IPsec ESP: okuthwelayo nendlela yokufakazela ukuthi kuyageleza
I-ESP isonga iphakethe le-IP langaphakathi kumodi yomhubhe futhi ihlonze ukuhlangana kwayo nge-SPI. Funda isimo, bese ubuka ukuthi ukugeleza okukodwa kuwashintsha kanjani izibali.
I-ESP ithwala ithrafikhi ku-VPN ye-IPsec, futhi i-runbook yayo iqala ngomthetho owodwa: funda ukuhlangana kokuphepha ngaphambi kokushintsha inqubomgomo. Iningi lokuziphatha kwe-ESP okungachazwanga libuyela kusikhethi esingafananga, imodi eyacatshangwa esikhundleni sokufundwa, noma isibali okungekho owasihlolayo ngesikhathi kuthunyelwa ukugeleza okukodwa. Izinyathelo ezintathu ngezansi zisungula ukuthi yini ithwala ini, zifakazela ukuthi ukugeleza okukodwa kuyisebenzisa, futhi zishiya ukuhlehliswa okungathembeli enkumbulweni. Isinyathelo ngasinye siletha umbono owodwa okufanele ubhalwe phansi.
Yazi izinkambu ngaphambi kokuzifunda
I-ESP ibeka isihloko phambi kwedatha evikelwe kanye nomshwele ngemuva kwayo. Isihloko sithwala inkomba yepharamitha yokuphepha ehlonza ukuhlangana okufanele kusetshenziswe umamukeli, inombolo yokulandelana yokuthola ukuphindwa, futhi emshweleni kukhona ukugcwalisa okugcina umthwalo uhambisana nomsombandlela wokubhala ngomfihlo. Inkambu yesihloko esilandelayo emshweleni isho ukuthi okuqukethwe okuvikelwe kuyini, futhi ngale ndlela umamukeli uyazi ukuthi ukhiphe ini kuphakethe.
Imodi ishintsha ukuthi yini engaphakathi kwalokho kuvikelwa. Kumodi yomhubhe into evikelwe iphakethe le-IP eliphelele langaphakathi, futhi isihloko esisha sangaphandle siyithwala phakathi kweziphethu. Kumodi yokuthutha ukuvikelwa kusonga umthwalo wesendlalelo esiphezulu sephakethe elikhona, ngakho asikho isihloko sesibili se-IP okufanele sivulwe. Iyiphi imodi esetshenziswayo iyiqiniso lokucushwa, hhayi indaba yokuhumusha. Yifunde kusihloko sesimo esikhundleni sokucabanga esuka kumdwebo.
Awekho kulezi zimo zombili afihla ikheli langaphandle okufanele lilethe iphakethe. Lokho kuyisici somklamo hhayi ukuntuleka, futhi yingakho umqaphi ophakathi esengabona ukuthi yimaphi amakheli amabili akhulumayo ngisho noma umthwalo ungabonakali.
Isinyathelo sokuqala: funda isimo, bese kuba inqubomgomo
Izihloko zesimo zigcina okhiye nezibali; izihloko zenqubomgomo zigcina izikhethi ezinquma ukuthi ngubani ovunyelwe ukuzisebenzisa. Ku-Linux kokubili kubonakala ngaphandle kokubamba iphakethe, futhi ukuzifunda ngalolo hlelo kugcina imibuzo emibili ihlukene.
ip xfrm state
ip xfrm policyKokuphuma kwesimo, hlola umthombo nendawo yokuhlangana, imodi, nokuthi ukusonga kukhombisa amachweba e-UDP yini. Lawo machweba asho ukuthi kusetshenziswa ukunqamula i-NAT, lokho kushintsha ukuthi isivikelo somlilo esiphakathi kufanele sivumele ini, kodwa hhayi ukuthi iziphi izikhethi noma okhiye abasebenza eziphethweni.
Bese ufunda izikhethi zenqubomgomo. Isikhethi esisho isiqalo esincane kunethrafikhi oyihlolayo yisona sizathu esivamile sokuthi umhubhe osebenzayo ubonakale unganaki ukugeleza, futhi isikhethi sephrothokholi engalungile siletha ukuthula okufanayo.
| Field | Where it appears | What it decides |
|---|---|---|
| Security parameter index | ESP header, and the receiving state entry | Which association and keys the receiver applies |
| Sequence number | ESP header | Replay detection for that association |
| Next header | ESP trailer | What the decapsulated payload contains |
| Inner IP header | Inside tunnel-mode payload only | The original source and destination the endpoints act on |
| Traffic selectors | Policy, not the packet | Which local traffic is allowed to use the association |
Amathuluzi omkhiqizi anyathelisa ulwazi olufanayo ngendlela elula.ipsec statusall ku-strongSwan kubala ukuhlangana kwengane, izikhethi zayo nezibali zayo zamabhayithi, okungavamile ngokushesha kunokufunda umphumela we-xfrm oyisisekelo uma sewazi ukuthi iyiphi ingane okufanele uyibheke.
Isinyathelo sesibili: fakazela ukuthi ukugeleza okukodwa kushintsha izibali
Izibali ziba nencazelo kuphela uma wazi ukuthi yini obekufanele kuzishintshe, ngakho khetha umthombo nendawo okugcina isikhethi sikusika ngokuqinisekile bese uthumela isicelo esisodwa esingenabungozi. Bese uphinda ufunde isihloko esifanayo futhi uqhathanise.
ip -s xfrm state
tcpdump -ni any espUkufunda okubili kukhuluma izindaba ezihlukene. Amaphakethe akhula ohlangothini oluphumayo kodwa angakhuli nakanye ohlangothini olungenawo akhombisa inkinga yokudlulisa noma yendlela yokubuya hhayi inkinga yokhiye, ngoba iphakethe lasongwa futhi lahamba. Uma kungekho sibali esishintshayo, ithrafikhi ayizange ihambisane nenqubomgomo, futhi isikhethi siyindawo okufanele ubheke kuyo.
Ukubamba esinyathelweni esifanayo kuqinisekisa ukusongwa kucingo, kuhlanganise nokuthi amaphakethe angaphandle yi-ESP noma i-ESP esongwe ku-UDP. Kubuye kukubonise amakheli ayithwale ngempela ukugeleza, futhi lawo kwesinye isikhathi ahluka kulawo akukucushwa obukufunda.
Isinyathelo sesithathu: shintsha into eyodwa futhi ugcine ukuhlehliswa
Bhala phansi umthombo, indawo, imodi, izikhethi nezibali zokuhlangana ngaphambi kokuhlela noma yini. Uma ushintsho lwenza izinto zibe zimbi kakhulu, lowo mbhalo yiwona okukuvumela ukuthi ubuyisele isimo sangaphambilini esikhundleni sokwakha kabusha ukucushwa okusebenzayo kusukela ekuqageleni. Lowo mbhalo uthatha umzuzu ukubhalwa futhi ulondoloza ihora kamuva. Futhi uwukuphela kwento ehlala ngemuva komuntu owenze ushintsho.
Shintsha isikhethi esisodwa noma ipharamitha eyodwa, silayishe kabusha, bese uphinda isinyathelo sesibili kukho ukugeleza okufanayo. Ukususa ukuhlangana kuphihliza konke ukugeleza okukusebenzayo, ngakho ukuhlela okuhlosiwe nokulayisha kabusha kwengane ngokuvamile kungcono kunokukhipha isimo ukuze ubone ukuthi kuzokwenzekani.
Ukuhlehlisa kokuhlelwa kwesikhethi ukuvuselela inqubomgomo yangaphambilini nokuyilayisha kabusha, ngombandela wokuthi uzakwabo angase adinge ushintsho oluhambisanayo uma isikhethi sixoxwa hhayi ukuba sendaweni. Bhala phansi lokho kuncika ngesikhathi kusasha, ngoba izithandani ezibuyiselwe ngengxenye kunzima ukucabanga ngazo kunanoma yisiphi sezimo ezimbili zokugcina.
Ekugcineni, gcina ububanzi buthembekile. Ukuhlangana kwe-ESP okugelezayo kufakazela ukuthi amasango amabili avikela futhi aletha isigaba, futhi akusho lutho mayelana nokuthi uhlelo olungaphezulu luqinisekisa abasebenzisi bakhona noma lusho ukufihla lokho olukugcinayo. Lezo ziyizilawuli ezihlukene ezinobufakazi obuhlukene, futhi i-runbook iphelela kuphela uma umuntu olandelayo ekwazi ukuyiphinda kusukela kumanothi.