I-Remote ID ku-VPN ku-iPhone: umusho lo uqobo usho ukuthini
I-Remote ID ubunikazi okufanele iseva ikufakazele ku-iPhone yakho; i-Local ID ubunikazi obushiwo iklayenti. Nansi into yokuthi yiluphi uhlamvu olungena kuyiphi inkambu.
Usemakwezini (Settings) wengeza ukulungiselela kwe-IKEv2, futhi izinkambu ezimbili zifuna umbhalo ongakunikezwa muntu: i-Remote ID ne-Local ID. Akukho kuzo okuyigama lakho lomsebenzisi, futhi akukho okuyikhophi yesibili yenkambu ye-Server. I-Remote ID ubunikazi okufanele igeyithi ikufakazele ku-iPhone yakho; i-Local ID ubunikazi obushiwo i-iPhone yakho kugeyithi. Uma uphutha kwenye yazo, ithuneli liyafa ngemva kokuba iseva isiphendulile, yingakho ukwehluleka kubonakala njengenkinga yephasiwedi kanti akusiyo.
Zikuphi izinkambu ku-iOS
Vula Amakwezi > Jikelele > i-VPN nokuphathwa kwedivayisi > i-VPN bese wengeza ukulungiselela kwe-IKEv2. Ngaphansi kokuqinisekisa ukuthi ungubani ukhetha Igama Lomsebenzisi noma Isitifiketi, futhi kungemva kwalokho lapho i-Remote ID ne-Local ID zivela khona njengezikhwama zombhalo okhululekile. Lezi zimpawu zokuhlonza, hhayi amakheli: i-iOS izithwala ekushintshiswaneni kwe-IKE_AUTH, lapho i-IKEv2 ibiza ubunikazi bomqalisi nge-IDi nobompenduli nge-IDr.
Ngemva kokugcina, i-iOS isonga ukulungiselela kube umugqa owodwa futhi iyeke ukubonisa amanani. Thepha inkinobho yolwazi noma uvule iphrofayela futhi ngaphambi kokuphetha ngokuthi izinkambu zingenalutho. Ukulungiselela okuthunyelwe yi-MDM kungazenza zibe mpunga ngokuphelele, futhi lokho kushintsha ukuthi ubani ongalungisa inkinga.
I-Remote ID igama legeyithi
Leli yinani i-iPhone yakho elilindele ukuthi iseva ilifakazele. Ngokuqinisekisa ngesitifiketi, liqhathaniswa negama elisestifiketini seseva, ngokuvamile i-subject noma umugqa we-subjectAltName. Uma isitifiketi sikhishwe se-vpn.example.com, lelo gama lomhambi liyi-Remote ID, ngisho noma ufinyelela umshini ngekheli le-IP elingenalutho.
Lokho kungafani yikho ukwehluleka okudala: amaphakethe afika, iseva iphendula, futhi ukuxhumana kusawa noma kunjalo ngoba ubunikazi obusestifiketini abuhambisani nalokho obekufunwa iphrofayela. Ukukhomba inkambu ye-Server ku-IP eluhlaza akusizi, futhi kuma-geyithi amaningi iseva iyeka nje ukuphendula ubunikazi engakwazi ukubufanisa.
Igeyithi inokulungiselela okuhambisanayo. Iseva ye-strongSwan ithumela ubunikazi bayo nge-leftid futhi ingakhawulela ubunikazi beklayenti nge-rightid; uma izinhlangothi zombili zingavumelani ngohlamvu, i-IKE_AUTH iyehluleka kuzo zombili izinhlangothi. Buza umqhubi ukuthi isitifiketi sikhishwe sabuphi ubunikazi esikhundleni sokukopa i-URL kubha yesiphequluli.
I-Apple ibhala imibhalo yomthwalo njenge-RemoteIdentifier ne-LocalIdentifier encwadini yezilungiselelo ze-IKEv2. Zombili ziyizinhlamvu ezijwayelekile, ngakho ukusetshenziswa kwezinhlamvu ezinkulu nezincane kanye nesikhala ekugcineni kungabaluleka.
I-Local ID yilokho okushiwo i-iPhone yakho
Ngokuqinisekisa ngegama lomsebenzisi, i-EAP ihlola igama nephasiwedi, kanti i-Local ID ubunikazi be-IKE obuhlukile obuphoqwa amanye amageyithi. Igeyithi lingafuna ukuthi i-Local ID ilingane negama lomsebenzisi, ibe ikheli le-imeyili, noma ihambisane nomugqa emgomeni wayo wokuxhumana; amanye ayiyeke. Ukuyishiya ingenalutho kuphephile kuphela lapho umqhubi esho kanjalo.
Ngokuqinisekisa ngesitifiketi, i-Local ID kufanele ihambisane nobunikazi igeyithi elibamukelayo kuleso sitifiketi seklayenti, ngokuvamile igama elijwayelekile lesitifiketi noma inani elixhunywe kurekhodi ledivayisi. Ukukopisha iphrofayela kazakwethu kukopisha nobunikazi bakhe. Esimeni esihle kakhulu igeyithi ibhala idivayisi engalungile; esimeni esibi kakhulu umgomo wedivayisi ngayinye uyakwenqaba.
Umgibe ukucabanga ukuthi okungenalutho kusho ukuthi akukho bunikazi. Ungagcwali inkambu engenalutho ngekheli lakho le-imeyili ngoba nje ibonakala ingaqediwe. Qinisekisa inani obekuhloswe lona bese ulifaka ngqo njengoba linikeziwe.
Ukuhlolwa kwemizuzu emihlanu ngaphambi kokugcina
Zihambise ngokulandelana; isinyathelo sokuqala esihlulekayo yisona okufanele silungiswe.
- Thola izinhlamvu ezintathu kumqhubi: igama elisestifiketini seseva, i-Local ID elindelekile kanye nendlela yokuqinisekisa.
- Hambisa indlela yokuqinisekisa. I-Remote ID ne-Local ID azithathi indawo yegama lomsebenzisi nephasiwedi, futhi iphrofayela yesitifiketi ngeke yamukele iphasiwedi.
- Bhala amanani ngqo, kuhlanganise nezinhlamvu ezinkulu nezincane, ngaphandle kwesikhala ekugcineni.
- Shiya ukuqinisekiswa kwesitifiketi kuvuliwe. Ukufaka isitifiketi sempande esingahlobene ukuze kuthuliswe isixwayiso kufihla ukungafani kwegama esikhundleni sokukulungisa.
- Hlola ngedatha yeselula, hhayi i-Wi-Fi yasehhovisi, ukuze iphothali yokubamba noma i-DNS ehlukanisiwe kungazenza inkinga yobunikazi.
| Field | What belongs there | What a wrong value looks like |
|---|---|---|
| Remote ID | The DNS name in the gateway certificate | Server answers, then the tunnel drops with a certificate or identity error |
| Local ID | The identity the gateway policy expects for you | IKE_AUTH or user authentication fails after the server responds |
| Server | A reachable hostname or IP | Timeout with no identity exchange at all |
Funda ithebula kusuka phezulu. Ukuphela kwesikhathi emugqeni we-Server kusho ukuthi izinkambu zobunikazi azikaze zihlolwe, ngakho ma lapho. Iphutha elivela kuphela ngemva kokuphendula kveseva cishe ngaso sonke isikhathi ukungafani kwe-Remote ID noma i-Local ID.
Amaphutha akhomba inkambu engalungile
Umlayezo ofana no-"User authentication failed" umayelana nezimpawu zokungena noma i-EAP, hhayi i-Remote ID. Isixwayiso sesitifiketi simayelana negama elisestifiketini, futhi yilapho i-Remote ID neningkambu ye-Server kuhlangana khona. I-"The VPN server did not respond" ngokuvamile isho ukuthi i-UDP 500 no-4500 azikaze ziqede, noma ukudlula kwe-NAT kwehlulekile, futhi akukho bunikazi obaqhathanisiwe.
Ohlangothini lwegeyithi, ukwehluleka kobunikazi kubonakala ngendlela ehlukile: i-peer iyenqatshwa ngesikhathi se-IKE_AUTH, noma ilogi isho i-ID ethunyelwe yiklayenti futhi ithi ayihambisani nokuxhumana. Lowo mugqa welogi uyindlela eshesha kakhulu yokuqeda ingxabano, ngoba ukhombisa uhlamvu oluqondile oluthunyelwe yifoni.
Ukusetha kabusha iphasiwedi ngeke kulungise ubunikazi baseseva obulindelekile, futhi ukushintsha i-Remote ID ngeke kulungise iphasiwedi engalungile. Hlukanisa isigaba kuqala, bese uhlela inkambu yesigaba leso.
Lapho iphrofayela ilawulwa
Uma izinkambu zimpunga, ukulungiselela kwavela ku-MDM futhi ifoni akuyona indawo yokukulungisa. Umthwalo we-VPN uthwala izimpawu zokuhlonza, ngakho ushintsho olulungile lusephrofayeleni kuseva yokuphatha, bese kufakwa kabusha kudivayisi.
Bheka Kumakwezi > Jikelele > i-VPN nokuphathwa kwedivayisi ukuthi iphrofayela iyalawulwa yini nokuthi ubani oyisayinile. Uma ungakwazi ukuyisusa, awukwazi ukuhlela izimpawu zokuhlonza endaweni, futhi iphrofayela yesibili yendawo idala kuphela ukulungiselela okungqubuzanayo.
Ngaphambi kokuthi uvale Amakwezi, bhala phansi izinhlamvu ezintathu okenzile nokuthi zavelaphi. Ngokuzayo lapho ithuneli lihluleka, qhathanisa i-ID eyatholwa yilogi yegeyithi naleyo nothi: uma yehluka, ubheke inkambu, hhayi iphasiwedi.