L2TP NO_PROPOSAL_CHOSEN: yisiphi isigaba esihlulekile ngempela?
Isaziso sithi isiphakamiso sanqatshwa, hhayi ukuthi sikuphi. Funda ilogi ye-backend ukuze uthole isigaba, bese uqhathanisa amasethi nalowo ophethe isango.
I-NO_PROPOSAL_CHOSEN ifika ngaphambi kokuba noma yiliphi igama lomsebenzisi le-PPP lihlolwe, okuyiqiniso eliwusizo futhi okuyisizathu sokuthi umyalezo udukise. Ibika ukuthi uhlangothi olulodwa lwenqabe isiphakamiso; ayibiki ukuthi yiphi ipharamitha engavumelananga, futhi ayisho lutho mayelana nokuthi ukwenqaba kwenzeka ngesikhathi kwakhiwa ukuhlobana kwe-IKE noma kamuva ngesikhathi kuxoxwa ngokuvikelwa kwethrafikhi. Ngemuva kwalawa mathuba amabili kukhona izilungiso ezimbili ezihlukene, futhi kunye kuphela kuzo elihlobene nebhokisi lokuhlola le-PFS abantu abaya kulo kuqala.
Umyalezo owodwa, amasethi amabili eziphakamiso
Uhlobo lwe-IKEv1 L2TP/IPsec lunokuxoxisana okubili okulandelana. Isigaba 1 sakha ukuhlobana kokuphepha kwe-IKE kusuka ku-algorithm yokubhala ngemfihlo, i-algorithm yobuqotho kanye neqembu le-Diffie-Hellman. Isigaba 2 bese sixoxa ngokuthi ithrafikhi izovikelwa kanjani, futhi imfuneko ye-PFS ingeyengxoxo yesibili leyo.
| Phase | What is agreed | What a rejection here means |
|---|---|---|
| Phase 1 | Encryption, integrity, DH group for the IKE SA | No management tunnel exists, so nothing later can run |
| Phase 2 | ESP transforms plus the PFS group policy | The IKE SA negotiates, then child negotiation fails |
Njengoba izigaba zilandelana, indawo yokwehluleka ikutshela ukuthi yiluphi uhlu okufanele uluqhathanise. Lapho kukho lonke inani lokuxilonga lomyalezo, futhi kufanelekile ukulikhipha ngaphambi kokuthinta noma yisiphi isilungiselelo.
Kungani ibhokisi le-PFS lingakwazi ukulungisa isigaba 1
Ukucisha i-PFS kushintsha isici sesigaba 2. Uma izinhlangothi zingakaze zavumelane ngesigaba 1, ingxoxo ye-ESP ayenzeki nhlobo, ngakho ibhokisi alinawo umthelela ekwenqabeni, futhi yingakho ukulishintsha kuletha iphutha elifanayo ngesigxivizo sesikhathi esihlukile.
Iphutha eliphambene lifana nalo livamile. Ukuhlobana kwe-IKE okuphumelelayo akufakazeli ukuthi isiphakamiso se-ESP samukelekile, futhi nakanjani akufakazeli ukuthi iqembu lesigaba 2 liyafana. Thatha umhubhe wokuphatha osusungulwe njengobufakazi mayelana nesigaba 1 kuphela. Abantu bafunda umugqa oluhlaza ngokuthi «umhubhe uvuliwe», bese bechitha ihora esigabeni esingalungile ngoba akukho okubatshela ukuthi ukuxoxisana kwesibili akukaqali.
Funda ilogi ngaphambi kokukhetha ama-algorithm
Qoqa imiyalezo esandulela ukwenqaba ngqo isuka ku-backend ephethe ngempela uxhumano, futhi uyihlobanise nomzamo ofanayo. Ngaphandle kwalokho kuhlobanisa ufunda umlando wokunye uxhumano futhi uphetha ngokuthola imiphumela kuwo.
journalctl -b -u NetworkManager --since "10 min ago"
ipsec statusall # strongSwan
ipsec whack --status # LibreswanKulelo mikhakha, phendula imibuzo emibili: ingabe ukuhlobana kwesigaba 1 kwasungulwa, futhi yikuphi ukushintshana okwehlulekile. Lezi zimpendulo ezimbili zinciphisa ukusesha kubhuku olulodwa lwezimpawu. Isaziso esingenasimo esizungezile asikwazi ukwenza lokho, kungakhathaliseki ukuthi kuyakhanga kangakanani ukuzama isiphakamiso esivela emcimbini wengxoxo. Ukukopisha umucu osebenzayo usuka emshinini onenye i-backend kuvame ukufaka esikhundleni sokwenqaba okukodwa ukwenqaba okunye, kamuva kancane.
I-syntax ye-backend ayihambi
Bhala inguqulo ye-NetworkManager-l2tp nenguqulo ye-backend ye-IPsec ngaphambi kokuqhathanisa noma yini. I-Libreswan ne-strongSwan azihlanganyeli i-syntax yeziphakamiso noma amasethi e-algorithm afanayo, ngakho umucu osebenza kwenye uwuphutha lwe-syntax kwenye. I-backend efakiwe ingase futhi yenqabe i-IKEv1 ngokwenqubomgomo, futhi lapho akukho siphakamiso esiyoke samukelwe.
I-README yephrojekthi ibhala leyo mehluko ye-backend futhi igcina izinkambu zesigaba 1 nesigaba 2 zihlukene. Yifunde njengombhalo wesakhiwo, hhayi njengesimemo sokuvula yonke imbobo yokubhala yasendulo neqembu elibuthakathaka, ngoba uxhumano oluphumelela kuphela ngaleyo ndlela akulona uxhumano okwakucelwe ukuba ulwakhe.
Vumelanani ngesethi, bese uqinisekisa izigaba
Buza umqhubi wesango ukuthi yimaphi amasethi e-IKE ne-ESP asekelwayo futhi agunyaziwe, bese uqhathanisa leyo mpendulo neziphakamiso zangempela zeklayenti hhayi nefayela layo lokucwangciswa. Uma ukungavumelani kumayelana ngqo ne-PFS yesigaba 2, nquma ngeqembu elisekelwayo noma ngenqubomgomo engenayo i-PFS egunyazwe ngokusobala. Ungaqageli inqubomgomo egameni lephutha.
Uma ukuhlangana okukodwa kudinga ukubhala ngemfihlo okungasamukelwa yinhlangano, isinqumo singesango noma singokushintshela kwelinye iphrothokholi. Ukwandisa umucu weklayenti kuze kube khona okuxoxisanayo kuyindlela yokuletha ubuthakathaka obaziwayo nokukhona uphawu oluhlaza eceleni kwalo.
Ngemva kokulungisa ukungafani kwangempela, qinisekisa ukusungulwa kwe-IPsec ngaphambi kokuphenya i-L2TP ne-PPP, futhi thatha noma yikuphi ukwenqaba kokuqinisekisa okulandela njengokwesigaba esilandelayo. Bese uhlola ukuvuselelwa enqubweni yokuhlola egunyaziwe, ngoba ukusungulwa kokuhlobana kokuqala akusho lutho ngempilo yaso esele.