IKEv2 ku-Windows ne-FortiGate: izilungiselelo ezintathu abantu abazihlanganisayo
Ukushintshana kokhiye kwe-IKE, ukuvikelwa kwe-CHILD SA kanye nokuqinisekisa umlingani kuyimigqa emithathu ehlukene. Izinombolo zeqembu ezifanayo kumawindi amabili azizihlanganisi.
Isivumelwano se-IKEv2 phakathi kwekhasimende le-Windows negethiweyi ye-FortiGate sihlala sehluleka, futhi ukufuna inombolo engafani kunikeza uhlu olude lwezinombolo. Uhlu lulawuleka kuphela lapho luhlukaniswa lube imigqa emithathu ehluleka ngokuzimela: ukushintshana kokhiye okuvikela i-IKE, ukuvikelwa okusetshenziswa ku-CHILD SA, kanye nokuqinisekisa okufakazela ukuthi ubani uhlangothi ngalunye. Izinombolo zeqembu zivela emigqeni emibili yaleya futhi zisho izinto ezahlukene.
Imigqa emithathu ehluleka ngokuzimela
Umugqa wokuqala ukushintshana kokhiye ngaphakathi kwe-IKE uqobo, okukhiqiza okhiye abavikela ukuxoxisana. Owesibili isiphakamiso se-CHILD SA, esivikela ithrafikhi ethwalwa umhubhe. Owesithathu ukuqinisekisa, okunquma ukuthi uhlangothi ngalunye lwethula ini nokuthi olunye lukuqinisekisa kanjani.
Ukwehluleka kwehlela ezindaweni ezahlukene. Ukwehluleka kokushintshana kumisa ukuxoxisana ngaphambi kokuba kube khona umhubhe. Ukwehluleka kwe-CHILD SA kwenzeka ngemva kokuphumelela kokuqinisekisa, kwesinye isikhathi kuphela lapho kushintshwa ukhiye. Ukwehluleka kokuqinisekisa kungabonakala njengokwehluleka kokushintshana kumalogi uma ufunda iphutha lokuqala kuphela.
Ukuhlukanisa imigqa akusikho ukugcina izincwadi. Kushintsha ukuthi yisiphi isilungiselelo okufanele sishintshwe, futhi kuvimbela isinyathelo esibiza kakhulu kuyo yonke le ndawo, okuwukukhiqiza kabusha izitifiketi ezisebenzayo ukuze kulungiswe ukungafani kwesiphakamiso. Umugqa owodwa oguqulwayo akumele uphoqelele eminye emibili ukuba iguquke nawo. Leyo nkululeko iyona njongo yonke yokubabhala ngokwehlukana.
Imikhakha emibili ye-Windows ilawula ini
I-Windows ihlukanisa imikhakha emibili: DHGroup ihlela ukushintshana kwe-IKE uqobo, kuyilapho PfsGroup ihlela inqubomgomo ye-IPsec evikela ithrafikhi esemhubheni. Zingezigaba ezahlukene. Ukuqhathanisa inkambu ye-IKE ye-Windows nenani le-phase-2 le-FortiGate kuhlola umbhangqwana ongawona, futhi izinombolo zingafana kuyilapho ukushintshana okuyisisekelo kusahluleka.
Get-VpnConnection -Name "Corp-IKEv2"
Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSAUmyalo wesibili nowesithathu ubika izinhlangano zokuphepha ezikhona ngempela, futhi yilokho okuseduze kakhulu nempendulo ikhasimende engayinikeza. Inhlangano ye-main-mode engenayo inhlangano ye-quick-mode iyinkinga ye-CHILD SA, futhi iwuphawu lokungafani kwe-phase-2 hhayi inkinga yesitifiketi.
Rekhoda ukuthi kwahlongozwa ini futhi kwakhethwa ini emzameni owodwa. Uhlu oluhlongoziwe oluqukethe isiphakamiso esamukelekayo kanye nesiphakamiso esikhethiwe esingahambisani nenqubomgomo yegethiweyi kuwukungezwani kokulungiselelwa, hhayi imfihlakalo yokusebenzisana.
| Agreement row | Where it is configured in Windows | What it does not decide |
|---|---|---|
| IKE key exchange | DHGroup on the VPN connection IPsec settings | The protection used for tunneled traffic |
| CHILD SA protection | PfsGroup in the same policy object | Which certificate the peer presents |
| Peer authentication | Machine or user certificate, or a supported EAP method | Any group number used for key exchange |
| Certificate validation | Trusted CA store on the validating side | The private key of the certificate being presented |
Iqembu le-elliptic-curve alikhethi ukhiye wakho wesiginesha
Umqondo oyiphutha oqinile kule ndawo ukuthi ukukhetha iqembu le-DH le-elliptic-curve kudinga isitifiketi se-elliptic-curve. Iqembu le-DH linikeza impahla yokushintshana kokhiye; i-algorithm yesiginesha ixoxiswana ngohlaka lokuqinisekisa, futhi lezi zinto ezimbili yizinqumo ezihlukene ku-IKEv2.
I-RFC 7427 ikhona ngoba lezo zinqumo zazixakene ngaphambili, ichaza ukuthi ama-algorithm esiginesha amenyezelwa futhi akhethwa kanjani ngaphandle kokuncika ekushintshaneni kokhiye. Igeythiweyi eyodwa ingasekela iqembu le-curve kanye nokukhethwa kwamasu esiginesha ngasikhathi sinye.
Ngakho uma ukuxoxisana kwehluleka ngemva kokushintshwa kweqembu, bheka indlela yokuqinisekisa ngaphambi kokubheka uhlobo lokhiye wesitifiketi. Ukushintsha isitifiketi kuwukusebenza okunensayo nokuyingozi okungavamile ukuba yimpendulo, futhi ukukwenza kuqala kubhubhisa ikhono lakho lokuthi wazi ukuthi yikuphi ukushintsha okwasiza ngempela. Funda umugqa wokuqinisekisa ngaphambi kokuthinta isitoreji sezitifiketi.
Gcina kokubili emigqeni ehlukene yeshidi lesivumelwano futhi lelo phutha liyeke ukuheha. Umugqa owodwa ubala amaqembu, omunye ubala amasu esiginesha nobunikazi, futhi akukho okungubufakazi ngomunye.
Beka ukhiye ngamunye wangasese kumnikazi wawo wangempela
Igeythiweyi ethula isitifiketi sayo idinga ukhiye wangasese ohambisana naso. Umlingani oqinisekisa uchungechunge udinga isitifiketi se-CA, futhi akudingi ngokukhethekile ukhiye wokusayina we-CA. Ukudida lezo zinto ezintathu yikho okwenza abantu bangenise ukhiye wangasese we-CA kudivayisi ye-VPN ukuze isitifiketi sibonakale sesigabeni esihlukile.
Ku-FortiOS izindima zihlukene: isitifiketi sasendaweni nokhiye waso, isitifiketi sakude esisetshenziselwa ukukhomba umlingani, kanye nokufakwa kwe-CA yakude okusungula ukuthembela kuzitifiketi ezasayinwa yileyo CA. Ukufakwa kwe-CA yakude okungenaye ukhiye wangasese akukapheleli; kulungile ngenjongo yako.
Okhiye bokusayina be-CA abangenisiwe bandisa igunya lanoma ubani ongafunda leyo divayisi. Futhi abalungisi ukuqinisekiswa okujwayelekile komlingani, ngoba ukuqinisekisa kudinga isitifiketi esisemphakathini nesinqumo sokuthembela, hhayi ikhono lokukhiqiza izitifiketi ezintsha.
Gcina ukhiye wokusayina we-CA emkhakheni womkhiphi uqobo, futhi rekhoda ukuthi iyiphi idivayisi ephethe ukhiye upi. Ithebula elifushane labanikazi libaluleke ngaphezu kwethebula elide lama-algorithm lapho ucwaningo lubuza ukuthi ubani wayengazenza ubani. Akekho ongenisa ukhiye azi ukuthi uwuhlu kuphela. Bhala uhlu ngaphambi kwesigameko, hhayi ngemva kwaso.