I-IPsec enamakwele amaningi ilahlekelwa ukuphindiselwa kwethrafikhi? Bala ama-reqid

Ithrafikhi iyasuka endaweni eyodwa futhi ayibuyi neze, womabili amasango abika ukuxoxisana okuqediwe, futhi okuwukuphela komkhondo inqwaba yamaphakethe aphumayo angenazo izimpendulo. Endaweni yokugcina ye-Linux, imbangela ejwayelekile akuwona amandla okubethela, i-MTU noma ithebula lomzila. Ingqikithi yemibhalo yenqubomgomo kanye nenombolo ehlanganisa inqubomgomo ngayinye nenhlangano yezokuphepha. Inqubo engezansi ifunda lezo zisekelo ezimbili ngaphambi kokuthinta noma yini enye.

Ihlukanise uphawu ngaphambi kokushintsha noma yini

Ukwehluleka kwendlela eyodwa ngokuxoxisana kwe-IKE okuqediwe kunciphisa inkinga ibe umzila wedatha. Kuhle ukuthi inqubomgomo yokuphuma yayihambisana futhi impendulo yalahlwa, noma impendulo ayifikanga neze ngoba uhlangothi olukude lwalungenayo into yokuyithumela ngayo. Kusukela kuhlelo lokusebenza zombili zibukeka zifana, futhi izisekelo ze-xfrm ziyazihlukanisa.

Ungaqali nge-MTU. I-MTU engalungile iletha ukumiswa kanye nezimpawu zokuhlukaniswa, hhayi ukuhlukaniswa kwendlela okuhlanzekile ngamasibali aphumayo akhulayo.

Funda isisekelo senqubomgomo kanye nesisekelo sesimo

Ku-Linux ukubethela kunqunywa imibhalo yenqubomgomo, ngakho inqubomgomo ehambisanayo, hhayi umzila, iyona efaka iphakethe emhubheni. Sebenzisa ip xfrm policy ukubona izikhethi, indlela, ukubaluleka kanye nesifanekiso sombhalo ngamunye, kanye ip xfrm state ukubona izinhlangano ezisunguliwe nama-reqid azo. Inqubomgomo kanye nenhlangano kuxhunywa yileyo reqid.

Bheka izindlela zontathu. Okuphumayo nokungena kuhlanganisa ithrafikhi eya nokuvela kule hosti; indlela yokuqhubekisela phambili ibalulekile lapho ihosti ihlela umzila yenzela abanye. Umbhalo ongekho noma ongahambisani endleleni eyodwa uchaza umphumela wendlela eyodwa ngaphandle kwephutha lokubethela.

Ukungalingani okujwayelekile: i-reqid eyodwa yezisubnet eziningi

Ukwehluleka okuvamile kuvela kumlingani ofaka izinqubomgomo zazo zonke izisubnet okuxoxiswene ngazo ngaphansi kwe-reqid eyodwa, okwenzeka nge-generate_policy require ye-racoon. Ithrafikhi ke iphuma ngenhlangano eyasungulwa kokugcina, kuyilapho uhlangothi olukude lugcina inhlangano ehlukile ngesisubnet ngasinye. Izimpendulo zifika kunhlangano okungeyona i-reqid yayo ekhombisa inqubomgomo okufanele izamukele, futhi umnyombo uziyalahla ngemva kokukhipha ukubethela.

Isixazululo ukushintsha kokucushwa, hhayi umthetho we-firewall: generate_policy unique; inikeza inqubomgomo ngayinye i-reqid yayo, ukuze izinhlangano zomlingani ngenqubomgomo ngayinye zibe nabalingani abahambisanayo. Kuyisebenzise, xoxisanani futhi, futhi ubale ama-reqid ahlukene ezisubnet ozilindele ngaphambi kokumemezela impumelelo.

Uma izisubnet ezimbili zisabelana nge-reqid eyodwa kuyilapho uhlangothi olukude lulindele ezimbili, utholile ukungalingani. Bhala ukubhangqa, ngoba kuwubufakazi bokuthi ushintsho olulandelayo kwalungisa noma kwakugcina.

Izikhethi zivela ekuxoxisaneni, hhayi ekucushweni kwakho

Izindawo ezivikelwe yilezo okwavunyelwana ngazo yizinhlangothi zombili, hhayi lezo ezacelwa uhlangothi olulodwa. Iklayenti elinikela ipheya lamahosti ngokumelene nebanga elibanzi elikude lithola inguqulo encishisiwe yesango, futhi iklayenti ayikwazi ukuyandisa. Funda izikhethi ezifakiwe esikhundleni salezo ezisefayelini yakho yasendaweni.

Uma umgomo uhlukile, ukugcina indawo eyodwa ngaphandle komhubhe, engeza inqubomgomo yokudlula enenombolo ephansi yokubaluleka ukuze yehlule umbhalo ofakwe ngokuzenzakalela. Inqubomgomo engenasifanekiso ivumela umbhalo ocacile, okwenza ibe ukuhlukana ngamabomu kwerekhodi loshintsho hhayi isinyathelo sokulungisa amaphutha.

Qinisekisa ngokulandelana lokhu, futhi wazi ukuthi ungahlehla kanjani

Bhala izinqubomgomo zesisubnet ngasinye kuzo zombili izindlela, kuhlanganise nokuqhubekisela phambili uma ihosti ihlela umzila. Bala ama-reqid ahlukene futhi uqinisekise eyodwa ngenqubomgomo ohlangothini oluyilindele. Qhathanisa izikhethi ezifakiwe nalezo okuxoxiswene ngazo. Funda kabusha amasibali ngenhlangano ngayinye ngemva kokuvuselelwa kokhiye, ngoba inhlangano oyihlolile kungenzeka isihambile. Hlola imizila ekugcineni, ngoba umzila ongekho oya kwisisubnet esikude uveza uphawu olufanayo lwendlela eyodwa ngamasibali enqubomgomo ahlanzekile.

Ngaphambi kokushintsha umlingani, gcina umphumela wamanje wemiyalo emibili ye-xfrm. Uma ukucushwa okusha kungabuyisi indlela yokubuyela emuva, ukubuyisela lowo mphumela ukuhlehla okusheshayo kunokwakha kabusha umhubhe kusuka enkumbulweni, futhi kugcina ukuqhathanisa kuthembekile.