Ukwakha i-VPN ye-IKEv2 ku-PowerShell ngesitifiketi somshini

I-Windows iza nekhasimende le-IKEv2 elilawulwa yi-PowerShell kusukela ekuqaleni kuze kube sekugcineni, ngakho umhubhe osebenzayo awudingi GUI noma isofthiwe yabanye. Cishe konke ukwehluleka kuvela ezindaweni ezintathu: ukuthi isitifiketi saphelela kuphi, ukuthi amaphrefikhi omzila abhalwa kanjani kanye nokuthi indlela ye-EAP ekhethiwe ilindeleni. Ziphatha ngalolo hlelo, ngoba ngayinye ingahlolwa ngaphambi kokuba okulandelayo kuqale futhi iphutha lakamuva lizofihla elangaphambili.

Imihubhe yesitifiketi somshini ikhona ukuze iqale ngaphambi kokuba noma ubani angene, yingakho ubunikazi ngokuvamile kufanele buhlale esitolo sekhompyutha hhayi sesisebenzisi.

Isitifiketi kuqala, umhubhe kamuva

Ukungeniswa okubili kubalulekile. Ubunikazi bekhasimende bungena ku-Cert:\LocalMachine\My ngokusebenzisa i-Import-PfxCertificate, futhi i-CA ekhiphayo ingena ku-Cert:\LocalMachine\Root ngokusebenzisa i-Import-Certificate. Iphepha elilodwa alifakazeli noma yiluphi uchungechunge, ngakho ukweqa ukungeniswa kwesibili kushiya ukuqinisekisa kungenasisekelo. Ngaphezu kokuba khona, ukhiye oyimfihlo kufanele unamathiselwe futhi i-akhawunti yekhompyutha kufanele ivunyelwe ukuwufunda. I-Get-ChildItem Cert:\LocalMachine\My ibala okufikile; qhathanisa izigxivizo zeminwe hhayi izihloko, ngoba izihloko ezicishe zifane zivamile.

Hlola ukusetshenziswa kokhiye okunwetshiwe ngaphambi kokuthumela. Ukuqinisekiswa kwekhasimende yisidingo esijwayelekile sobunikazi bomshini we-IKEv2, futhi uhlangothi olulandelayo kufanele luthembe i-CA eyisayinayo. Ubunikazi obusesitolo somsebenzisi abukho ekuxhumaneni komongo wekhompyutha.

Dala iphrofayela nemizila yayo

I-Add-VpnConnection -Name "Office IKEv2" -ServerAddress vpn.example.com -TunnelType Ikev2 -EncryptionLevel Required -AuthenticationMethod MachineCertificate -AllUserConnection ibhala iphrofayela. Isishintshi se--AllUserConnection siyishicilela encwadini yocingo yomhlaba wonke, ifanele umshini owabiwe noma ophethwe yisevisi; shiya ngaphandle kumsebenzisi oyedwa. Noma yiliphi ikheli olidlulisayo kufanele lihambisane negama le-DNS elisitifiketini seseva, uma kungenjalo ukwehluleka kuvela ngemva kokuba umhubhe usuvele. Bese kuthi amaphrefikhi engezwe ngamunye nge-Add-VpnConnectionRoute, futhi kuphela lawo umklamo owadingayo ngempela.

I-IPv6 inento eyisimanga: i-Windows yenqaba i-::/0 njengomzila we-VPN, ngakho i-::/1 ne-8000::/1 ndawonye zimboza isikhala sekheli elifanayo. Ukuhambisa iphrefikhi akuniki lutho futhi ku-firewall ekude, ngakho uhlu lwamaphrefikhi nenqubomgomo ye-firewall kuhlala kuyimibhalo ehlukene.

Ubufakazi bungebendlela yokuqinisekisa

Iphrofayela yesitifiketi somshini ayidingi mfihlo yomsebenzisi nhlobo, kanti iphrofayela ye-EAP-MSCHAPv2 iyayidinga. Esimweni sesibili imojuli ye-VPNCredentialsHelper inikeza i-Set-VpnConnectionUsernamePassword, futhi ifuna umbhalo ocacile: i-$cred.Password yi-SecureString, ngakho yivule kuqala nge-GetNetworkCredential().Password. Faka imojuli yonke indawo lapho umyalo ugijima khona, hhayi kuphela esiteshini somsebenzi lapho yabhalwa khona. I-EAP-TLS noma indlela yangokwezifiso ayisebenzisi neze le cmdlet; esikhundleni salokho ithatha i-XML yokulungiselelwa kwe-EAP.

I-rasdial "Office IKEv2" iphakamisa ukuxhumana isuka ku-shell, futhi iyona ndlela esheshayo yokubona umphumela obonakala ngqo esikhundleni sokuwuthola kumbhalo wemicimbi.

Okungakufakazeli umhubhe oxhunyiwe

Isimo sokuxhunyiwe simboza ukushintshana kwe-IKE kanye nesinyathelo sokuqinisekisa, futhi akukho okunye. Ukuziphatha kwe-DNS, indlela eya kumsingathi oyimfihlo kanye ne-firewall ekude konke akukafakazelwa. Sebenza uye ngaphandle: i-adaptha yomhubhe, bese ukusesha komzila wekheli eliyimfihlo, bese isevisi eyodwa oyivunyelwe ukuyisebenzisa. Ukubona kokuqala okwehlulayo kukhombisa ungqimba okufanele luphenywe.

Uma ushintsha iphrofayela, susa eyandulelayo nge-Remove-VpnConnection -Name "Office IKEv2" -Force ngaphambi kokuyakha kabusha; uma kungenjalo izilungiselelo nemizila endala zihlala zikhona ngemva kokuhlela. Uma ingakaxhumi, qhathanisa isigxivizo somunwe esibhalwe kuphrofayela naleso esikhona esitolo, ngoba i-Windows ingase igcine isikhombo sobunikazi obushintshwe phakathi nendawo ngaphansi kwesihloko esingashintshile.

Gcina isigxivizo somunwe, indlela ye-EAP kanye nohlu lwemizila eduze kwephrofayela. Zihlangene zichaza okuningi kwalokho okungahambi kahle kamuva.