IPsec phakathi kwamahost amabili: lapho ukuvikelwa kuqala futhi kuphela khona
Ipheya lamahost ingavikela ukuhamba okukhethiwe ngaphandle kwesango. Chaza iziphetho, inqubomgomo ekhetha ithrafikhi kanye nezimvume ezihlala zehlukene.
Ukuvikelwa kupheya lamahost kuqala lapho inhlangano yezokuphepha iphela khona, futhi lokho yiqiniso umqondo obunjwe amasango ovame ukukushiya. Iseva yohlelo lokusebenza kanye neseva yayo yesizindalwazi zingavikela ingxoxo yazo ngqo, ngaphandle kwanoma yisiphi isihlanganisi sokufinyelela kude endleleni, futhi umngcele wokuvikelwa ube usungaphakathi kwihost ngayinye esikhundleni sokuba kuvikelo lomlilo. Lokho okukunikezayo ukumboza kusukela ekupheleni kuya ekupheleni kokuhamba okukhethiwe. Lokho okungakunikezi isinqumo sokuthi ubani angafunda umugqa upi.
Umngcele yilapho i-SA iphela khona
I-RFC 4301 ichaza izinhlangano zezokuphepha kumodi yezokuthutha njengokuhlelwa okuvame ukusetshenziswa phakathi kwepheya lamahost ukuze kuvikelwe kusukela ekupheleni kuya ekupheleni. Lawa mahost amabili aphethe okhiye, futhi ngalinye linquma ukuthi yimaphi amaphakethe alo angena enhlanganweni. Ithubhu lesango liphela kwenye indawo ngokuphelele futhi lifinyelela kuhost ngokusebenzisa ingxenye yangaphakathi eyengeziwe, okuwumncele wokuthembela ohlukile ngisho nalapho iphakethe livaliwe ingxenye enkulu yohambo lwalo.
Ihost-kuya-host kanye nemodi yezokuthutha akusiwona amagama afanayo. Amahost amabili angakha ngokulingana inhlangano emodini yethubhu phakathi kwawo, ngakho khetha kuqala imodi bese uchaza iziphetho. Bhala kokubili encwadini yokuklama eduze kwamakheli ozakwethu, ngoba umhloli owazi imodi kuphela uzocabanga enye.
I-SPD inquma ukuvikelwa, umzila unquma isiqondiso
Ithebula lokuhlela umzila liphendula ukuthi iphakethe liyaphi. Isizindalwazi senqubomgomo yezokuphepha siphendula ukuthi ithrafikhi ekhethiwe iwela kanjani umngcele wokuvikelwa, futhi sikwenza lokho ngakho kokubili isiqondiso ngabakhethi baso. Lokho kwehlukanisa yisizathu sokuthi umzila osebenzayo oya esizindalwazini awufakazi lutho mayelana nokuthi isicelo besivikelwe, futhi kuyisizathu sokuthi ingxoxo esunguliwe ayifakazi lutho mayelana nokuthi lolu hlelo oluthile luhambisana nayo. Qhathanisa abakhethi ngaphambi kokuthi uqhathanise izibali, ngoba izibali zichaza kuphela ukuhamba okufinyelele kangako.
Ku-Linux, i-ip xfrm policy iphrinta leyo mibhalo ngokuhambisana nesiqondiso, ukubaluleka, umkhethi kanye nesenzo sokuvumela, ukuvimba noma ukuziba, kuyilapho i-ip xfrm state ibonisa izinhlangano eziphumayo kanye nezibali zazo. Ukufunda kokubili ndawonye yindlela yokuthola ukuhamba okwedlule ithubhu buthule ngoba umbhalo ovumelayo obanzi wafanisa kuqala.
Ukuhlelwa kokubaluleka kuyingxenye yenqubomgomo, hhayi imininingwane yokusebenza. Umbhalo omncane okufanele uvikele imbobo yesizindalwazi wehlulwa umbhalo obanzi onokubaluleka okuphezulu, futhi ukwehluleka kubonakala sengathi inqubomgomo ayikaze ibuzwe.
Imodi yezokuthutha ihlanganisa isigaba esilandelayo, hhayi isihloko se-IP
| Transport mode | Tunnel mode | |
|---|---|---|
| Original IP header | kept for routing the flow | replaced by an outer header |
| What ESP protects | the carried next-layer payload | the whole inner IP packet |
| Where it terminates | commonly the two hosts | gateway pair, or a host pair |
Kumodi yezokuthutha isihloko se-ESP siphakathi kwesihloko se-IP nomthwalo, futhi izinkambu zamakheli zaleso sihloko zihlala zibonakala kuyo yonke idivayisi esendleleni. Lokho kulungile lapho amakheli kuwona umfihlo futhi umthwalo uwumfihlo. Lokho kuyisinqumo esingalungile uma futhi udinga ukufihla isakhiwo sangaphakathi, ngoba imodi yethubhu kuphela egoqa isihloko sokuqala ngaphakathi kwesisha.
Womabili amamodi angathwala izinhlobo eziningi zezivumelwano zesigaba esilandelayo, futhi i-ESP izovikela lokho okufaniswa umkhethi hhayi konke okuthunyelwa ihost.
Ukukhetha kuncane kunokuxhumana
Inhlangano eyodwa ingathwala ukuhamba okuningi, kodwa kuphela lokho okukhethwa inqubomgomo. Rekhoda ubunikazi bozakwethu, amakheli omsuka nendawo okubhekiswa kuyo, iphrothokholi kanye nobubanzi besevisi bobudlelwano ohlosile, bese unquma ngokwahlukana ukuthi ithrafikhi engafanisi ingahamba obala, kufanele ivikelwe, noma kufanele ilahlwe lapho inhlangano ingekho. Yisona leso sinqumo sokugcina esiletha izimanga, ngoba umthetho odinga ukuvikelwa komsuka ongalungile ungavimba ukufinyelela kwakho kokuphatha ngempumelelo efanayo nokuvimba kwakho umgidekazi.
Gcina umzila ongephandle webhendi ogunyaziwe ngenkathi ushintsha ukuphoqelela, futhi uwuhlole ngaphambi kokuba uwudinga esikhundleni sokuthi ngemva kokuba womabili amahost engasafinyeleleki.
Ubunikazi bomshini akusona imvume yohlelo
I-IPsec iqinisekisa uzakwethu olungiselelwe futhi ivikela amaphakethe akhethiwe. Ayinqumi ukuthi iyiphi irekhodi yesizindalwazi umuntu angayihlela, futhi ayiguquli ubunikazi besiphaka obuthenjwayo bube ukunikezwa kwawo wonke amalungelo ohlelo. Ama-akhawunti, izindima kanye nokugunyazwa kohlelo kuhlala khona lapho kwakukhona, futhi imfuneko ye-TLS ezingeni lohlelo igcina inhloso yayo ngisho nalapho umzila wenethiwekhi usuvikelwe.
Yamukela ukuklama ngokusebenza okukodwa okuvela kumsuka ohlosiwe nokunye okufanele kwenqatshwe, futhi ufake nokuthi kwenzekani lapho inhlangano edingekayo ingakhiwa. Ukuhlolwa kokufinyeleleka okuvamile kukutshela ukuthi amaphakethe ayahamba; akukutsheli ukuthi ahamba ngaphansi kwenqubomgomo oyibhalile.