L2TP, GRE noma IPsec: iyiphi ingqimba okufanele ithwale iseshini?
I-L2TP ithwala amaseshini e-PPP, i-GRE ithwala amaphakethe ahlelisiwe, i-IPsec ivikela ithrafikhi ekhethiwe. Nika ingqimba ngayinye umsebenzi owodwa, bese uqinisekisa ngayinye ngokwahlukana.
Imibuzo emibili iyahlangana njalo lapho L2TP, GRE kanye ne-IPsec kuhlangana khona encwadini yokuklama eyodwa: iyiphi iseshini engiyithwalayo, futhi iyiphi ingqimba eyivikelayo? Uma eyokuqala inephutha, konke okungezansi kuhlala kuhambisana ngaphakathi kodwa kuxazulula inkinga engalungile — isembozo esihlelisiwe esakhiwe lapho abasebenzisi babedinga khona ukungena, noma isikhungo sokungena esime esikhundleni sesango lesayithi-kuya-sayithi. Iphepha lokusebenza elingezansi liphoqa lo mehluko ngaphambi kokuthi noma ubani angene kudivayisi. Yigcwalise ngokulandelana futhi umugqa ngamunye uba yinto ongayihlola wedwa.
Qala ngeseshini, hhayi ngohlu lwamaphrothokholi
Umsebenzisi okude ophethe iseshini ye-PPP kanye nesembozo esihlelisiwe phakathi kwamasango amabili kuyizihlobo ezimbili zezokuxhumana ezihlukene, ngisho noma zombili zigcina zisongelwe ku-IPsec. Eyokuqala iphetha isixhumanisi somsebenzisi ngamunye futhi idinga ukwabiwa kwamakheli, ukuqinisekiswa komuntu noma kwedivayisi, kanye nenqubomgomo ebiza ukuthi iyiphi inethiwekhi yangaphakathi umsebenzisi angayifinyelela. Eyesibili idlulisa amaphakethe phakathi kwezindawo okungekho muntu ongena kuzo.
Bhala umusho owodwa obiza ukuthi iyiphi kulezi ezimbili oyakhayo, bese uwufunda kabusha sengathi nguwe umuntu okufanele awusebenzise. Uma umusho udinga igama elithi «futhi», wakha zombili, futhi iphepha lokusebenza lidinga amakholomu amabili esikhundleni sekholomu eyodwa yokuyekelela esebenzela ngayinye ingxenye. Uma ubiza umsebenzisi kodwa kungekho iqoqo lamakheli, noma isiqalo kodwa kungekho nqubomgomo yokudlulisa, umusho awukapheleli. Amazinga azwakala njengawasehhovisi, kodwa lena indawo eshibhile kakhulu yokubamba umklamo obungatholakala ngethikithi lesikhungo sosizo.
Nika ingqimba ngayinye umsebenzi owodwa ngqo
I-L2TPv2 ithwala amaseshini e-PPP phakathi kwamaphoyinti ayo amabili okugcina. I-PPP ihambisa izingxoxo zesixhumanisi futhi, uma zivunyelwene, ukuqinisekiswa komsebenzisi; I-L2TP ayifaki noma yikuphi ukubethela, ngakho-ke i-L2TP daemon engenalutho ayifezi noma iyiphi ingxenye yobudlelwano bokuphepha be-IPsec futhi ihlala kuphela esixhumanisini osithembayo kakade.
I-GRE iwukusonga phakathi kwamakheli amabili. Ithwala amaphakethe engqimba yenethiwekhi idlula isembozo esinengqondo futhi, iyodwa, ayinikezi imfihlo noma ubunikazi bomshela obuqinisekisiwe. Lokho akulona iphutha: isihloko saklanywa saba lula ukuze sihlale sishibha ekucutshungulweni kuzinsiza zokudlulisa. Umphumela uwukuthi i-GRE iphendula umbuzo wokuthi ingashintshwa kanjani leli phakethe phakathi kwamakheli amabili futhi akukho okunye, futhi lowo umbuzo okufanele uwubuze kuyo.
Kusala i-IPsec njengengqimba ekhetha ithrafikhi, eqinisekisa oshela futhi ebethela lokho eyatshelwa ukuthi ikuvikele. Iyiphi ithrafikhi eyivikelayo isinqumo sokumiswa okufanele kuhambisane nokusonga okukhiqizwa ngamaphoyinti okugcina ngempela, ngoba inqubomgomo ebhalelwe ikheli langaphandle le-GRE iziphatha ngendlela ehlukile kunaleyo ebhalelwe iziqalo zangaphakathi. Incazelo ye-GRE igcina umthwalo, isihloko se-GRE kanye nephrothokholi yokuletha yangaphandle kuhlukene ngokusobala, futhi inqubomgomo yakho idinga ukwahlukaniswa okufanayo.
| Layer | Its one job | What it never does |
|---|---|---|
| PPP | Link negotiation, optional user authentication, address assignment | Protect traffic between gateways |
| L2TPv2 | Carry the PPP session between two endpoints | Encrypt or authenticate peers |
| GRE | Encapsulate network-layer packets between two addresses | Hide or authenticate the payload |
| IPsec | Authenticate peers and encrypt selected traffic | Carry a dial-in user session by itself |
Bhala indlela yephakethe ngaphambi kokumiswa
Thatha iphakethe elilodwa bese ubala sonke isihloko esengezwayo ngokulandelana esengezwa ngakho, futhi usho idivayisi esengezayo. Kumsebenzisi ongenayo lokhu ngokuvamile yi-PPP ngaphakathi kwe-L2TP ngaphakathi kwe-IPsec; esembozweni sesayithi yi-PPP yephakethe le-IP langaphakathi ngaphakathi kwe-GRE ngaphakathi kwe-IPsec. Uma amadivayisi amabili engeza isihloko esifanayo, unomjikelezo noma umhubhe ophindwe kabili, futhi akukho kuhlela kwenqubomgomo okuzokulungisa lokho.
Uhlu olufanayo lunquma i-MTU, ngoba usayizi wangaphakathi osebenzisekayo yi-MTU yendlela elinganisiwe kususwa izihloko osanda kuzibala futhi akukho okunye. Ungakopishi inombolo embhalweni wenkundla: hlanganisa izindleko ze-IP, UDP kanye ne-ESP zangaphandle, bese kuba i-GRE noma i-L2TP, bese kuba i-PPP lapho kufanele khona, futhi ususe ku-MTU yendlela oyilinganise ngempela. Izimpawu ezivela kuphela ekudlulisweni okukhulu, noma amaseshini asungulayo bese efa empendulweni enkulu yokuqala, ngokuvamile zihlehlela ekutheni lokho kwengezwa kwenziwa ngokuqagela.
Hlola ingqimba ngayinye ngokwahlukana, ngaphandle kungena ngaphakathi
Gijimisa izinto zokuhlola ngokulandelana futhi ume kokokuqala okwehlulwayo. Umugqa ngamunye uphendula umbuzo ohlukile, ngakho-ke ukwehluleka kukhomba ikholomu eyodwa yephepha lokusebenza esikhundleni sokutshela ukuthi umhubhe uphukile.
ip xfrm state # is the IPsec SA up?
ip -s link show gre1 # does the overlay interface carry packets?
ip route get 10.20.0.5 # does the inner prefix route where you think?
ss -lun | grep -E "1701|4500" # are the L2TP and NAT-T listeners bound?Kubhokisi le-Cisco okulingana nakho kuncike endimeni, futhi isakhiwo somusho esiqondile sincike kupulatifomu nokukhishwa: show crypto session koshela be-IPsec, izibali zesixhumanisi sesixhumanisi se-GRE noma somhubhe, kanye nokuqinisekiswa kwe-VPDN noma kwe-PPP endimeni yokungena. Isethi yemiyalo ephetha i-PPP ayifakazeli lutho ngokusekelwa kwe-GRE, futhi isixhumanisi se-GRE esisebenzayo asifakazeli lutho ngensizakalo ye-PPP, ngakho-ke qinisekisa indima oyimise ngempela hhayi leyo esemfanekisweni.
Rekhoda umphumela ngamunye eceleni komugqa wephepha lokusebenza awukho. Amanothi athathwe ngesikhathi iphutha lisebenza abaluleke kakhulu kunombono wendawo odwetshwe kabusha kamuva ngokukhumbula.
Hlela ukulandelana kokuhlakaza, bese uqinisekisa futhi
Ukuhlakaza kuhamba ngokulandelana okuphambene ngesizathu: khipha ithrafikhi evikelwe kunqubomgomo ye-IPsec ngaphambi kokususa ukusonga eyayibhalelwe kona, kungenjalo inqubomgomo iqhubeka ikhomba isixhumanisi esingasekho futhi ukulayishwa kokumiswa okulandelayo kwehluleka endaweni ebonakala ingenazihlobo. Ku-Linux lokho kusho ukususa amarekhodi esimo nenqubomgomo ngaphambi kwesixhumanisi somhubhe; kusiphathi, ukususa imephu ye-crypto noma irekhodi lephrofayela ngaphambi komhubhe.
Ngemva kokwakha kabusha, phinda ukubona okune kokwamukela ngakunye: ukufinyeleleka kwangaphandle, inhlangano ye-IPsec esunguliwe, iseshini ye-PPP esunguliwe lapho umklamo uhlanganisa eyodwa, kanye nokudluliswa kwangaphakathi okwamukela ikheli lendawo lokwamukela langempela. Ukukhanya okulodwa okuluhlaza akubona ubufakazi kwezinye ezintathu, futhi leso sikhala yisona sehlulekile esihlala isikhathi eside kakhulu ekukhiqizeni — umhubhe ophakeme, obethelwe, futhi ongadlulisi lutho ngoba indlela yangaphakathi ayikaze yengezwe.
Gcina iphepha lokusebenza eligcwalisiwe eceleni kokumiswa kwedivayisi. Noma iyiphi ikholomu ongakwazi ukuyigcwalisa iyingqimba engenawo umsebenzi owabelwe, futhi ingqimba engenawo umsebenzi ngokuvamile iyingqimba okungekufanele ibe khona esitakini.