Isango lika-Juniper noma i-Pulse: iyiphi iphrothokholi ye-OpenConnect okufanele isetshenziswe

Ukukhetha iphrothokholi ye-OpenConnect kuwumsebenzi wokuhlanganisa, hhayi ukufuna uphawu lomkhiqizo. Isango elithi Juniper ekhasini lokungena lingase liveze i-Network Connect, i-Pulse noma kokubili, futhi okumisiwe kweklayenti akukho kulezi. Ukuqagela kubiza ukungena okuhlulekile futhi, okubi kakhulu, uchungechunge lwesekelo olusola imininingwane yokungena ngokungafani kwephrothokholi. Qinisekisa insizakalo ngaphambi kokuthayipha igama lomsingathi kuphrofayela.

I-OpenConnect ibiza iphrothokholi endala ngokuthi nc neyentsha ngokuthi pulse, futhi zombili zihlala kubhinari eyodwa. Ifulegi olikhethayo lishintsha ukushintshana kokungena, hhayi ukuhamba kwendlela ngemuva kokuxhumana okuphumelelayo.

Amagama amabili ephrothokholi ahlanganyela umlando owodwa womkhiqizo

I-Network Connect yakwa-Juniper neklayenti le-Pulse Secure lakamuva amaphrothokholi ahlukene umndeni owodwa wamadivayisi owawavezile ngokuhamba kwesikhathi. I-OpenConnect yathuthukisa isibambi se-nc seyokuqala nesibambi se-pulse sesesibili. Lezi zindlela zekhodi ezihlukene namafomethi ezicelo ahlukene, ngakho ukusekelwa kwelinye akusho lutho ngelinye.

Umehluko ubonakala ngokushesha engxoxweni yokungena: amaphoyinti okuphela, izinkambu zefomu nendlela iklayenti elibika ngayo isici sesibili esenqatshiwe kuyahluka phakathi kwababambi ababili.

Ukukhetha emugqeni womyalo kuwushintsho lwegama elilodwa: openconnect --protocol=nc vpn.example.com ye-Network Connect, noma openconnect --protocol=pulse vpn.example.com ye-Pulse. Yomibili imizamo iyimizamo yangempela yokuxhumana engahle ihlele kabusha imizila ne-DNS, ngakho yisebenzise ngamabomu. Ungalokothi ubeke iphasiwedi emugqeni womyalo noma ucime ukuhlolwa kwesitifiketi ukuze udlule iphutha lephrothokholi, ngoba lokho kufihla ukungafani kunokukulungisa. Uma udinga ukubona okuthunyelwa yiklayenti, --dump-http-traffic iphrinta ukushintshana, okuvame ukukhomba isibambi isango elisilindele.

Vumelanisa iphrothokholi nalokho okuvezwa yisango

Idivayisi liphendula kuphela iphrothokholi elilungiselelwe yona. Insizakalo ye-Pulse kuphela inqaba ukungena kwe-nc ngisho nemininingwane evumelekile, futhi insizakalo endala ye-Network Connect ayinayo iphoyinti lokuphela le-pulse elingaphendula. Buza umlawuli ukuthi iyiphi enikwe amandla, nokuthi yiliphi iklayenti abalisekelayo. Idivayisi eliqanjwe kabusha, ikhasi le-wiki eliphelelwe yisikhathi nesango lewebhu elijwayelekile konke kuwubufakazi obubuthakathaka.

Uma usuwazi iphrothokholi, qinisekisa izimfuneko ezizungezile: ukuqinisekiswa ngesitifiketi noma ngetokheni, ukukhethwa kweqembu le-auth nanoma yikuphi ukuhlolwa kokuhambisana kwephoyinti lokuphela. Lezo zinquma ukuthi iklayenti lomugqa womyalo lingakwazi yini ukuqeda ukungena.

Ukuqinisekiswa kungaxazulula umbuzo ngaphambi kwephrothokholi

Ukusetshenziswa kungase kudinge isitifiketi seklayenti, uhambo lwe-SAML ngokusebenzisa isiphequluli noma isihloli se-host esihlola umshini ngaphambi kokunikeza ukufinyelela. Isibambi se-pulse se-OpenConnect sibhala imikhawulo yokuhambisana kwezinye zalezi zindlela, futhi isibambi se-nc sinezikhala saso. Iphasiwedi esebenza kusiphequluli ifakazela ukuthi i-akhawunti ivumelekile; ayifakazeli ukuthi noma iyiphi i-CLI noma isengezo sedeskithophu engakhethwanga ingaqeda ukulandelana okufanayo. Uma isihloli se-host sikhona, iklayenti lidinga iskripthi sokugoqa esinikezwa umlawuli. Ngaphandle kwaso ukungena kuyama ngemuva kwempendulo yokuqala futhi kubonakala njengokuhluleka kwephrothokholi kuyilapho empeleni kuyisinyathelo sokuhambisana esingekho.

Ukukhethwa kweqembu le-auth kungenye indawo evamile yokukhohlisa, ngoba isango elinamaqembu amaningi lilindele ukuthi iklayenti lisho elilodwa.

Emugqeni womyalo, --authgroup="Employees" inikeza lokho kukhetha, futhi ukukushiya kungase kubeke isikhathi seshoni eqenjini elizenzakalelayo elinqaba i-akhawunti. Ngezitifiketi, --certificate ikhomba isitifiketi seklayenti nokhiye, futhi isango lingase lisadinga itokheni ngemuva kwalokho. Hlola ukulandelana okuphelele kanye ngokukhipha okuningiliziwe ngaphambi kokwenza noma yini ezungezile ngokuzenzakalela.

Uma ingaphambili yedeskithophu ingakwazi ukuveza ukukhetha

Izingaphambili zomdwebo ziletha amasethi azo ezici, futhi isengezo esidala singase sibe ngaphambi kwephrothokholi oyidingayo. Ukuhlanganiswa kwe-OpenConnect kwe-NetworkManager kugcina ukukhetha kudatha yokuxhumana yayo, ngakho nmcli connection modify "Office VPN" vpn.data "protocol=pulse" ingasetha lokho umhleli angakubonisi. Hlola ukuthi inguqulo yesengezo efakiwe iyakusekela yini lokho khiye ngaphambi kokucabanga ukuthi ushintsho lusebenzile.

Uma imenyu inikeza i-PPTP noma i-L2TP kuphela, ukukhetha okukodwa akuguquli insizakalo ye-Pulse ibe yilowo phrothokholi. Faka ukuhlanganiswa okuvunyiwe esikhundleni sokushintshela kulokho imenyu okubalayo ngengozi.

Yini okufanele ibhalwe uma ukungena kusahluleka

Bhala izinto ezine: iphrothokholi oyikhethile, izinguqulo zeklayenti nesengezo, ukugeleza kokuqinisekiswa obekulindelwe, nephutha lokuqala elabuya nekhodi yesimo esikhundleni sesikhathi sokuphela. Lelo sethi lehlukanisa isibambi esingalungile nesitifiketi esingekho, iqembu le-auth elenqatshiwe noma ukuhlolwa kokuhambisana okuvinjiwe. Ukukhipha okuningiliziwe nakho kufanele kugcinwe ngesizathu esifanayo, ngoba kukhombisa isicelo esihlulekile hhayi uphawu kuphela.

Gcina umyalo noma iphrofayela esebenzayo eduze kwegama lesango uma kuphumelela. Uma kungenjalo umuntu olandelayo oxhumayo uzophinda ukuqagela okufanayo kophawu lomkhiqizo ngokumelene nephrothokholi.