nge-SA eyingane ehlanganisa kuphela leyo /24. Isibungu esisodwa siphendula, konke okunye kuyawa ngaphandle, futhi akukho lutho kukhayenti okusho lokho. Funda izikhethi ezamukelwe hhayi lezo eziceliwe ngaphambi kokuphetha ngokuthi izingxoxo ziphumelele.
Amaphrofayela e-road warrior acela umzila ozenzakalelayo ehla lapha njalo. Isango elakhelwe ukufinyelela okuhlukanisiwe linciphisa isiphakamiso sebanga eliphelele libe yizinethi zalo ezingaphansi, futhi iklayenti kufanele lamukele umphumela oncishisiwe noma lihluleke ngomsindo.
Funda ukwenqatshwa emzamweni owodwa
Qoqa womabili amalogi emzamweni wokuxhumana owodwa. Iphrofayela egciniwe ibonisa lokho okulungiselelile, hhayi lokho okuphakanyisiwe, futhi ku-strongSwan i-swanctl --log iphrinta isaziso esitholiwe kanye nezikhethi ebezithwele.
Bese uhlola ukuthi yini eyafakwa ngempela. I-swanctl --list-sas ibonisa izikhethi ze-SA eyingane, futhi i-ip xfrm policy ibonisa lawo mabanga njengokufakwa kwenqubomgomo ye-kernel. I-SA eyingane kulolo hlu ehlome ngezikhethi obungazihlosanga ingumcimbi wokuncipha; ukungabikho kwe-SA eyingane kanye ne-TS_UNACCEPTABLE kulogi ukwenqatshwa.
Ngesikhathi usulapho, hlukanisa omakhelwane abaseduze. I-INVALID_SELECTORS ikhononda ngesikhethi esingaphakathi kwe-SA eyingane esivele isunguliwe, kuyilapho i-INTERNAL_ADDRESS_FAILURE isho ukuthi umphenduli akakwazanga ukwaba ikheli mbumbulu, okuyinkinga yedamu hhayi yokumbozeka.
Hlola ukuthi yini enciphisa iqoqo buthule
Izinto ezintathu zinciphisa iqoqo lezikhethi ngaphandle kokusho lutho. Inqubomgomo yomphenduli ngeyokuqala, ngohlu lwezinethi ezingaphansi, imithetho yeqembu noma ugunyazo lomsebenzisi ngamunye olwehlisa isiphakamiso libe yiqoqo elincane. Umndeni wamakheli owesibili: iklayenti elineziteki ezimbili livame ukuphakamisa i-IPv6 eceleni kwe-IPv4 futhi lithole ukwenqatshwa kwamabanga angakaze alungiselelwe isango.
Ukukhawulwa kweprothokholi netheku kungokwesithathu. Lapho inqubomgomo ivumela i-TCP 445 kuphela, i-SA eyingane ingakhuphuka kuyilapho i-ICMP ne-UDP zihlala ngaphandle, futhi umsebenzisi ubika umhubhe ophukile nakuba iprothokholi eyodwa kuphela eyayivunyelwe.
Ngakho-ke ukwandisa amakheli kuphela akukwazi ukulungisa inqubomgomo ekhawulwe ngetheku, futhi yilokhu kanye ikesi okungenzeka kakhulu ukuthi lidlule imijikelezo emithathu yokuxazulula izinkinga ngaphandle koshintsho.
Fakazela ukumbozeka ngethrafikhi efanele
Ngemva kokuba i-SA eyingane ifakiwe, thumela isicelo esisodwa esiwela ngokuqinisekile ngaphakathi kwamabanga amukelekile. Bheka izibali hhayi isithonjana sesimo: i-ip -s xfrm state nezibali ezingemuva kwe-ip xfrm policy ziyakhula lapho iphakethe liqhathaniswa futhi livikelwa. Inani lamabhayithi elihlala linguziro ngemva kwethrafikhi yangempela lisho ukuthi i-kernel ayikaze ikhethe leyo nqubomgomo.
Lolo ziro yinkinga yokuhambisa noma yokulandelana kwenqubomgomo, hhayi inkinga yokubethela. Kubonakala kufana ncamashi nokwenqatshwa kwesikhethi kusukela esihlalweni somsebenzisi, yingakho izibali kufanele ziqoqwe ngaphambi kokuvula kabusha iphrofayela. Izibali ezikhuphuka ohlangothini olulodwa kuphela zikhomba endleleni yokubuya esikhundleni salokho.
Qeda ngokubhala ibhangqa elamukelekile kwithikithi, eceleni kwebanga elicelwe ekuqaleni. Gcina ukukhetha kuncane njengemfuno, ngoba ukususa iphutha ngokufaka wonke amakheli esikhundleni sebanga langasese kunikeza ukufinyelela okungaphezulu kakhulu kunalokho okwagunyazwa i-akhawunti.