I-SA yengane ye-IPsec ivuliwe, kodwa izibali zamaphakethe zihlala zinguziro

Uvule umhubhe, isibali sikhathi sokushintsha ukhiye siyabala sihla, kodwa izinhlangothi zombili zisafunda uziro wamaphakethe. Akukho kulolo mbhangqwana wezinombolo okusho ukuthi umlingani wenqabile umhubhe wakho: i-CHILD SA efakiwe enezibali ezingasebenzi iyisimo esijwayelekile senhlangano okungekho okuhambisana nayo okwamanje. Umsebenzi uwukufakazela ukuthi iphakethe bekufanele lihambisane, bese uthola iphuzu lapho lashiya khona indlela echazwa yizikhethi. Kwenze kanye, ngokulandelana, futhi ugcine isicelo sifana phakathi kokugijima.

Isibali esinguziro sifakazela ini ngempela

I-CHILD SA iwumbhangqwana wezikhethi kanye okhiye ne-SPI ezibethela ukuxhumana okungena kulezo zindawo. Ukuyifaka kusho kuphela ukuthi abalingani bobabili bavumelana ngezindawo kanye nokhiye abatholiwe; i-kernel izoyigcina amahora amaningi ngaphandle kwefakethe elilodwa elifikayo. Ngakho umbuzo awukaze ube wukuthi umhubhe ukhona yini, kodwa ukuthi noma iliphi iphakethe elithunyelwe ukuhlolwa kwakho lawela ezindaweni abalingani bobabili abavumelana ngazo. Uma kungekho elawelayo, izibali zihlala zinguziro futhi inhlangano iphela ingasetshenziswanga ekupheleni kwempilo yayo.

Lowo mehluko ushintsha ukuthi uhlola ini kuqala. Isiphakamiso esenqatshiwe, ukwehluleka kokuqinisekisa noma i-IKE SA efa konke kuvela kulogi noma ohlwini lwe-SA, hhayi njengoziro oluthule. Umhubhe oxoxa ngokuhlanzekile bese uhlala ungenzi lutho ukhomba ukuhambisana, umzila noma umsuka wokuxhumana kokuhlolwa esikhundleni salokho.

Thumela ukugeleza ongakuchaza ngaphambi kokukuthumela

Khetha indawo ngaphakathi kwe-subnet evikelwe bese uvula uxhumano olusha oluya kuyo; ikhasi olulayishe ehoreni eledlule lingase likhishwe kusuka kunqolobane, futhi impendulo egciniwe ayikaze ithinte umhubhe. Bese ubhala amanani amane ngenkathi isicelo sisengumbono nje: ikheli lomthombo elizobopha uhlelo lokusebenza, indawo, umndeni wamakheli kanye negama noma umbhangqwana wezikhethi wengane oyibhekile. Lelo rekhodi yilona eliguqula isibali esicaba sibe isitatimende esingahlolwa.

Ikheli lomthombo yinani abantu abalidlulayo, futhi yilona eliphula ukuhlolwa kaningi kakhulu. I-laptop enekheli elinentambo, ikheli le-Wi-Fi nekheli lomhubhe ingabopha noma iliphi kulawo kuye ngokuseshwa komzila, futhi lilodwa kuphela elingaba ngaphakathi kwendawo okuvunyelwene ngayo. Sebenzisa ithuluzi elikuvumela ukubopha umthombo, njenge-ping -I 10.1.0.5 10.2.0.9 noma i-curl --interface 10.1.0.5, ukuze iphakethe lingakwazi ukukhetha ikheli elihlukile ngokuthula. Uma ukugijima okuboshiwe kuhambisa izibali kanti okungaboshiwe akukwenzi, uthole inkinga yomzila hhayi inkinga ye-IPsec.

Yiziphi izinombolo okufanele uzifunde, futhi zihlala kuphi

Ku-Linux, i-ip -s xfrm state iphrinta inhlangano ngayinye ngomugqa we-lifetime current: okungukuthi isamba samabhayithi nesamba samaphakethe kungokwayo i-SA kuphela, kulandela umugqa we-stats: wezibalo zokuphinda nokwehluleka. Kumlingani we-strongSwan, i-swanctl --list-sas iphrinta umugqa we-in nomugqa we-out ngengane ngayinye efakiwe, ngamunye uphela ngesibalo samabhayithi nesibalo samaphakethe; amathuluzi amadala e-stroke abiza lowo mbhangqwana ngokuthi bytes_i no-bytes_o. Funda izinhlangothi zombili ngokwahlukene, ngoba leyo ehlale icaba iyitholakele. Ukuzihlanganisa ndawonye kufihla impela ukungalingani okukufunayo.

Kokubili ukubuka kungokwenhlangano, ngakho ukushintsha ukhiye kufaka umbhangqwana omusha we-SPI futhi isisekelo sakho sibuyela kuziro ngaphandle kokuthi kube nokwephuka. Bhala i-SPI oyibhekile ngaphambi kokuba isibali sikhathi sokushintsha ukhiye sisebenze, ngaphandle kwalokho uzofanisa i-SA entsha nenombolo endala. Uma okuphumayo kukhuphuka ngenkathi okungenayo kuhlala kucaba, isikhethi sihambisene kodwa impendulo ayizange ibuye, okuhambisa uphenyo ekudluliseni komlingani kanye nenqubomgomo yakhe. Idokhumenti yokucushwa kwe-IKEv2 ye-strongSwan ihlanganisa umjikelezo wempilo we-SA yengane kanye nesikhathi sokushintsha ukhiye ngemuva kwalezo zinombolo.

Iphuzu lokubuka liwuhlobo oluhlukile kumsuka wephakethe. Ukwehliswa kwengxenyekazi yezinsimbi kungangeza izibali zenhlangano ngenkathi ukubanjwa kwesofthiwe kusixhumi kungabonisi lutho, ngoba amaphakethe ehlisiwe eqa ihuku okuhlezi kulo ukubanjwa, futhi okungenayo kungaphambuka ngendlela efanayo. Uma kokubili kungavumelani, sebenzisa izibali ukuphendula ukuthi kukhona okuhambiseneyo yini kanye nokubanjwa ukuphendula ukuthi iphakethe lalibukeka kanjani.

Umzila, izikhethi nendawo lapho iphakethe lazalelwa khona

Qhathanisa izinto ezintathu eceleni: umzila i-kernel ewukhethayo endaweni yakho, inqubomgomo eqondisa ukuxhumana emhubheni, kanye nombhangqwana wezikhethi owavunyelwana yingane. I-ip route get 10.2.0.9 from 10.1.0.5 isho isixhumi nomthombo i-kernel ebezowusebenzisa, okuvamisile ukuthi akulona ibhangqwana obucabange lona. I-ip xfrm policy ikhombisa amathempulethi nezikhethi ezifakwe endaweni, kanti i-swanctl --list-sas ikhombisa lokho umlingani avumelana nakho. Ukusesha okukhipha iphakethe ngokusebenzisa isixhumi somzimba akufinyeleli kunqubomgomo nhlobo, ngakho izibali azikwazi ukunyakaza.

Ukungahambisani kuza ngezindlela ezimbalwa ezibukeka zifana kusukela kusibali. Indawo ye-IPv6 engaphandle kwesikhethi se-IPv4, ikheli lomthombo elivela ku-subnet engalungile kanye nenqubomgomo encane kunengane konke kukhiqiza uziro ofanayo. Lungisa imbangela encane kuqala, ngoba ukunweba isikhethi ukuze kugudluzwe inombolo kushintsha lokho umhubhe okukuvikelayo.

Bese kuba khona umsuka wephakethe, isicupho isango elibekela umsebenzi walo uqobo. Ukuxhumana isango elikukhiqizayo ngokwalo kufaniswa nenqubomgomo yokuphuma, kanti iphakethe elilidlulisela iklayenti lifaniswa nenqubomgomo yokudlulisa, ngakho i-ping evela ebhokisini ingaphumelela emzileni okungekho klayenti olwake wahamba kuwo.

Ushintsho olulodwa olubuyisekayo kanye nombiko omelana nokubuyekezwa

Shintsha into eyodwa, phinda isicelo esifanayo bese ufunda izibali ezifanayo. Ukusula yonke imithetho yomlilo noma ukushintsha zonke izikhethi ngesikhathi esisodwa kuzohambisa inombolo futhi kucekule ubufakazi obukutshele ukuthi kungani. Uma ukugijima kwesibili kusakhombisa uziro, usususile umcabango owodwa esikhundleni sokumosha intambama.

Bhala okutholakele ngendlela omunye angakwazi ukuyiphinda: igama lengane, izindawo ezamukelwe, umthombo owubophile, indawo oyihlolile, uhlangothi olwahlala lunguziro kanye ne-SPI obuyifunda. Lowo mugqa wehlukanisa inhlangano okungekho muntu oyisebenzisile kuhlelo olukude olwathola ukuxhumana futhi lwakwenqaba. Buyisela ushintsho uma ungazange uhambise izibali, futhi gcina irekhodi; umuntu olandelayo uqala lapho wena ugcine khona. Akukho emhubheni okwadinga ukwakhiwa kabusha ngakho konke lokhu, futhi lokho kuyisizathu sokuhlola ukuhambisana ngaphambi kokuthinta ukucushwa.