Indlela i-NAT traversal ehlanganisa ngayo i-ESP ku-UDP

Amaklayenti amabili ngemuva kwerawuta efanayo akhuluma negeyithiweyi eyodwa ye-IPsec, futhi elilodwa lihlala liwa kuyilapho elinye lihlala lixhunyiwe. I-ESP yemvelo iphrothokholi ye-IP engu-50 engenamaphothi, ngakho umhumushi akanalutho angabambelela kulo ukwenza imephu uma amaklayenti amaningi abelana ikheli elilodwa. I-NAT traversal ivala leli gebe ngokuhlanganisa i-ESP ku-UDP ku-4500, futhi leso sihloko sichaza iningi lezimpawu ezilandelayo. Iphinde ikhombe idivayisi okufanele ishintshwe.

Kungani izinga ledatha lidlulela kuphothi 4500

Ngesikhathi sokusetha i-IKEv2 iqhathanisa amakheli namaphothi ohlangothi ngalunye olucabanga ukuthi luwasebenzisa, ngokushintshana ngama-hash ezazisweni zayo zokuthola i-NAT. Uma ama-hash engafani, umhumushi uhlala kwenye indawo emzileni, futhi izinhlangothi zombili zidlulisela ithrafikhi evikelwe ekuhlanganisweni kwe-UDP. Yingakho iseshini ehlangabezane nomhumushi ibukeka ihlukile kunaleya engazange ihlangabezane naye.

Ukuhlanganisa kuyisikhwama, hhayi ukuguqulwa kwephrothokholi: I-ESP igcina isihloko sayo, ukuhlolwa kobuqotho kanye nokubethela kwayo, futhi i-UDP ihlinzeka kuphela ngamaphothi adingwa umhumushi. Iphothi 500 ithwala ukushintshana kwe-IKE; i-4500 ithwala idatha ehlanganisiwe ngemva kokutholwa, futhi ngokuvamile nemiyalezo ye-IKE yakamuva. Alikho iphothi elenza ukugeleza kube ukuxhumana kwe-TCP, umcabango okhohlisa iningi labantu abafunda ukuthwebula.

Hlola izigaba ezimbili ngokulandelana

Qala ufakazele ukushintshana kokulawula, bese kuba umzila wedatha, futhi ugcine kokubili kuhlukaniswe emanothini akho. Ukuthwebula okubonisa ithrafikhi ku-500 futhi kungabonisi neze ku-4500 ngokuvamile kusho ukuthi umzila wedatha uyahlungwa, ngakho ukulungiswa kukwindlela yomlilo hhayi kuklayenti.

Qaphela womabili amaphothi nge-tcpdump -ni any 'udp port 500 or udp port 4500', futhi ufunde ithebula lokuhumusha kuserawuta ngenkathi iseshini iphila. Lelo thebula libonisa iphothi lomthombo i-geyithiweyi ezolibona ngempela, futhi ukuthwebula kukukhompyutha ephathwayo akuhambisani nakho ngokwamadizayini: ikhompyutha ikholelwa ku-500 kuyilapho i-geyithiweyi ibona i-4500 enephothi lomthombo elihunyushiwe, futhi kokubili kulungile. Ukuhamba okufanayo, ngaphambi nangemva kokuhumusha:

client 192.0.2.10:500 -> router 203.0.113.7:62000 -> gateway 198.51.100.9:4500

Izimpawu ezichazwa ukuhlanganisa, kanye nezimbili ezingazichazi

Irawuta evumela ukushintshana kokulawula futhi ivimba idatha ehlanganisiwe ikhiqiza umbiko wokuthi ithuni ikhona kodwa akukho okudlulayo. Amathebula emephu ayaphelelwa isikhathi, ngakho iseshini engasebenzi idinga ithrafikhi yokugcina iphila ethunyelwa izinhlangothi ngamabomu, futhi lawo maphakethe awakho ukuhlolwa kwempilo. Uma amaklayenti amaningi ngemuva kwe-geyithiweyi eyodwa ehluleka ndawonye, hlola ukuhumusha kwaleyo geyithiweyi nanoma yisiphi isici sakudala sokudlulisa. Ukuhlanganisa akukuchazi uhlelo lokusebenza oluhluleka kuwo wonke amaklayenti ngemva kokuba ithuni likhuphuke, noma isexwayiso sesitifiketi ekhasini lokuvimba; kokubili kungaphezulu kwalesi sigaba.

Funda ithebula lemephu lamaklayenti amabili ngesikhathi esisodwa: uma womabili ebonisa iphothi elifanayo elihunyushiwe, idivayisi ayiwahlukanisi ngendlela i-geyithiweyi eyifunayo. Imodi yokudlulisa enikeza i-ESP yemvelo kusiphathi esisodwa kuphela ayilingani nokusebenzela amaklayenti amaningi ahunyushiwe, nakuba abathengisi bechaza kokubili njengobungane ku-IPsec. I-NAT ephindwe kabili yengeza isigaba semephu kanye nelinye iphuzu lokuphelelwa isikhathi, kodwa ayinqamuli ukuxhumana okuphumayo ngokuzenzakalela.

Ithrafikhi yokugcina iphila ifanele umugqa wayo kumanyuwali wokusebenza, ngoba yiyo egcina umzila wempendulo uvulekile ezikhathini zokungenzi lutho. Yivumele lapho umthengisi eyibhala khona, futhi uyihlole kuqala uma iseshini ifa ngemva kwemizuzu yokuthula hhayi ekusetshenzisweni kokuqala.

Shintsha umnikazi wemephu, bese uphinda uhlole

Landela izilungiselelo ze-NAT traversal ezisekelwayo ezinhlangothini zombili esikhundleni sokuthi uqagele iphothi. Ukuhlela iphothi lomthombo lendawo kuklayenti elilodwa akukwazi ukushintsha isevisi elalela kwelinye iphethe, futhi ngokuvamile kwephula imephu esivele yakhiwe. Uma iklayenti lingemuva kwedivayisi ongalilawuli, ushintsho lungeyomnikazi walo.

Ngemva kwanoma yiluphi ushintsho, phinda zombili izihlolo zezigaba futhi uqinisekise ukuthi iphakethe ledatha liyadlula, hhayi nje ukuthi isikrini sesimo saba siluhlaza. Gcina ama-tuple, umphumela wethulebula lemephu kanye noshintsho lomthetho kunothi elilodwa, ukuze umuntu olandelayo angaqali kabusha kusukela ekushintsheni kokulawula. Amanothi e-strongSwan mayelana ne-NAT traversal ahlanganisa izilungiselelo zokuhlanganisa nokugcina iphila ngemuva kwezigaba zombili.