iPhone IKEv2 kuya ku-RouterOS: yiluphi uphawu oluya kuphi
Izimangalo ezine ezihlukene zinquma umhubhe we-IKEv2 ku-iOS: ikheli elishaywayo, ubunjalo besiphakamiso obulindelekile, ubunjalo bomthengi obuzibiza ngalo kanye nezinto zesitifiketi.
Ukufinyelela isango le-MikroTik kuxazulula kuphela ingxenye yezokuthutha yokusetshenziswa kwe-IKEv2 futhi akukho okunye. Ngemva kwalokho, izimangalo ezine ezihlukene zinquma ukuthi umhubhe uzakheka yini: ikheli ucingo olushayayo, ubunjalo besiphakamiso ucingo okulindele, ubunjalo ucingo ozibiza ngabo, kanye nezinto zesitifiketi ezisekela leso simangalo. Zihlole ngokulandelana kwalokho, futhi ume kwelokuqala elingahambisani nalokho okwethulwa isango. Ngakunye kuhlelwa endaweni ehlukile, yingakho ukuhlela okungalungile kuvame ukuhambisa iphutha esikhundleni sokulilungisa.
| Setting | What it decides | What it has to agree with |
|---|---|---|
| Remote address | where IKE packets are sent | a reachable name or address for the gateway |
| Remote Identifier | which server identity is expected | the gateway certificate name and the peer identity RouterOS presents |
| Local Identifier | who the phone claims to be | the client certificate name and the RouterOS identity entry |
| Certificate payload | trust plus proof of key possession | the issuing chain and a usable client private key |
Hlola izinkambu zephrofayela ngokulandelana okusetshenziswa ukushintshana
Ikheli elikude iyindawo okuya kuyo iphakethe lokuqala le-IKE futhi akukho okunye. Isihlonzi esikude yilokho ucingo olulindele ukuthi isango likufakazele, futhi liyigama, akuwona umzila. Ukugcwalisa kokubili ngegama elifanayo lomsingathi kuyasebenza lapho isitifiketi sesango sineso sigama, futhi kuyahluleka ngendlela ebukeka njengenkinga yomzila lapho singenaso. Funda iphrofayela njengochungechunge lwezimangalo, hhayi njengohlu lwezinkambu okufanele zigcwaliswe.
Isihlonzi sasendaweni isimangalo socingo ngokwaso, futhi kufanele kube igama elamukelwa ukufakwa kobunjalo kwe-RouterOS lesitifiketi somthengi ucingo olusethulayo. Uma kokubili kungavumelani, isango liyenqaba ukuxhumana ngemva kokuthi isitifiketi ngokwaso siqinisekisiwe, futhi ilogi ibukeka njengenkinga yegunya hhayi yokuqamba amagama.
Hlola izihlonzi ngokuqhathanisa nalokho okwethulwa isango
Ukufakwa kozakwethu kwe-RouterOS okulungiselelwe ukuqinisekisa ngesitifiketi kwethula isitifiketi sako, futhi ubunjalo baso buthathwa kuleso sitifiketi ngaphandle uma ulungiselele okunye. Uma isihlonzi esikude socingo sisho igama le-DNS lesango, isitifiketi sesango sidinga lelo gama endaweni ezoqanjwa ucingo, ngokuvamile igama elihlukile lesihloko. Isitifiketi esikhishwe ngelinye igama elivamile ngeke siqinisekiswe ngisho uma ukhiye nokuxhumana kuphelele.
Amaphrofayela e-Apple aphethwe angaba nomkhawulo wegama lesitifiketi ohlolwa ngaphezu kwezinkambu zesihlonzi. Hlola okugcwele kokuqukethwe esikhundleni sokucabangela igama lokuqinisekisa ngokukhonjiswa yisikrini sezilungiselelo, ngoba kokubili akusona isilungiselelo esisodwa.
Hlola ukuthi isitifiketi somthengi siwukhiye, hhayi nje isisekelo sokwethenjwa
Ukungenisa isitifiketi se-CA kunika ucingo into yokuqinisekisa ngayo isango. Akuniki ucingo ubunjalo bomthengi, futhi ukuqinisekisa ngesitifiketi kudinga isitifiketi seqabunga lomthengi kanye nokhiye waso oyimfihlo okulethwa ndawonye ngomzila wokubhalisa ogunyaziwe. I-PKCS#12 eyakhiwe ngaphandle kokhiye oyimfihlo ikhiqiza iphrofayela efakwa ngokuhlanzekile futhi engaqinisekisi lutho.
Iqabunga lomthengi lidinga futhi ubunjalo obulindelwe uhlangothi lwe-RouterOS, okusho ukuthi isihloko noma igama elihlukile lesihloko kufanele kuhambisane nokulungiselelwa kobunjalo okuhambisanayo. Ukukhishwa kwezitifiketi zomthengi nezeseva ku-CA eyodwa kwenza uchungechunge lube lula futhi akwenzi amaqabunga amabili ashintshisane.
Hlola ukuthi inqubomgomo ye-RouterOS iyalemukela lelo gama
Esangweni, ukufakwa kozakwethu kubeka indlela yokushintshana nendlela yokuqinisekisa, futhi ukufakwa kobunjalo kuhlanganisa ubunjalo obukude obamukelwe nesitifiketi kanye nenqubomgomo elandelayo. Ku-RouterOS v7 leyo mbhangqwana ivezwa ngokufakwa kozakwethu nobunjalo kwe-IPsec, isibonelo umzakwethu we-IKEv2 one-auth-method=digital-signature. Hlola okuqukethwe kwemenyu kwangempela kunguqulo yakho efakiwe, hhayi umhlahlandlela obhalelwe endala.
Yilapha futhi lapho ukungavumelani kulungiswa khona ngezindleko eziphansi, ngoba isango lingakutshela kokubili ubunjalo obutholile nobunjalo obebukufuna. Ukwandisa ubunjalo obamukelwe ukuze kuthuliswe iphutha kususa isibopho esanikeza ukusetshenziswa incazelo.
Hlola ukuthi yisiphi isigaba esihlulekile ngaphambi kokuhlela noma yini
Funda umzamo ezinhlangothini zombili futhi uwuhlukanise ngaphambi kokushintsha isiphakamiso. Ukungavumelani kwesiphakamiso, ukhiye wokusayina ongekho, umkhiphi ongethembekile, isihlonzi sozakwethu esingalungile kanye negunya lomthengi elenqatshiwe konke kubukeka njengomhubhe ofile uma kubonwa ocingweni, futhi ngakunye kunomnini ohlukile. Ukushintsha zonke izilungiselelo ezinhlanu ngesikhathi esisodwa kuqinisekisa ukuthi awuyi kufunda lutho emphumeleni.
Rekhoda ubunjalo obethulwe, ubunjalo obulindelekile, umkhiphi kanye nenombolo yochungechunge yesitifiketi kanye negama lenqubomgomo efanele, kanti gcina okhiye abayimfihlo nezimfihlo zephrofayela ngaphandle kwalowo mbhalo. Uma ukuqinisekisa kuphumelela, hlola insizakalo yangasese kanye nempendulo yayo, ngoba ukwabiwa kweekheli, izikhethi, i-DNS kanye nenqubomgomo yokufinyelela kusafanele kusebenze ngemva kokuphela kokushintshana kwe-IKE.