Amasango amabili e-IPsec ngaphandle kwe-IP eyabiwe: i-failover yenza ini ngempela

Cisha isango A phakathi nomhlangano bese ubuka umhubhe ubuya nge-B ngemva komzuzu; uxhumano luyasebenza, ucingo lwevidiyo kungenzeka lungasebenzi. Lona uhlobo oluthembekile lokushintsha okubandayo phakathi kwamasango amabili e-IPsec anamakheli azimele. Iklayenti liphinda likhethe iphoyinti lokugcina futhi lakhe ubudlelwano obusha, okubuyisela ukufinyeleleka ngaphandle kokudlulisa isimo sokubhala ngemfihlo sesikhathi esidlule. Ukulandela ukulandelana kwenza kucace ukuthi yiziphi izithembiso umklamo ongazigcina.

Lungisa indawo: amakheli amabili, akukho IP entantayo

Isango A liphendula ekhelini elilodwa elifinyelelekayo kanti isango B likwelinye. Iklayenti linendlela evunyelwe yokukhetha i-B lapho i-A ingekho, futhi akukho kheli langaphandle elabiwe okubanga wonke amasango womabili. Kulo mklamo, i-IP ebonakalayo isho leyo ndawo yokungena eyabiwe, hhayi ikheli langaphakathi elinikezwa iklayenti lokufinyelela kude.

Le ncazelo ibalulekile ngoba imibono emibili ixubana emathikithini, futhi ukulungiswa kwakho okukodwa akulona ukulungiswa kwakho okunye. Umbiko wokuthi indawo yokungena eyabiwe ayilandeli isango uchaza umklamo owodwa. Umbiko wokuthi ikhompyutha ephathwayo ilahlekelwe ikheli layo langaphakathi uchaza ukuqashwa kweklayenti. Abanikazi abehlukene, amalogi ahlukene, ukulungiswa okuhlukene.

Dlula ekwehlulekeni: thola, bese uphinda ukhethe

Okokuqala okuthile kubona ukuthi i-A iyeke ukuphendula. Lokho kungaba ukutholwa komlingani ofile esigabeni somhubhe, iphrothokholi yomzila ehoxisa indlela, noma isikhathi sokuphelelwa kwesicelo esiphoqa ukuxhuma kabusha ekugcineni. Ngakunye kunesilinganiso sesikhathi esihlukile, futhi okunensa kakhulu ngokuvamile kunquma ukuthi abasebenzisi balinda isikhathi esingakanani.

Bese iklayenti likhetha i-B ngayo noma iyiphi indlela esekelwa ukusetshenziswa: indawo yesibili ekude elungisiwe, igama le-DNS elixazululwe ekhelini elinempilo, noma umzila omane uthanda indlela ehlukile manje. Ukukhetha kuyisinyathelo senqubomgomo, futhi kufanele kube khona ngaphambi kwehluleka kungaphandle kwalokho kuzokwenzeka ngengozi.

Yini i-B engayizuza njengefa nokuthi yini engakwazi

I-B ingabelana nge-A ngesifanekiso sokulungisa, isiphathimandla sesitifiketi kanye nenqubomgomo yokuqinisekisa. Ayikwazi ukuzuza njengefa ukuhlangana kokuphepha okusebenzayo. Izikhiye zesikhathi, izinkomba zepharamitha yokuphepha kanye nesimo sokulandelana kungokobudlelwano obusungulwe i-A neklayenti, futhi i-B ayinakho nokukodwa kwalokho.

Ukuhambisa leso simo phakathi kwamasango kuyinkinga yangempela yobunjiniyela, yingakho idokhumenti ye-strongSwan yokutholakala okuphezulu ikuthatha njengomklamo weqembu hhayi njengefulegi yokulungisa. Iresiphi ethile yeqembu akuyona impendulo evamile yenethiwekhi yefu, futhi ukuyikopisha ngaphandle kwengqalasizinda esekelayo kuthenga ubunkimbinkimbi esikhundleni sokuqhubeka.

Ukusungula ubudlelwano obusha

Njengoba i-B ikhethiwe, iklayenti lenza ukushintshana kwe-IKE okusha: amanani amasha e-nonce, amanani amasha e-Diffie-Hellman, izihlonzi ezintsha zokuhlangana okuvelayo. Ukuqinisekisa kwenzeka futhi ku-B. Uma umklamo uncike kumininingwane yomshini, ukuxhuma kabusha kungase kube ngaphandle kweso; uma kudinga isici somuntu, othile kufanele abe khona ukuze i-failover iqede.

Chaza lokho kwaziswa komsebenzisi ngaphambi kokuphazamiseka, hhayi phakathi kwakho. Yisho ngokucacile ukuthi iklayenti lizokwenzani, lizozama isikhathi esingakanani futhi lizobonisa ini lapho linikezela, ngoba umehluko phakathi komzuzu wokuxhuma kabusha nocingo lokusekelwa ngokuvamile yidokhumenti kanye nephrofayili ehloliwe.

Ukugcina ikheli langaphakathi elifanayo kusiza izinhlelo ezilindele ubunikazi bendawo obuzinzile, futhi akugcini izikhathi zazo. Izibopho ze-NAT ziphelelwa yisikhathi, ukuxhumana kwe-TCP kusethwa kabusha, futhi noma yini enesikhathi sayo sokuphelelwa inquma ngokuzimela ukuthi izozama futhi yini.

Imihubhe emibili ngokuhambisana iwumklamo ohlukile

Ukugijima imihubhe yomibili ngasikhathi sinye kuyiphethini evumelekile lapho womabili amasango nomklamo womzila kusekela. Khona-ke ukukhetha komzila kukhetha indlela esebenzayo, futhi indlela yokubuya kufanele ivumelane, kungaphandle kwalokho ithrafikhi iphuma ngasango elilodwa futhi ibuya ngelinye ngaphandle kwesimo sokuyifanisa.

Izinqubomgomo zomhubhe ezigqagqene azakhi ngokwazo ukushintsha okuhlelekile. Zakha abaqhudelana ababili, futhi okuthile kufanele kunqume phakathi kwabo ngendlela eqinisekile, kungaba yisilinganiso somzila, ukubaluleka kwenqubomgomo noma ukuthanda okucacile kuklayenti.

Noma yiluphi uhlobo olukhethayo, bhala isivumelwano: ukuthi ukwehluleka kutholwa kanjani, ukuthi okunye kukhethwa kanjani, ukuthi kudinga ukuqinisekisa okunjani nokuthi ukuxhuma kabusha kulindeleke ukuthi kuthathe isikhathi esingakanani. I-IP eyabiwe ingenza ukutholakala kube lula, kodwa akuyona incazelo efanayo yesimo esiqhubekayo, futhi ukutholakala kuwumklamo noma kanjani.