Iphutha 789 le-L2TP/IPsec ku-Windows: yakha iphrofayela futhi uqinise isiphakamiso

Iphutha 789 kuxhumano lwe-L2TP ku-Windows lisho ukuthi ithumbu lafa ngaphakathi kokushintshisana kokuphepha kwe-IPsec, lokho kwenzeka kude ngaphambi kokuba i-Windows ithumele iphasiwedi yomsebenzisi noma kuphi. Ukuzama iphasiwedi futhi, noma ukuyisetha kabusha kudayirekhithri, akukwazi ukuqhubekisela phambili leso sigaba. Okusihambisela phambili ukwakha kabusha uxhumano kusuka ku-PowerShell ngesiphakamiso i-gateway eyisinikezayo ngempela, ngoba isihlakaniphi saseZilungiselelo sikhetha izinguquko ze-IPsec buthule futhi asikubonisi nakancane ukuthi sikhethe ini. Lona umhlahlandlela walokho: yakha iphrofayela, qinise isiphakamiso, bese usebenzisa ithebula lezigaba ukuze ikhodi elandelayo ikutshele okuthile.

Yakha iphrofayela ngaphandle kwesihlakaniphi

Add-VpnConnection ibhala ingeno yendabuko yencwadi yocingo, ngakho umphumela uyinto efanayo ezo hlelwa yi-app yeZilungiselelo kamuva. Yisebenzise kusuka kuseshini ephakanyisiwe lapho uxhumano kufanele lube khona kuyo yonke i-akhawunti emshinini, noma kusuka kumongo womsebenzisi lapho kufanele lihlale liyimfihlo:

Add-VpnConnection -Name "Contoso L2TP" `
  -ServerAddress 203.0.113.10 `
  -TunnelType L2tp `
  -EncryptionLevel Required `
  -AuthenticationMethod MSChapv2 `
  -RememberCredential -Force

Fanisa -AuthenticationMethod nalokho okunikezwa i-gateway. I-MSChapv2, i-EAP ne-PAP azishintsheki, futhi iphrofayela efuna indlela okungeke kuyamukele iseva yehluleka ngaphambi kokuba kubhekwe noma yimuphi umbhalo womsebenzisi. Gcina -EncryptionLevel Required kunoma yini yangempela; i-Optional ivumela i-Windows ukuthi yamukele ithumbu elingabhalisiwe uma uhlangothi lwesinye lunikeza elilodwa, okuyisifinyezo saselabhu hhayi isilungiselelo sokuthunyelwa.

Uma udlulisa i--L2tpPsk, leyo khiye eyabiwe ngaphambili ibhalwa kuphrofayela kudiski, lapho noma ubani ongayifunda iphrofayela kuleyo mshini angayithola khona. Sebenzisa isitifiketi ekufakazeni uhlangothi lwesinye lapho i-gateway ikusekela, futhi lapho i-PSK ingenakugwenywa, yigcine ngaphandle kwesitoreji nangaphandle komlando we-shell esikhundleni sokuyinamathisela kukho konke ukusebenza kokuhlinzeka.

Qinise isiphakamiso esikhundleni sokwamukela amanani okuhlala

I-Windows izigcwalisa ngokwayo izinguquko ze-IPsec, yingakho imishini emibili enokuxhumana okubonakala kufana ingehluleka ngendlela ehlukile ku-gateway efanayo. I-Set-VpnConnectionIPsecConfiguration iyindlela esekwayo yokuziqinisa:

Set-VpnConnectionIPsecConfiguration -ConnectionName "Contoso L2TP" `
  -AuthenticationTransformConstants SHA256128 `
  -CipherTransformConstants AES128 `
  -EncryptionMethod AES128 `
  -IntegrityCheckMethod SHA256 `
  -DHGroup Group14 `
  -PfsGroup None `
  -PassThru -Force

Lelo qoqo liwukuhlelwa okujwayelekile kwe-L2TP/IPsec, akuyona impendulo yonke. Ipharamitha ngayinye yamukela uhlu olungaguquki lwamanani, futhi inhlanganisela ipulatifomu engakwazi ukuyihlela ibuyela njengephutha le-cmdlet esikhundleni sephrofayela encishisiwe buthule. Thatha iphutha elinjalo njengesitatimende ngamanani, hhayi ngezimvume zakho.

Kopisha isiphakamiso kusuka kumadokhumenti e-gateway noma kuzilungiselelo zayo eziphilayo zesigaba 1 nesigaba 2, futhi shintsha inkambu eyodwa ngesikhathi kuphela ngenkathi i-gateway ibhala izinguquko eziyiziyo ezizenzayo. Ukudabula amakambu amahlanu kukhiqiza uxhumano olusebenza ngesikhathi esisodwa nerekhodi elingachazi lutho kumuntu olandelayo.

Funda ukwehluleka ngesigaba, hhayi ngombhalo wephutha

I-789 ingeyase mkhakha wamakhodi wonke abonakala efana kudayalogi yeklayenti. Beka ikhodi phambi kwesigaba ekiyingxenye yaso ngaphambi kokuthi uphinde uthinte iphrofayela:

Lapha kuhlanganiswe imisebenzi emibili yezifakazelo. Ukhiye owabiwe ngaphambili noma isitifiketi kuqinisekisa izinhlangothi komunye nomunye, kuyilapho i-MSChapv2 noma i-EAP ikufakazela wena ngaphakathi kwethumbu. Ukusetha kabusha iphasiwedi yomsebenzisi akukwazi ukulungisa eyokuqala, imfihlo entsha eyabiwe ayikwazi ukulungisa eyesibili, futhi ukushintsha kokubili ngasikhathi sinye kubhubhisa ubufakazi bokuthi yikuphi okwakungalungile.

Endleleni yesitifiketi, hlola iwashi leklayenti, uchungechunge lokuthembela kanye nobuwena i-gateway elindele lokho ngaphambi kokucabanga ukukhonjulula ukuqinisekisa. Ukucisha ukuqinisekisa kuguqula i-789 ebonakalayo ibe yithumbu elixhumayo ngenkathi lithemba uhlangothi olungalungile, futhi akukho lutho kuklayenti oluzokutshela ukuthi lokho kwenzekile. uhlu lwamaphutha okufinyelela kude lwe-Microsoft luyisihluthulelo samakhodi ngokwawo, futhi luhlukanisa ukwehluleka kwengqimba yokuphepha ekwehlulekeni kokungena.

Qinisekisa kuzinhlangothi zombili ngaphambi kokuthi uthi kulungisiwe

Funda iphrofayela emuva, kodwa ungakulindeli isiphakamiso kokuphumayo. I-Get-VpnConnection ibika igama, ikheli leseva, uhlobo lwethumbu, izinga lokubhalisa kanye nendlela yokuqinisekisa, futhi ayazi lutho ngezinguquko, ngakho ukufunda kuqinisekisa ukuthi ingeno ikhona futhi ikhomba kumsingathi ofanele:

Get-VpnConnection -Name "Contoso L2TP" |
  Select-Object Name, ServerAddress, TunnelType, EncryptionLevel, AuthenticationMethod

Shaya kusuka emgqeni womyalo ukuze uthole inombolo esikhundleni sedayalogi: i-rasdial "Contoso L2TP" ibuyisela ikhodi yokwehluleka efanayo obekuzoyibuyisela isixhumi, futhi i-rasdial "Contoso L2TP" /disconnect iyisula phakathi kwemizamo. Bese ufunda uhlangothi lwe-gateway kulowo mzamo. I-ipsec statusall ye-strongSwan noma irekhodi le-IKE lomzila isho ukuthi isiphi isiphakamiso esifike futhi esiphi esenqatshiwe, futhi ukusiqhathanisa namanani e-cmdlet yisona kuphela isinyathelo esifakazela ngempela ukuthi izinhlangothi zombili zavumelana.

Uxhumano oluyimpumelelo aluwona umugqa wokugcina. Vula uhlelo lokusebenza umsebenzisi akhathazekile ngalo, ngoba imizila, i-DNS eqhutshwayo kanye nezilungiselelo zethumbu elihlukanisiwe kuyahluleka ngemva kokuba ithumbu likhuphile futhi akukhiqizi neze idayalogi yephutha.

Yenza ngokuzenzakalela, futhi uhlehle emuva ngokuhlanzekile

Ukuhlelwa okungagadiwe yikho okuyisizathu sokubhala iskripthi salokhu, futhi isigaba sokushaya yilapho izifakazelo zivuza khona. I-rasdial izithatha emgqenini wayo womyalo, lapho abanye abasebenzisi basendaweni kanye nabaqoqi abaningi bamarekhodi bengazifunda khona:

subprocess.run(["rasdial", "Contoso L2TP"], check=True)

Khetha isifakazelo esilinganiselwe ku-akhawunti eqhuba umsebenzi, noma vumela iphrofayela ukuthi isigcine nge--RememberCredential, esikhundleni sokudlulisa iphasiwedi njengengxabano emsebenzini ohleliwe. Imiyalo yokuhlinzeka ngokwayo iphephile ukuyiphinda nge--Force, kodwa izomboza ngokujabula isiphakamiso esidala, ngakho ukuphinda kusize kuphela uma iskripthi sithwala amanani amanje.

Amaphrofayela ahlala ezindaweni zokuqala kabusha futhi aphila isikhathi eside kunokuhlelwa kwe-gateway abakhelwe kona. Lapho isiphakamiso se-gateway sihamba, susa ingeno futhi uyidale kabusha esikhundleni sokunqwabelanisa iqoqo lesibili lamanani phezu kwayo: i-Remove-VpnConnection -Name "Contoso L2TP" -Force, bese uphinda ama-cmdlet amabili ngeqoqo elisha.

Vala umjikelezo ngezihlolo ezine ezihlala eduze kweskripthi: i-Get-VpnConnection ikhombisa uhlobo lwethumbu nolwezinga lokubhalisa okulindelekile; i-gateway ibhala isigaba 1 nesigaba 2 esiqediwe sekheli leklayenti lakho; i-rasdial ibuyisela impumelelo futhi uhlelo luyavuleka; futhi isiphakamiso esirekhodwe kuskripthi sihambisana nesilungiselelo samanje se-gateway. Lapho ifika i-789 elandelayo, lokho kuqhathanisa kuthatha imizuzu esikhundleni sentambama yonke.