I-router ye-VPN engagunyaziwe: ukulawula ukungena ngaphambi kokususa umfihlo

I-router engaziwa evela embotsheni yeswitshi yangaphakathi futhi ivule i-VPN ephumayo ngokushesha isivele yeqe ukulawula okubaluleke kakhulu. Ukungena kunquma ukuthi idivayisi ithola ukufinyelela kwenethiwekhi okusebenzisekayo yini, kuyilapho ukususa umfihlo kutshela kuphela ukuthi yenzani ngemuva kwalokho. Ukugcina lolo hlelo ngendlela efanele kuguqula inkinga yokuhlola engenakwenzeka ibe umbuzo ojwayelekile wenqubomgomo yembobo. Futhi umehluko phakathi kwesenzo esingabuyiselwa nokuphazamiseka kwensizakalo.

Ukungena kunqunywa embotsheni

Buza ukuthi idivayisi yathola kanjani ukuxhumana okusebenzisekayo ngaphambi kokubuza ukuthi umhubhe wayo uthwala ini. I-router exhunywe embotsheni yodonga esebenzayo, noma iklayenti elingenantambo elijoyine i-SSID evulekile, lalivunyelwe yinqubomgomo esetshenziswa yileyo mbobo noma leyo SSID. Uma leyo nqubomgomo ithi "konke okuxhunywayo kuthola i-VLAN esebenzayo", i-VPN iwuphawu hhayi ubuthakathaka.

Isivumelwano sokukhetha se-DHCP akulona irekhodi lokugunyaza. Ukuthola ikheli, noma ukungalitholi, kuchaza insizakalo yokwaba amakheli, hhayi isimo sembobo, futhi izakhiwo eziningi zivumela idivayisi engaqinisekisiwe ukuba ifinyelele insizakalo elusizo kuyilapho yenqaba konke okunye. Thatha ithebula lezivumelwano njengobufakazi bokwabiwa kwamakheli, hhayi bokuthenjwa.

Izinhlobo ezintathu zobufakazi ziyahlangana kulezi zihlolo: umuntu ogunyaziwe, idivayisi ephethwe egunyaziwe, kanye nomugqa okushadi lokubalwa kwempahla. Inqubomgomo yembobo kufanele icace ukuthi iyiphi kulezi eyamukelayo, ngoba ubufakazi bokungena obuntshontshiwe nekheli le-MAC elikopishiwe kuhlangabezana nemibandela ehlukene.

Imbobo eqinisekisiwe inquma ini ngempela

Ku-IEEE 802.1X, iswitshi noma iphoyinti lokufinyelela iyiqinisekisi, futhi idlulisela ubufakazi bomfakisicelo enkombeni emaphakathi njengeklayenti le-RADIUS. Izici ze-RADIUS 802.1X zivumela lowo mphumela ukuba ugunyaze imbobo futhi, kuye ngokwakhiwa, ubeke isikhathi somhlangano ku-VLAN ethile noma kumongo othile wokubalwa. Iswitshi siphoqa kuphela lokho okubuyiswa iseva yenqubomgomo uma imbobo ilungiselelwe ukukuphoqa.

Kulesi sigaba sokugcina lapho ukusetshenziswa kwehluleka khona buthule. Imbobo eshiywe kumodi yokuqapha noma yokuloga iqopha isinqumo obekufanele sithathwe futhi isadlulisa ithrafikhi, okubonakala kuyo yonke imibiko njengokusetshenziswa okusebenzayo kuze kube umuntu uxhuma i-router engaphethwe.

switch# show authentication sessions interface Gi1/0/12
Interface  MAC Address      Method  Status
Gi1/0/12   a4bb.6d12.3f09   dot1x   Authz Success
switch# show dot1x interface Gi1/0/12 details
  Oper control mode: auto
  PAE state: Authenticated

Amadivayisi angakwazi ukugijimisa umfakisicelo adinga isinqumo esihlukile, hhayi ukuxolelwa okujwayelekile. Ukweqa ukuqinisekiswa kwe-MAC, ingosi yokubhalisa noma i-VLAN yedivayisi ezikhethekile konke kuyizimpendulo ezisemthethweni, kodwa ngayinye kufanele ikhethwe ngamabomu futhi ibhalwe phansi. Bhala ukuthi yiziphi izigaba zamadivayisi ezingasebenzisa indlela yokubuyisela emuva nokuthi ubani ozigunyazayo. Indlela yokubuyisela emuva engabhalwanga iyona ndlela i-router engaphethwe ethola ngayo i-VLAN esebenzayo ngaphandle kwemvume yomuntu.

Yini ongayibona ngaphandle kokususa umfihlo

Ukubethela kufihla imithwalo, hhayi ukuziphatha. Amakheli omsuka nendawo ekuyiwa kuyo, izimbobo, isikhathi samaphakethe, umthamo wokugeleza nesikhathi sesikhashana kuhlala kubonakala emngceleni lapho ukuqoqa khona, futhi leyomininingo yolwazi ivamise ukwanela ukuxhumanisa idivayisi engaziwa nembobo nendawo ekuyiwa kuyo ephumayo. Ongakwazi ukukufunda uhlelo lokusebenza olungaphakathi komhubhe, futhi akukho kuthwebula amaphakethe okushintshayo lokho ngaphandle kokhiye.

Umhubhe oqhubekayo awuyona ngokuzenzekela into embi. Izixhumanisi phakathi kwezindawo, amanxusa ezokugcina ikhophi kanye namathuluzi okuphatha okude asebenza ngokuqhubekayo ngokwakhiwa, ngakho ukugeleza okuthatha ubusuku bonke akufakazeli lutho ngokwako. Kuqhathanise nendima enikezwe leyo mpahla kanye nomugqa oyisisekelo ogunyaziwe wesigaba sayo.

Nquma ukukhishwa ngamabomu. Ukuvumela imbobo yendawo ekuyiwa kuyo akufani nokugunyaza uhlelo lokusebenza oluyisebenzisayo, futhi ukuqagela komhlukanisi akusona isinqumo sokugunyaza. Qoqa imininingo yolwazi edingekayo kuphenyo, enomnini oshiwo kanye nesikhathi sokugcina, esikhundleni sokuthwebula ngokuzenzakalela yonke ithrafikhi yomsebenzisi ngamunye.

Vimbela ngomngcele owulawulayo

Ngaphambi kokwehlukanisa noma yini, qinisekisa ukuthi idivayisi ingeyakabani nokuthi ixhunywe kuphi. Bese usebenzisa inqubo yesigameko ukunciphisa imbobo noma ukuhoxisa isikhashana, ugcina amalog afanele ngesikhathi ubufakazi busasha. Imbobo yeswitshi ingavalwa iphinde ivulwe; isixhumanisi esiphezulu sokukhiqiza esikhonza amatafula angamashumi amane asikwazi ukubuyiselwa kalula kanjalo.

Ungahlaseli iphoyinti lokugcina futhi ungavali imbobo eyabiwe ngenxa nje yokuthi ukuskena kuphakamise iphrothokholi ye-VPN. Zombili lezi zenzo ziphazamisa umsebenzi osemthethweni ngaphandle kokwenza ngcono isinqumo sokungena esavumela idivayisi ukuba ingene ekuqaleni.

Isivivinyo sokwamukela sicacile: iphoyinti lokugcina eligunyaziwe lisathola ukufinyelela okudingwa yindima yalo, futhi idivayisi engagunyaziwe ayikwazi ukuthola indlela efanayo. Ukuqapha kusekela lowo mngcele, futhi akudingi ukuphula ukubethela kwanoma ubani ukuze kube nzuzo.