Izinketho zethrafikhi ye-IPsec: zihlanganisa ini futhi azihlanganisi ini

Izinketho zethrafikhi ziqamba ithrafikhi yangaphakathi evikelwa isivumelwano se-IPsec, futhi ipheya lixoxiswana ngalo hhayi ukucatshangwa. Iziphetho ezimbili zingaqinisekisa ukuthi zifana ngokuphelele futhi zingavumelani ngokuthi yimaphi amaphakethe angaphakathi komhubhe. Ukungavumelani lokho akubonakali esimweni sokuxhumana, okuvame ukubika umhubhe onempilo. Ukufunda izinketho kuzo zombili iziphetho bese ulandela indawo eyodwa kukuthola ngokushesha kunanoma yikuphi ukuhlela inqubomgomo.

Zifunde kuzo zombili iziphetho

Isiphetho ngasinye sichaza uhlangothi lwaso njengolwasekhaya nolunye uhlangothi njengolukude. Ngakho iqoqo leziqalo elifanayo livela lishintshiwe kukho kokubili ukuhlelwa, futhi lokho kulungile, akukona ukuphikisana. Ukuhlanekezela umbono kuyinto yokuqala okufanele yenziwe lapho isivumelwano esisebenzayo sibonakala singalungile ephepheni. Ukuqhathanisa amafayela amabili eceleni ngaphandle kokuwashintsha kudala ukungafani okungekho.

Amanani awahlali eyi-subnet eyodwa. Izinketho ze-IKEv2 zingathwala amabanga amakheli, izinombolo zeprotocol namabanga amachweba, futhi yilokho inqubomgomo evikela ngakho insizakalo eyodwa esikhundleni senethiwekhi yonke. Isikhethi esincane kunethrafikhi ehlosiwe sidala umhubhe othwala ezinye izindawo futhi ushiye ezinye ngaphandle buthule.

Bhala izinhlangothi zombili etafuleni elilodwa ngaphambi kokushintsha noma yini. Lo msebenzi uvame ukuxazulula umbuzo ngaphandle kokuthinta ifayela lokuhlelwa.

Ukunciphisa kuyisinqumo somphenduli

Umsunguli uphakamisa, futhi umphenduli angamukela kuphela iqoqo elincane. I-IKEv2 ivumela umphenduli ukuthi anciphise izinketho zethrafikhi ezinikeziwe, futhi umphumela oncishiwe yiwo ofakwa ngempela. Ngakho ukufunda ukuhlelwa komsunguli kuchaza isiphakamiso, hhayi isivumelwano.

Yingakho i-subnet eyengezwe kuklayenti ingadala umhubhe osebenzayo kodwa onqaba indawo entsha. Iseva yanciphisa isiphakamiso yaze yafinyelela lokho inqubomgomo yayo ikuvumelayo, kuyilapho ifayela leklayenti lisabala ibanga elibanzi. Isimo esixoxiwe kuphela sikhombisa iqiniso: ku-Linux, ip xfrm policy kanye nohlu lwe-child SA ku-dokhumenti ye-IKEv2 ye-strongSwan babika okufakiwe hhayi okuceliwe. Lapho kokubili kungavumelani, inqubomgomo yomphenduli yiyo okufanele ishintshwe.

Isiphakamiso esenqatshiwe siyisibonakaliso esihlukile kwesincishiwe. Ukwenqatshwa kuvela kugayidi wezingxoxo futhi akushiyi noma yikuphi ukuxhumana kwe-child.

Landela indawo eyodwa kusukela ekuqaleni kuze kube sekupheleni

Khetha indawo yangempela kanye nekheli lomthombo iklayenti elizolisebenzisela yona, bese uhlisa lelo pheya ezinqumweni ezintathu ezizimele. Umzila ukhetha indlela, isikhethi sinquma ukuthi leyondlela ivikelwe yini, futhi umdwebo womlilo unquma ukuthi iphakethe livunyelwe yini. Ngakunye kungahluleka ngokwakho, futhi isikhethi esibanzi asilungisi noma yisiphi esinye.

ip route get 10.20.30.41
ip xfrm policy list
swanctl --list-sas

Umbuzo womzila ubiza isixhumanisi nekheli lomthombo okuzothwala iphakethe. Uhlu lwenqubomgomo lukhombisa ukuthi ngabe ikhona inqubomgomo yomhubhe ehambisanayo yalelo pheya, kuhlanganise nendlela yayo nezinga layo. Uhlu lwe-SA lukhombisa izinketho ze-child ezixoxiwe kanye nezibali, ngakho ukuxhumana kwe-child okunamaphakethe angewona nhlobo ngemva kokuzama ithrafikhi kuwuphawu lwezinketho ezikhipha lokho okuthunyelwayo. Imiyalo emithathu, izimpendulo ezintathu ezihlukile, futhi eyodwa kuphela yazo echaza ukuwa buthule.

Uma izibali ze-child zinyakaza kuyilapho uhlelo lusahluleka, inkinga ingaphesheya komhubhe. Lokho kuhambisa uphenyo kumlaleli noma kumdwebo womlilo womsingathi okude hhayi ezinkethweni.

Gcina imigomo emibili ihlukene

Ukuvikela i-subnet yasehhovisi nokuthumela konke ukuphequlula ngomphumela okude kuyizimfuno ezihlukile ezinezinketho ezihlukile. Iphrofayela eyakhelwe okukodwa ayivamisile ukufanela okunye, futhi ukuzixuba kudala ukuvuza noma ukwehlukanisa okuphukile. Ukwandisa ibanga elivikelwe kusho ukushintsha iziphetho zombili kanye nenqubomgomo yazo yokudlulisa, ngoba ushintsho lwangakolunye ludala isiphakamiso esenqatshiwe. Le yindlela evame kakhulu yokuthi umhubhe obusebenza uyeke ukusebenza ngemva kokuhlelwa okuncane.

Izinketho zichaza ukumboza kwe-cryptographic, imizila ikhetha izindlela, futhi izinhlelo zisebenzisa izimvume zazo. Umhubhe ohlanganisa konke awukwazi ukufinyelela insizakalo eboshelwe ku-loopback, futhi umzila ongena emhubheni usadinga isikhethi esihlanganisa indawo. Hlola zontathu ngesicelo sokuhlola esisodwa, futhi ukungafani kuzozibiza ngokwakho.