Ukufinyelela iklayenti le-IKEv2 kwi-IP yezimo eyabelwe

Isicelo esiqalwa isango esiya kuklayenti le-IKEv2 sidinga inketho ehambisanayo, umthombo wendawo ofanele kanye nomleli ekhelini elifinyelelekayo. Hlola zontathu.

Isango kufanele liqale uxhumano oluya kukhompyutha ephathwayo exhunywe kulo nge-IKEv2, lisebenzisa ikheli lezimo elinikezwe lelo klayenti. Umhubhe uvuliwe, iklayenti lifinyelela konke okungemuva kwesango, kodwa indlela ephambene isahluleka. Lokho kungalingani kuvamile: inqubomgomo okwavunyelwana ngayo ichaza ukuthi yimaphi amakheli angakhuluma, hhayi ukuthi yiluphi uhlangothi olungaqala. Izinto ezintathu kufanele zihambisane ngaphambi kokuba isicelo esiqalwe isango sisebenze.

Umhubhe awulungisi ikheli lomthombo

I-CHILD SA ihlanganisa ipheya lezinketho zethrafikhi, elilodwa ohlangothini ngalunye, futhi ivumela ithrafikhi kuzo zombili izinhlangothi zalelo pheya. Ayisho lutho mayelana nokuthi yiluphi uhlangothi olwavula ukushintshana kwe-IKE kuqala. Isango elalilalele umhubhe ekuqaleni lisengathumela iphakethe lokuqala lohlelo, inqobo nje uma umthombo nendawo ekuyiwa kuyo ezikhethiwe kungaphakathi kwezinketho ezifakiwe. Lapho isicelo siphuma ku-interface okungeyona, asifaneleki umhubhe.

Ukuhamba komgwaqo oluya kuklayenti kuyadingeka futhi akwanele. Inqubomgomo kufanele yamukele umthombo owenze ngawo ngempela.

Funda inqubomgomo efakiwe, hhayi ifayela lokumisa

Qala esihlanganisweni esisebenzayo kanye nezinketho zaso, ngoba ukwabiwa okuguquguqukayo kushintsha okufakiwe ku-kernel.

ipsec statusall
ip xfrm policy

Umphumela wesimo ubalula uxhumano, ikheli lezimo elinikeziwe kanye nezinketho ezisebenza njengamanje kulelo hlangothi. Ukudonswa kwenqubomgomo kubonisa lezo zinketho njengesimo se-kernel, futhi yikho okubuzwa ngempela ukukhethwa kwamaphakethe. Qhathanisa inketho yohlangothi lwesango nomthombo ozosetshenziswa uhlelo lwakho, ngoba ukungafani kuchaza ukuhluleka ngokushesha. Funda ikheli lamanje leklayenti hhayi elivela esesheni edlule, ngoba i-VIP eyabiwe kabusha yenza inqubomgomo endala ingasebenzi.

Iklayenti kufanele lalele lapho iphakethe lifika khona

Ngisho inqubomgomo ephelele ifinyelela echwebeni elivaliwe lapho isevisi ibophezela ku-loopback kuphela. Umleli kufanele abe sekhelini elinikeziwe noma ekhelini lendawo elijwayelekile.

ss -ltnp 'sport = :9090'
iptables -S INPUT

Uhlu lwamasokhethi lubonisa ukuthi ichweba liboshelwe ekhelini lezimo, futhi imithetho yodonga lomlilo ibonisa ukuthi ukuxhumana okusha kuyamukelwa yini kusuka emthonjeni ovikelwe. Umthetho obhalelwe ukuxhumana osuvele kukhona awuvumeli ukuxhumana okuqalwa isango. Gcina ukuqinisekiswa kwesevisi ngokwayo, ngoba ukufika ngomhubhe kuqinisekisa kuphela ukuthi iphakethe lavelaphi kunethiwekhi. Iklayenti elingemuva kwe-NAT yalo lisadinga ukudluliselwa kwechweba elingenayo, ngoba lezi zicelo zihamba ngaphakathi komhubhe okhona.

Hlola indlela entsha yodwa

Isicelo esiphumelelayo esisuka kuklayenti siya kuseva asikaze sihlole le ndlela. Khiqiza isicelo kusuka esangweni bese ubheka iziphetho zombili.

ip route get 10.90.0.42 from 192.168.50.1
tcpdump -ni any host 10.90.0.42 and tcp port 9090

Ukuseshwa komzila kuphendula ukuthi isango lizosebenzisa muphi umthombo futhi iyiphi i-interface, futhi yilowo nalowo mthamo okufanele inqubomgomo iwamukele. Ukuthwebula kufanele kubonise isicelo siphuma ngaphakathi kwe-ESP hhayi njenge-TCP evamile ku-interface yomphakathi. Kuklayenti, thwebula ithrafikhi ekhululiwe ukuze uqinisekise ukufika nokuthi isevisi yaphendula yini. Uma isicelo sinyamalala ngaphandle kwe-ESP ocingweni, solisa ikheli lomthombo ngaphambi kodonga lomlilo leklayenti.

Phinda ukuhlolwa ngemva kokushintshwa kokhiye noma ukuxhumana kabusha, ngoba i-VIP ingashintsha. Umzila osebenza kuphela kuze kufike isesheni elandelayo awuwona umzila osebenzayo.

Izihloko ezihlobene