Kungani umhubhe we-IPsec ogcwele ugcina ushintsha okhiye ngaphambi kwesikhathi: imikhawulo yesikhathi neyevolumu

Cishe njalo ngemizuzu engamashumi amahlanu, umhubhe osemgudwini ogcwele uyawa imizuzwana embalwa, futhi umsolwa wokuqala iwashi. Izinhlangano zingaphela ngomkhawulo wesikhathi noma ngokubalwa kwamabhayithi, futhi iyiphi imingcele efika kuqala iyona eyenza zithathe umhlalaphansi. Emgudwini othwala ithrafikhi yangempela, umkhawulo wevolumu ungase usebenze kudala ngaphambi kokuphela kwehora elilungisiwe. Ngakho-ke «kusenesikhathi kakhulu» isitatimende mayelana newashi, hhayi mayelana nenhlangano.

Bala lokho inhlangano ekubalayo, hhayi i-interface

Isamba samabhayithi e-interface, umthamo ohlangene wedashibhodi nesibali senhlangano uqobo kuyizinombolo ezintathu ezihlukene, futhi eyodwa yazo kuphela eqhathaniswa nomkhawulo. Rekhoda inhlangano engenayo nephumayo ngokwahlukene kanye nezihlonzi zayo, ukuze ukushintshwa kokhiye okuthinta uhlangothi olulodwa kubonakale njengesigameko esiqondile esikhundleni semfihlakalo. Isibali senhlangano naso siqala kabusha lapho kushintshwa ukhiye, yingakho isamba esithathwe ku-interface sikhula kuyilapho inani elibalulekile lisethwa kabusha.

Kufanelekile ukwenza izibalo kanye ukuze ukuhleleka kobukhulu kuyeke ukuzwakala kungahleliwe. Isabelomali esibalwe se-gibibyte eyodwa esetshenziswa ngejubane elingaguquki lama-128 mebibyte ngomzuzu siphela emizuzwini eyisishiyagalombili, futhi lokho ukuguqulwa kwamayunithi, hhayi ukukala umhubhe wakho. Uma inombolo ephumayo ilele ngaphansi kakhulu komkhawulo wesikhathi, ivolumu iyona ndlela, futhi akukho ukubheka iwashi okuzochaza isikhala. Uma ilele phezulu kakhulu, umkhawulo wamabhayithi awusona isiqhumo sakho futhi ukusesha kungokwenye indawo.

Umkhawulo othambile noqinile yizigameko ezimbili ezihlukene

Umkhawulo othambile ucela ukubuyisela kudala ngaphambi kokuba umkhawulo oqinile uqede inhlangano, futhi ukusetshenziswa kunezela imikhawulo yayo nokungahleliwe phezu kwalokho okulungisile. Yingakho isikhala esibhekiwe cishe asikaze sibe inombolo eyindilinga. isakhiwo se-IPsec ichaza impilo evezwa ngesikhathi nangokubalwa kwamabhayithi nemikhawulo emibili, futhi ukuphelelwa kwangaphambi kwayo yikona okusebenzayo. Uma uthatha impilo eyodwa eshicilelwe njengohlelo, uzophutha ngobukhulu bomkhawulo.

Funda inqubomgomo esebenzayo kusuka esimweni esisebenzayo esikhundleni sokuyiqagela kusuka enombolweni esefayelini, ngoba umkhawulo ungowokusetshenziswa, hhayi owomqondo wakho. Mela isilingo sokwelula imikhawulo iye kobukhulu bayo ukuze uthulise uphawu: umhubhe oshintsha okhiye ngokohlelo uziphatha njengoba wakhelwe, futhi impilo ende ihlehlisa isigameko kuphela ngesikhathi igcina ukhiye osonjiwe usetshenziseka isikhathi eside. Lapho ukubuyisela uqobo kwehluleka, umkhawulo uyisithunywa hhayi iphutha.

Funda impilo esebenzayo kusuka esimweni esisebenzayo

Ku-strongSwan, swanctl --list-sas iphrinta isifinyezo senhlangano kanye nezikhathi zokushintshwa kokhiye nempilo, ngakho inani i-daemon ehlose ukulisebenzisa liyabonakala ngaphandle kokuqagela. Kumphathi we-Linux ongenakho ukubuka kwe-daemon, ip xfrm state ibika imikhawulo yamabhayithi namaphakethe ethambile neqinile elungisiwe eceleni kwezibali zamanje. Lokho kufunda okubili kuphendula imibuzo ehlukene futhi kokubili kufanele kugcinwe kwithikithi.

swanctl --list-sas
ip -s xfrm state

Qhathanisa umkhawulo othambile ophrintiwe nesikhala osikale, ngoba ukubuyisela okuqala ngomkhawulo ongaphansi komkhawulo oqinile kuvamile futhi lokho okungakaze kuqale akunjalo. Uma i-daemon ibonisa impilo eyodwa futhi isimo se-kernel sibonisa enye, ubheka izingqimba ezimbili ezingavumelani, futhi lokho ngokwako wukutholakala.

Bheka ukushintshana okubuyisela i-SA

Gcina izibuyekezo ezintathu zihlukene, ngoba zehluleka ngezindlela ezihlukene: ukushintshwa kokhiye kwe-IKE SA kwakha inhlangano entsha yokulawula, ukushintshwa kokhiye kwe-CHILD SA kubuyisela inhlangano yedatha, futhi ukuqinisekisa kabusha kuphinda ukushintshana kobuwena. Ku-IKEv2 iqembu ngalinye linquma impilo yalo ngokwalo esikhundleni sokuxoxisana ngenani elilodwa elabiwe, ngakho ukushintshana ongakakuqali kuvamile. Ukungafani kwe-perfect forward secrecy kuyisizathu esivamile sokuthi i-child SA entsha ife ngqo esikhaleni sokushintshwa kokhiye, futhi kubonakala njengokwehluleka kwesikhathi kuze kube umuntu ufunda isiphakamiso.

Qhathanisa inhlangano endala nomlandeli wayo kanye nokushintshana okwayiveza. Ukunyamalala kwesihlonzi ukubuyisela okuvamile; isiphakamiso esenqatshiwe, impendulo engekho noma ukungabikho kwesimo somlandeli esisebenzisekayo kusigameko esihlukene esinomnikazi ohlukile. Gcina lobo bufakazi ngaphambi kokushintsha noma yini, ngoba amanothi akhethekile wenguqulo, isiphakamiso sozakwethu kanye nempilo ekhulunywe ngayo yikona okwenza icala lifundeke ngemuva kweviki elilodwa, ngemuva kokujikeleza kwamalogi.

Fakazela ukuvuselelwa esikhundleni sokukufihla

Yamukela ukuthunyelwa ngokudlula kubuyekezo obuluhlele hhayi lokho okwenzeka kuwe. Phoqelela ukushintshwa kokhiye okukodwa ngaphakathi kwewindi lokunakekela, bese uqinisekisa ukuthi izinhlangothi zombili zithwala idatha ngemuva kwalokho nokuthi umphumela wohlelo awukashintshi, hhayi nje ukuthi isikhombisi somhubhe siluhlaza. Rekhoda ukuthi wuphi umkhawulo osebenzile nokuthi yikuphi ukushintshana okuhilelekile.

Isiphetho saleso simo sihlala ekuhlolweni, kuyilapho inani lesikhathi elishintshiwe elenza ukuxhumana kubonakale kuthule isikhathi sasemini lingahlali. Uma kuhambile isikhathi kuphela, ubufakazi bahamba nayo.