I-overhead ye-IPsec: imodi, i-NAT-T nama-algorithm konke kuyayishintsha
Inombolo eyodwa yobukhulu obungeziwe eshicilelwe ichaza ukufakwa okukodwa endleleni eyodwa. Hlanganisa izihloko okuxoxisana ngazo umhubhe wakho ngempela, bese ulinganisa indlela.
Kwenye indawo encwadini yomhlahlandlela kunenombolo, ngokuvamile ephakathi kwamashumi ayisithupha namashumi ayisishiyagalombili amabhayithi, umuntu ayisusa ku-1500 ukuze athole i-MTU yesixhumanisi. Leyo nombolo ichaza ukufakwa okuthile endleleni ethile. Shintsha imodi, umndeni wekheli wangaphandle, ukubethela noma ukuba khona kwe-NAT, futhi izibalo azisasebenzi kumhubhe wakho.
Le nombolo yayivela komunye umhubhe
I-overhead ayisona isici se-IPsec ngendlela engaqondile. Isici sephakethe elakhiwe ngempela: imodi okuvunyelwene ngayo, isihloko sangaphandle, isihloko sokuvikela, ukugcwalisa, inkambu yobuqotho kanye mhlawumbe nesembozo esengeziwe se-UDP.
Inombolo eshiwo yemodi yokuthutha ne-IPv4 futhi ngaphandle kwe-NAT ichaza iphakethe elincane kunemodi yomhubhe ne-IPv6 ngaphansi kokunqamula kwe-NAT. Zombili zilungile esimweni sazo. Ukukopisha enye yazo kokunye ukusetshenziswa yiyo indlela abantu abagcina ngayo bene-MTU ephula ukudluliswa okukhulu. Ukwehluleka kuthule ngoba izicelo ezincane ziyaqhubeka zisebenza.
Hlanganisa izingqimba ezikhona ngempela
Qala esihlokweni se-IP sangaphandle bese ungenelela ngaphakathi. Emodini yomhubhe iphakethe lokuqala lingaphakathi, ngakho isihloko sangaphandle siyisengezo hhayi ukushintshwa. RFC 4303 ichaza isihloko se-ESP, ukugcwalisa kanye nedatha yobuqotho ekulandela.
| Layer | What it adds | When it applies |
|---|---|---|
| Outer IP header | 20 bytes for IPv4, 40 for IPv6 | Always, and 40 rather than 20 if the outer path is v6 |
| ESP header | 8 bytes of SPI and sequence number | Always |
| Block cipher IV | 8 to 16 bytes depending on the transform | When the negotiated cipher uses one |
| Padding and trailer | Padding to the block size, plus two trailer bytes | Always, and the amount varies with payload length |
| Integrity data | 12 to 16 bytes for common authenticated ciphers | When integrity protection is negotiated |
| UDP encapsulation | 8 bytes | NAT traversal on port 4500, which is common for clients behind NAT |
Awekho kuleyo migqa ahlala njalo phakathi kokusetshenziswa, futhi umugqa wokugcwalisa awuhlali njalo ngisho ngaphakathi kokusetshenziswa okukodwa. Yiso sonke isizathu sokuthi inombolo eyodwa ye-overhead eshicilelwe idumaze.
Amasayithi amabili angase angavumelani ngomhubhe ofanayo
Iphakethe elivikelwe kusamele linqamule indlela yangaphandle, futhi indlela yangaphandle ayifani yonke indawo. Isixhumanisi sokufinyelela se-PPPoE sithwala okuncane kunesigaba se-Ethernet esihlanzekile. Inethiwekhi yeselula ingase inciphe nakakhulu, futhi umhlinzeki ogxumela ithrafikhi yakhe siqu wengeza okunye ukufakwa okungashiwo muntu. Umhubhe osebenza kusixhumanisi esisodwa wehluleke kwesinye uchaza isixhumanisi sesibili, hhayi iphrothokholi.
Izindlela zombili zingase futhi zehluke. Indlela engalingani ingakunikeza ukulayisha okusebenzayo nokulanda okumile, lokho okufundwa njengenkinga yohlelo kuze kube yilapho ubheka osayizi bamaphakethe esikhundleni sokufinyeleleka. I-ping encane ephumelelayo ifakazela okuncane kakhulu mayelana nempendulo yosayizi ogcwele.
Linganisa esikhundleni sokususa
Thola idathagramu enkulu kunazo zonke ephumelela endleleni. Bese uyiqhathanisa nenani elibikwa isixhumanisi:
ip link show eth0 | grep -o 'mtu [0-9]*' ip xfrm state list ping -M do -s 1400 198.51.100.7 ping -M do -s 1372 198.51.100.7 tcpdump -ni any -c 20 'esp or udp port 4500'
Yehlisa usayizi we-ping kuze kufike izimpendulo, futhi thatha inani elikhulu elisebenzayo njengesabelomali saleyo ndlela. Umphumela we-xfrm ukutshela ukuthi iyiphi imodi namiphi ama-algorithm okuvunyelwene ngawo, futhi yikho okufakwayo kunoma yisiphi isibalo esithembekile. Ukuthwebula kuqinisekisa ukuthi kucingo kukhona i-ESP noma i-ESP esongwe ku-UDP, futhi lokho kuxazulula umbuzo we-NAT ngaphandle kokuqagela.
Bekela eceleni inani elilodwa lebhande lokulawula futhi. Amaphakethe okuxhawula we-IKE anesakhiwo esihlukile kunamaphakethe edatha, ngakho usayizi othathwe ekuthwebuleni kokuxhawula awusona i-MTU yebhande ledatha.
Beka inombolo endaweni efanele
Ku-TCP ngomhubhe, ukunciphisa i-MSS kuvame ukuba ukulawula okungangeneleli kakhulu, ngoba kunciphisa lokho okuthunyelwa iziphetho ngaphandle kokushintsha umhubhe ugobo. Emhubheni osekelwe emizileni, setha i-MTU yesixhumanisi somhubhe ngamabomu futhi ubhale ukuthi kungani. Ukwenza kokubili ngesikhathi esisodwa bese ulinganisa akukuni nolwazi lokuthi yikuphi okusizile.
Gcina ndawonye ethikithini imodi okuvunyelwene ngayo, umndeni wangaphandle, isimo se-NAT kanye nomphawu ongaphindwa. Iqoqo elirekhodiwe lamafakazi amane linqoba inguquko ekhunjulwayo, futhi iyona kuphela inguqulo yalokhu ephila ngemva kokuthuthukiswa kwesikhathi esizayo kwekliyenti.