IKEv2 isebenzisa i-UDP 500 ne-4500: yiphi ethwala idatha?

Ukuvula i-UDP 500 ku-firewall kwenza umhubhe ukuba uxoxisane, bese ukuxhumana kuyeka ukudlulisa ithrafikhi. Uhlu lwezimbobo lwalungaphelele, hhayi olungalungile. I-IKEv2 iqala kusokhethi eyodwa futhi ekusetshenzisweni kwangempela okuningi iqhubeka kwesinye, kanti umthwalo kungenzeka ungabi imbobo nhlobo. Ukufunda izigaba ngokulandelana kuchaza ukuthi muphi umthetho ongekho.

Izimbobo ezimbili, imisebenzi emibili

I-IKEv2 iqala ngokushintshana kokhiye ku-UDP 500, lapho izinhlangothi ziqinisekisa khona futhi zisungula inhlangano yezokuphepha yomhubhe. Indlela yedatha elandelayo iyindaba ehlukile: ingaba i-ESP yemvelo, okuyinombolo yephrothokholi ye-IP hhayi imbobo, noma ithrafikhi ehlanganiswe ku-UDP ku-4500. Ukuhlukanisa lezi ezimbili ekubuyekezweni kwe-firewall iwumehluko phakathi komhubhe oxoxisanayo nomhubhe osebenzayo. Isokhethi eyodwa ithwala ukulawula kanti esinye sithwala umthwalo.

Yingakho umthetho ovumela i-500 kuphela ukhiqiza uphawu oludida kakhulu kuwo wonke umndeni wephrothokholi: ukuxoxisana kuyaphumelela futhi akukho lutho olusizo olulandelayo. Isimo sikhombisa i-peer, ilogi ikhombisa i-IKE SA esunguliwe, futhi uhlelo lokusebenza lusagcina isikhathi. Imvume engekho ingeyomfudlana ohlukile kunalowo osanda kuphumelela.

Kungani i-4500 ikhona

Amadivayisi amaningi e-NAT awakwazi ukudlulisa iphrothokholi engeyona i-TCP noma i-UDP, futhi amanye abhala kabusha amakheli ngendlela ephula ukuhlolwa kobuqotho be-ESP. Ukuhlanganisa i-ESP ku-UDP kuxazulula zombili izinkinga, ngezindleko zekhanda elingeziwe kanye nembobo yesibili okufanele ivunyelwe. Lokho kuhlanganisa yikona okuyisizathu sokuthi imbobo yesibili ibekhona.

Lapho i-NAT itholakala, i-IKE ngokwayo iya ku-4500 ukuze yonke ithrafikhi yabelane ngomzila owodwa ngokusebenzisa isihumushi. Umaka wamabhayithi amane okungeyona i-ESP uhlukanisa imilayezo yokulawula nedatha kuleso sokhethi. Lokhu kushintsha kuyisinqumo sephrothokholi, hhayi ukuthanda komlawuli.

Kuphi lapho imbobo yomthombo ishintsha khona

Isihumushi singabhala kabusha imbobo yomthombo yeklayenti, ngakho i-tuple ebonakala kuseva ayifani ne-tuple ekuklayenti. Bheka izinhlangothi zombili zazo zonke izigaba ze-NAT ngaphambi kokuphetha ngokuthi umthetho awunakwa. Ukuxazulula izinkinga kuklayenti kuphela kungaveza umthetho obonakala ulungile futhi uhluleke.

Ukusetshenziswa okusekela i-MOBIKE nakho kungaya ku-4500 ngaphandle kokutholwa kwe-NAT, futhi okunye ukusetshenziswa kuphoqelela lowo mzila ngamabomu. Ngakho ukubona i-4500 kuwubufakazi besinqumo, hhayi ubufakazi berutha yasekhaya.

Hlola imifudlana yomibili kuwo wonke umngcele

Dlula emingceleni emithathu: inethiwekhi yeklayenti, noma iyiphi i-firewall ephakathi, kanye neseva. Ngayinye idinga imifudlana ebalulwe ukusetshenziswa, hhayi imifudlana evela ku-athikili ngelinye icala.

sudo swanctl --list-sas
sudo tcpdump -ni any 'udp port 500 or udp port 4500'
sudo iptables -S | grep -E '500|4500|esp'
ip xfrm state

Umugqa we-ESP ohlwini lwe-firewall uwukufana kwephrothokholi, ngakho umthetho wembobo awukaze uyimboze. Uma umsebenzi esebenzisa imbobo yangokwezifiso, landela ukucushwa okubhaliwe kuzo zombili iziphetho, ngoba iklayenti alikwazi ukwakha isilaleli kuseva ngokukhetha inombolo eyaziwayo.

Rekhoda lapho ukuxoxisana kwagcina khona nokuthi inhlangano yezokuphepha yengane yafakwa yini, ngoba lelo pheshana lihlukanisa umzila ovinjiwe nephutha lokufakazela noma lenqubomgomo. Bese uphinda isivivinyo ngokuqinisekisa iseva kuvuliwe, ngoba ukufinyeleleka akukona ukufakazela. Leso sinyathelo sokugcina sihlukanisa imbobo evunyelwe ne-peer ethembekile.