Umthamo we-IPsec uphansi kunalokho obekulindelekile? Hlola i-SA esebenzayo kuqala
Uhlu olude lwezinguquko akulona isikhathi sokuxoxa esivikela ukudluliswa kwakho. Rekhoda i-SA okuxoxwe ngayo, usayizi womthwalo kanye nezinga elilethiwe ngempela ngaphambi kokusola ukubethela.
Ukulungiselelwa kunikela izinguquko eziyisishiyagalombili, othile ufunda eyona eqinile futhi isibalo somthamo sinanyathiselwa kuyo. Ithungelela cishe alikhethanga lolo guquko, futhi alizange lisebenzise umthwalo womsebenzi obewucatshangwa ngumuntu. Okuxoxiwe ngakho kuyinto eyodwa kulelo hlu, ngosayizi oyedwa wephakethe, ngendlela eyodwa, kukwakhiwo okukodwa. Kala lokho futhi impikiswano ngezindlela zokubala ivamise ukuphela ngaphambi kokuba iqale.
Uphawu: isibalo esingaphansi kwalokho okuthenjiswa ukulungiselelwa
Uhlu olude lwezinguquko luchaza amathuba, futhi ithuba ngalinye likalwa ephepheni hhayi kule hardwe. Umphumela okuxoxwe ngawo uyinhlanganisela eyodwa eyamukelwa yizinhlangothi zombili, futhi kungase kube yona ebuthakathaka kunazo zonke evunyelwa yinoma yiluphi uhlangothi ngenxa yokuhambisana. Lokho okufinyelelwa yile nhlanganisela kuncike esimweni se-offload, usayizi wephakethe kanye nokuziphatha komugqa, ngakho amadivayisi amabili anefayela lomgomo elifanayo angagcina esehluke kakhulu. Uhlu luyimenyu; ukuhlangana kuyi-oda ebuyile.
Ukufunda uhlu kukutshela ukuthi yini obekungakhethwa. Ukufunda ukuhlangana kukutshela ukuthi yini ephethe ukudluliswa ngempela, futhi yilokho kuphela okuchazwa yisibalo somthamo. Isinyathelo ngasinye sokulungisa esiqala ohlwini siwukucabanga okunezincwadi ezengeziwe.
Rekhoda ukuhlangana okuphethe lokhu kudluliswa
Ku-ASA show crypto ipsec sa kubala ukuhlangana okusebenzayo kanye nezinguguqo zazo nezibali zendlela ngayinye, futhi ireferensi yemiyalo yakwa-Cisco ibhala lokho okukhiphayo. Khetha i-peer nendlela ebalulekile, futhi qaphela ukuthi ukuxoxa kabusha ngokhiye kushintsha ukuhlangana futhi kusetha kabusha izibali zaso, okwenza buthule kungavumeleki isisekelo obewusathemba. Gcina okukhiphayo eduze kwamanothi okuhlola ukuze umzuliswano olandelayo ube nokuthile okuqhathaniswayo. Isihlonzi sokuhlangana esishintshayo phakathi kwemizuliswano senza noma yikuphi ukuqhathanisa kwakamuva kungabi namsindo.
| What to record | Where to read it | What it rules out |
|---|---|---|
| Negotiated transform and SA identifiers | show crypto ipsec sa for that peer and direction | "the configuration picked the wrong algorithm" |
| Offload or accelerator state for that build | platform show commands and interface statistics | "the crypto engine is the ceiling" |
| Payload size and offered rate | the test tool's own settings and summary | "packets per second versus bytes per second" |
| Delivered rate and loss at the receiver | the receiving endpoint, not the sender's counters | "the sender transmitted, so it arrived" |
| Access-link load and drops | underlay interface counters along the path | "the bottleneck lives inside the tunnel" |
Imigqa emihlanu yanele ukwenza isilinganiso siphindwe, futhi umugqa ngamunye ususa incazelo ethile uma ungekho. Akukho noyedwa okuyingxenye yohlu lweziphakamiso, ngoba uhlu alukwazi ukusho ukuthi yini evikela amabhayithi akho okwamanje. Gcwalisa ithebula kanye futhi isigameko esilandelayo sizoqala ngedatha hhayi ngempikiswano entsha ngezindlela zokubala.
Umugqa wesixhumanisi sokungena uwona abantu abawushiyayo, futhi yiwona ovame ukuchaza igebe elibonakala lingelokubethela. Isisekelo esigcwele noma i-policer endleleni kukhiqiza uhlobo olufanayo lophawu njengenjini enensayo.
Kala indlela eyodwa ngomthwalo olawulwayo
Sebenzisa isivivinyo kusuka endaweni yokugcina ye-LAN emele uhlelo lokusebenza hhayi kusuka kuwevu ngokwayo, ngoba uphenyo olwenziwe yiwevu lungalandela umgomo wendawo ohlukile. Kala indlela eyodwa ngaphambi kokwengeza umfudlana wesibili, futhi rekhoda kokubili izinga elinikeziwe nokuthile okwamukelwa ngumamukeli ngempela. Ukugijima kwe-UDP okulinganiselwe ngezinga kuhlukanisa umthwalo onikeziwe kusuka ekuphenduleni kwe-TCP kokuminyana, kanti umthumeli we-UDP ongenamkhawulo akulona ukuxilonga okungathathi hlangothi. Rekhoda nobude bomthwalo, ngoba idathagramu enkudlwana ishintsha kokubili izinga lamaphakethe nezindleko zokufaka.
show crypto ipsec sa peer 203.0.113.9
iperf3 -c 10.20.0.10 -u -b 200M -l 1200 -t 30Sebenzisa isivivinyo esifanayo kabili ngobude obufanayo bomthwalo nesikhathi esifanayo, ngoba ukugijima okukodwa akukwazi ukuhlukanisa uphahla lusuka kumzuzu omubi. Uma umamukeli ebika amaphakethe ambalwa kunalawo athunyelwe umthumeli, ukulahleka kuwukutholakala kwakho, futhi injini yokubethela ingenye yezinto ezimbalwa ezingaba yimbangela.
Chaza igebe ngaphambi kokulungisa noma yini
Hlola umgomo wokudlulisela, ukwehla komugqa, amaphutha esixhumanisi kanye nemikhawulo yezinsiza kanye nomzila wokubethela, ngoba ukushoda kwezinga kukodwa akukaze kuhlonze i-CPU. Gcina futhi izendlalelo zokubalwa zicacile: amabhayithi ethungelela langaphandle ahlanganisa ukufaka, futhi ukuthunyelwa kabusha kususa ubudlelwano phakathi kwezibali zangaphakathi nangaphandle. Ukuqhathanisa izibali ezingahlobene ngabhayithi ngabhayithi kudala umehluko ongakaze ube khona.
Usayizi wephakethe ufanelwe ukuqhathanisa okulawulwayo kwakho, hhayi isibalo esikopishwe esibonelweni esidala. I-TCP MSS ilungisa i-TCP futhi ayinawo umthelela kumadathagramu e-UDP angenamkhawulo, ngakho inani elingaguquki lika-1350 elithathwe kudokhumenti elidala alikali lutho nhlobo. Shintsha ubude bomthwalo ngamabomu futhi ubheke ukuthi umamukeli ubika ini.
Shintsha into eyodwa futhi gcina umthwalo womsebenzi
Lapho isisekelo siphinda ngaphakathi kwebhande elincane, shintsha into eyodwa esekelwayo futhi gijimise umsebenzi wokuqala wohlelo lokusebenza. Leso sinyathelo yisona esiguqula isibalo sibe imbangela, futhi yisona kuphela esifanelekela ukuthinta ukulungiselelwa. Phinda umthwalo ofanayo womsebenzi hhayi othambile.
Ungahoxisi iziphakamiso, ungehlisi ukuqinisekiswa futhi ungacimi ukuvikelwa ukuze wenze isibalo sokwenziwa sibe sikhulu. Lezo zinyathelo zishintsha isimo sokuphepha bese zikala umphumela walolo shintsho, hhayi umthamo wethungelela.