Lapho i-MODP3072 ingena khona ku-AWS Site-to-Site VPN
I-MODP3072 iyiqembu le-15 le-IANA, kodwa iqembu lingelesigaba esithile. Hlanganisa imfuneko nohlu lwe-DH lwe-Phase 1 noma i-Phase 2 ngaphambi kokuhlela i-tunnel.
Othile ukuthumelela imfuneko ethi i-IKEv2, i-ESP ne-MODP3072, kanti ikhonsoli ayinayo inkambu enalelo gama. Iphutha ukuthi uqale ukufuna leyo nkambu. I-IKEv2 inguqulo yokuxoxisana, i-ESP iwumthetho wokuxhumana ohambisa ithrafikhi yakho evikelekile, kanti i-MODP3072 iyiqembu lokushintshana kokhiye, okungukuthi iqembu le-15 le-IANA. Lawu maqiniso amathathu ahlala ezindaweni ezintathu ezahlukene, futhi iqembu livela kabili.
Lowo musho awusona isilungiselelo esisodwa
Guqula imfuneko ibe nguhlu lwezinketho ngaphambi kokuthinta noma yini. Ithebula elingezansi liwukuhlangana konke.
| Agreed requirement | AWS option to review | Still a separate decision |
|---|---|---|
| IKEv2 | Allowed IKE versions | Encryption, integrity, key-exchange choices |
| MODP3072 for the IKE exchange | Phase 1 DH groups, group 15 | Phase 2 key-exchange and PFS policy |
| MODP3072 for the protected-traffic exchange | Phase 2 DH groups, group 15 | The initial IKE exchange group |
| A named encryption algorithm | That phase's encryption list | Integrity and DH-group agreement |
I-MODP3072 iyiqembu le-15, futhi i-AWS okwamanje yamukela i-15 kukho kokubili uhlu lwamaqembu e-DH e-Phase 1 ne-Phase 2. Ukuyamukela kuzo zombili izindawo akufani nokuyidinga kuzo zombili, futhi akusho neze ukuthi uzakwethu wayeqonde zombili.
I-Phase 1 ne-Phase 2 zixoxa ngezinto ezihlukene
I-Phase 1 yakha inhlangano yezokuphepha ye-IKE: ukuthi amasango amabili aqinisekisa kanjani ubunikazi, avumelana kanjani ngokhiye futhi avikela kanjani ingxoxo yawo uqobo. I-Phase 2 yakha i-CHILD SA ehambisa ithrafikhi yakho yangempela, futhi ukushintshana kwayo kokhiye kungaba okusha esikhundleni sokuthathwa njengefa.
Yikho lokhu kwehlukaniswa okwenza kube nokubaluleka lapho uzakwethu ekhuluma ngokufihleka okuphelele okuya phambili. I-PFS iyisici se-Phase 2, futhi iqembu elisohlu lwe-Phase 1 alikunikezi lokho. Buza ukuthi imfuneko ngayinye isebenza kukuphi ukushintshana, kanye nemodi yokubethela, ukuthi ubuqotho bunikezwa yi-AEAD cipher yini, kanye nokulindelwa kokuvuselelwa kokhiye kuzo zombili izinhlangothi.
Ungasikhiphi isethi ephelele eyamukelekayo egameni i-AES noma enombolweni eyodwa ye-DH. Inqubomgomo ehlanganiswe izingxenye ezimbili zezingxoxo ezimbili yiyo indlela i-tunnel egcina ngokuphakamisa ngayo into okungekho qembu elivumelene nayo.
Uhlu oluvunyelwe alusona umphumela wezingxoxo
Uhlu lwezinketho luchaza lokho uhlangothi ngalunye oluzimisele ukukwamukela. Alubiki lokho okukhethiwe. Funda iziphakamiso ze-IKE ne-CHILD-SA ezikhethwe ngempela oxhumano olusha, bese uqinisekisa ukuthi imfuneko yanelisiwe hhayi nje ukuvunyelwa. Inketho eqinile esohlwini ifakazela kuphela ukuthi yayitholakala.
Bheka nokuvuselelwa. I-CHILD SA yokuqala ye-IKEv2 nokushintshana kwe-CHILD kamuva okuphethe i-PFS kungadalula izimo zokuhambisana ezahlukene, ngoba ukushintshana kwesibili kwakha impahla entsha yokhiye neqembu le-PFS. Uma ukuhlolwa kwakho kokwamukela kuhlanganisa kuphela umzuzu wokuqala we-tunnel, akuhlolanga ingxenye uzakwethu ayikhathazayo.
Incwadi yezinketho ze-tunnel ye-AWS ibala i-Phase 1 ne-Phase 2 ngokwehlukana, futhi yilokho ukwakheka okufanele kufundwe ngaphambi kokufika kwemfuneko elandelayo.
Shintsha i-tunnel oyishoyo ngempela
Uxhumano lwe-VPN Site-to-Site lunama-tunnel amabili anezinketho zawo kanye nesimo sawo. Ngaphambi kokubuyekeza noma ukuhlela noma yini, hlanganisa ikheli langaphandle le-tunnel ye-AWS ne-peer ohlangothini lwesango lekhasimende futhi ungacabangi ukuthi ukugcina okukodwa kubuyekeza kokubili.
Ushintsho olugunyaziwe ludinga ukuthi uhlangothi lwesango lekhasimende lulungiselelwe inqubomgomo efanayo kanye nesikhathi sokuphazamiseka i-tunnel ekhethiwe ezokuthola. Uma i-peer ingakalungiselelwa iqembu le-15 esigabeni osishintshayo, i-tunnel izovele iyeke ukuphakama, futhi ikhonsoli ngeke ikutshele ukuthi luphi uhlangothi olwenqabile.
Rekhoda inqubomgomo okuvunyelwene ngayo njengesigaba, inguqulo yomthetho wokuxhumana, ukubethela, ubuqotho kanye neqembu le-DH, bese uyiqinisekisa ekushintsheni okufanele ikuvikele. Ukuhlela imizila, izikhethi zethrafikhi nezimvume zezinhlelo zokugcina zihlala zihlukene; lokhu kuhlangana akusona isilungiselelo esiphelele sesango, futhi akusona isiphakamiso sokuvula ama-algorithms engeziwe ngenxa yokwehlukahlukana.