NO_PROPOSAL_CHOSEN ku-L2TP? Hlola igethiweyi kuqala

Iklayenti le-L2TP/IPsec elihluleka ngaphambi kombuzo wegama lomsebenzisi alikaze livumelane ngesigaba 1. Hlola isethi yeziphakamiso zegethiweyi esikhundleni sokunamathisela izintambo zokubethela.

Umbuzo wegama lomsebenzisi awuveleki neze, futhi iklayenti libika i-NO_PROPOSAL_CHOSEN. Ngaleso sikhathi izifakazelo kanye nokhiye owabiwe ngaphambili akubalulekile, ngoba izinhlangothi zombili azivumelananga ngendlela yokuvikela isigaba 1. Iningi labantu liphendula ngokunamathisela intambo yokubethela abayithole ku-inthanethi. Ukuhlola igethiweyi kuphendula umbuzo ofanayo ngobufakazi futhi kuthatha isikhathi esilinganayo.

Okushiywa yilo mlayezo

Ukwenqatshwa kwenzeka kumodi eyinhloko, ngaphambi kwanoma yikuphi ukushintshana kwe-L2TP noma kwe-PPP, ngakho ithuneli kanye nesizindalwazi somsebenzisi akuzange kubuzwe. Isigaba 1 sixoxa ngokubethela, ubuqotho kanye neqembu le-Diffie-Hellman. Isigaba 2 sixoxa ngesiphakamiso se-ESP sedatha. Ukwehluleka kwesigaba 1 akukwazi ukulungiswa ngokushintsha isilungiselelo se-PFS sesigaba 2, futhi ukuxhumana kwe-IKE okuqediwe akufakazi ukuthi isiphakamiso se-ESP siyafaneleka.

Rekhoda i-backend ngaphambi kokuhlela i-syntax: ipsec --version. I-libreswan ne-strongSwan zamukela izipelingi ezahlukene zesiphakamiso kuma-algorithm afanayo.

Bese ufunda ukwenqatshwa kumongo nge-journalctl --no-hostname _COMM=nm-l2tp-service _COMM=ipsec _COMM=pluto _COMM=charon _COMM=kl2tpd _COMM=xl2tpd _COMM=pppd.

Hlola igethiweyi ngesethi yaso yezinguquko

Isihloli sibuza igethiweyi ngqo ukuthi izoxoxa ngaziphi izinguquko. Qala ngokumisa insizakalo ye-IPsec yasendaweni ukuze uphenyo lungaqhudelani neklayenti lakho, bese ufunda imigqa ye-SA. Thatha uhlu njengobufakazi ngohlangothi olulodwa, hhayi njengemenyu okufanele kuvulwe konke.

sudo ipsec stop
sudo ike-scan --trans=3des-sha1-modp1024 10.10.10.250 | grep SA=

Amadivayisi amadala avame ukunikeza i-3DES, i-SHA1 ne-MODP1024, ngoba lawo ayeyizinto ezingokwenziwa ngesikhathi umkhiqizo uthunyelwa futhi akekho owayebuyekeza. Gcina okukhiphayo okungahluziwe kokuhlola, ngoba iwukuphela kwerekhodi yalokho ohlangothi olulodwa olwanikeza ngakho ngalolo suku. Uma lokho kuwukuhlangana okunamandla okutholakalayo, ukukhushulwa okulungile kuya kumnikazi wegethiweyi, hhayi ekucushweni kweklayenti okuvula kabusha ukubethela okubuthakathaka kubo bonke.

Qondanisa ukuhlangana ngaphandle kokucisha ukuphepha

Faka kuphela izinguquko ezivela kukho kokubili ukuhlola kanye nenqubomgomo yakho. Isibonelo esingezansi sibonisa igethiweyi enikeza i-3DES, i-SHA1 ne-MODP1024 esigabeni 1. Qaphela isexwayiso se-backend: i-libreswan 4.x ayihlanganisi iqembu le-modp1024, ngakho lokhu kusebenza ku-strongSwan noma ekwakhiweni kwe-libreswan okusekela i-DH2. Qinisekisa inguqulo ngaphambi kokuphetha ngokuthi iklayenti liphukile.

Phase 1: 3des-sha1-modp1024
Phase 2: aes256-sha1,aes128-sha1,3des-sha1

Uphawu lwesibabazo ekugcineni lubopha isiphakamiso esisodwa. Kusebenzise ukwehlukanisa ukuhlolwa, bese ukususa ukuze igethiweyi ikwazi ukuxoxa ngokunamandla kamuva.

Hlola i-daemon kanye nebhokisi ngaphambi kokuzama futhi

I-NetworkManager-l2tp iqala isenzakalo sayo se-xl2tpd. Uma insizakalo yesistimu isivele iphethe i-UDP 1701, iklayenti libuyela embotsheni yomthombo yesikhashana, okuvunyelwa yi-RFC 3193 futhi amanye amaseva ayilahla buthule. Hlola umnikazi wesokhethi ngaphambi komzamo olandelayo.

sudo ss -unlp | grep 1701
sudo systemctl stop xl2tpd.service
sudo systemctl disable xl2tpd.service

Izimfihlo ezidalwe endala zingenye imbangela ethule. Amafayela angaphansi kwe-/etc/ipsec.d/ aqanjwe ngoxhumano oludala angaphila isikhathi eside kunephrofayili ewadalile, ngakho susa lawo okungekho okubhekisela kuwo bese uzama futhi.

Ekugcineni, hlola ukuthi iseluleko savela kuphi. I-ipsec.conf ebhalelwe i-IKEv1 XAuth ichaza uhlobo oluhlukile lwe-VPN, futhi isiphakamiso sayo akulona kuphela umugqa ozoba nephutha kuphrofayili ye-L2TP. Rekhoda isethi yezinguquko oyifakile eduze kwephrofayili, ukuze umuntu olandelayo angenzi uphenyo futhi.

Izihloko ezihlobene