IPsec ngaphakathi kwe-IPsec: yimaphi amakheli umhubhe wangaphandle okufanele awathwale

I-IPsec ene-nested kulula ukuyicabanga lapho izigaba ezimbili ziphela emishinini ehlukene. Amasango amane, imihubhe emibili kanye nombuzo owodwa onquma ukuthi umklamo uyasebenza yini: yini umhubhe wangaphandle ewubonayo ngempela lapho owangaphakathi usuqedile ngephakethe? Phendula lokho futhi izikhethi, imizila kanye nokulandelana kokuxazulula izinkinga kuyalandela. Uma wenza iphutha uzochitha usuku ulungisa umhubhe osebenza ngokobuchwepheshe.

Imodeli yamasango amane

Amasango angaphandle A no-B akha umhubhe wokuqala phakathi kwezindawo ezimbili. Ngemuva kuka-A kukhona isango langaphakathi C elinekhasi lokudlula 10.60.0.2; ngemuva kuka-B kukhona isango langaphakathi D elinekhasi lokudlula 10.70.0.2. Amanethiwekhi ohlelo lokusebenza ahlala ngemuva kuka-C no-D, futhi yonke ikheli esibonelweni ngamabomu alihlangani.

application net -> C -> A == outer IPsec == B -> D -> application net
                       \---------- inner IPsec ----------/

C transit: 10.60.0.2      D transit: 10.70.0.2
A and B:    underlay addresses only

Ukuhlukanisa izigaba kumahost amane kusho ukuthi umshini ngamunye uphoqa umngcele owodwa. Ihost eyodwa eqhuba zombili izigaba kufanele ihlanganise amaqoqo amabili omgomo, amathebula amabili omzila kanye nezimo ezimbili zokwehluleka kumsihini owodwa, okungenzeka futhi kunzima kakhulu ukukuqaphela.

Isigaba ngasinye sisusa isivikelo saso kuphela

I-C ibethela iphakethe lohlelo lokusebenza le-D. Umphumela ukhonjiswa kusuka ku-C kuya ku-D, futhi yilokho okufinyelela ku-A. Konke okulandelayo kuncike kulokho kubhala kabusha.

I-A iyibethela futhi i-B. I-B ikhipha isigaba sangaphandle, ibona iphakethe elisuka ku-C liya ku-D futhi ilidlulisela lisebethelwe. I-D isusa isivikelo sangaphakathi futhi iletha iphakethe lohlelo lokusebenza.

Ngakho u-A no-B babona iziphetho zangaphakathi kanye nemethadatha yazo, kepha abonawo amaqembu akhipha umthwalo wohlelo lokusebenza. Leyo yimpawu yangempela yomklamo, hhayi isimangalo sokuthi u-C, u-D noma amahost ohlelo lokusebenza athembekile.

Izikhethi zangaphandle zisho amasango angaphakathi

Yilapho iningi lalezi zakhiwo lihluleka khona. Emhubheni wangaphandle osekelwe kumgomo, izikhethi ozixoxayo kufanele zibe namakheli u-A no-B abhekana nawo ngempela: 10.60.0.2/32 kanye 10.70.0.2/32, ngokulandelana okuqondile kwasekhaya nokwakude.

Ukubeka ama-subnet wohlelo lokusebenza okugcina ezikhethini zangaphandle akusebenzi, ngoba lapho iphakethe lifinyelela ku-A, ukugoqa kwangaphakathi sekugbhalile kabusha lokho u-A okufanele akuvikele. Khona-ke umgomo wangaphandle awuzukuhambisana nalutho, futhi umhubhe uzophakama ngaphandle kokuthwala idatha.

Unganciphisi imvume yangaphandle ibe yi-UDP 500. Ukuxhumana kwangaphakathi kunendlela yako yedatha, esebenzisa i-ESP noma ukugoqa kwe-UDP kuye ngokuthi kuxoxwe ngani, futhi umgomo wangaphandle kufanele uvumele leyo protocol.

Hlola umphumela nge- swanctl --list-sas kusango ngalinye futhi qinisekisa ukuthi izinhlangano zokuphepha zezingane zibika amakheli obekuhloswe wona, hhayi lawo obewucabanga. Uma uhlu lubonisa ama-subnet ohlelo lokusebenza, umgomo wangaphandle wabhalelwa isigaba esingalungile. Lungisa izikhethi ngaphambi kokulungisa umzila, ngoba umzila uzobonakala ulungile kepha izibali ngeke zinyakaze.

Ukudluliswa kanye nogibe lokuphinda

Izikhethi azithathi indawo yomzila. U-A no-B kufanele badlulise ithrafikhi phakathi kuka-C no-D kuzo zombili izinhlangothi, okusho ukuthi ukudluliswa kwe-IP kuvuliwe, imizila ekhomba emhubheni kanye nendlela yokubuya ekhona ngakolunye uhlangothi.

Uma umhubhe wangaphandle usebenzisa ama-interface e-XFRM, imizila ikhetha i-interface ngenkathi imigomo okuxoxwe ngayo isabeka umkhawulo kulokho ekuthwalayo. I-interface ayikhulisi okukhaviwe; ishintsha kuphela indlela ikernel ethatha ngayo iphakethe.

Ugibe ukuphinda. Umzila ka-A oya endaweni yokugcina yangaphandle ka-B kufanele ulandele inethiwekhi engaphansi, hhayi umhubhe u-A awakhayo, ngaphandle kwalokho ukugoqa kuzama ukuhamba ngaphakathi kukho futhi ukuxhumana akukaze kuqede.

Hlola ukuhumusha ngaphambi kokwengeza izigaba

Bheka noma iyiphi i-NAT yomthombo ku-A naku-B ngaphambi kokulungisa enye into. Umthetho obhala kabusha ikheli lika-C ngaphambi kokuthi umgomo we-IPsec usebenze ungaphula izikhethi okuvunyelwene ngazo, futhi ungashintsha nalokho u-D akutholayo ngakolunye uhlangothi.

Ukufihla okubanzi akuphephe kakhudlwana ngenxa yokuthi kunezigaba ezimbili. Kufihla ukuthi yiliphi ikheli elibonwa uhlangothi olukude, futhi yilokho kanye ulwazi olukudingayo lapho umhubhe uvuliwe kepha uhlelo lokusebenza lungasebenzi.

Uma umthetho we-NAT udingeka ngempela, bhala ukuthi uhlangothi ngalunye lucabanga ukuthi lukhuluma naliphi ikheli. Lowo mugqa owodwa uxazulula iningi lezingxabano zokuthi ingabe umhubhe noma ukuhumusha okuyisono. Futhi utshela unjiniyela olandelayo ukuthi abheke kuphi lapho umthetho usususwa ngemva konyaka. I-ping ngeke yenze lokho.

Fakazela i-fail-closed futhi uhlole i-MTU

Ukunyamalala komzila ngokwako akusiwona umgomo we-fail-closed. Elinye ithebula, umzila ozenzakalelayo noma umthetho womgomo kungase kunikeze indlela yokubuyisela buthule, futhi indlela eyodwa yokwazi ukuthi yini ukwehlisa umhubhe wangaphandle futhi ubheke ukuthi ithrafikhi yohlelo lokusebenza yenzani. Kwenze ngamabomu, efasiteleni lokulungisa, esikhundleni sokukuthola ngephutha.

Hlola izimo ezintathu: umhubhe wangaphandle phansi, umhubhe wangaphakathi phansi, kanye nokululama ngemva kokuba kokubili kubuyile. Sebenzisa izibali zomgomo kusango ngalinye, ngoba amaseshini amabili e-IKE asunguliwe afakazela kuphela ukuthi ukuxoxisana kwendiza yokulawula kuphumelele.

Beka isabelomali kukho kokubili ukugoqa. I-IKE esebenzayo iwumphumela wamaphakethe amancane, futhi amaphakethe ohlelo lokusebenza anosayizi ogcwele asengasehluleke uma kunezihloko ezimbili ezengeziwe; hlola ngosayizi womthwalo owaziwayo emzileni wangempela esikhundleni sokucabanga ukuthi izinombolo ziyahlangana. Izibalo zilula, umzila awulona.