Okufanele kurekhodwe kwi-VPN yezindawo: izikhethi kanye nobubanzi

Ezinyangeni eziyisithupha ngemuva kokufakwa komhubhe, isethi entsha yamanethiwekhi iyeka ukuhambisana nomgomo futhi idokhumenti eyodwa kuphela kusheya ithi i-VPN yehhovisi. Leyo yinhlekelele evinjwa irekhodi lezikhethi, futhi icacile: isethi yamakheli yashintsha kanti amaphepha awashintshanga. Ukubhala irekhodi ngendlela efanele kusho ukwazi ukuthi iyiphi isethi yamakheli phakathi kweziningi oyichazayo, futhi urekhode leyo uhlangothi olulandelayo empeleni iyiphogelela, hhayi leyo oyimisile.

Okumisiwe akukona okuxoxiwe

Kumhubhe we-IPsec osuselwe kumgomo, uhlangothi ngalunye luphakamisa izikhethi zethrafikhi: izigaba zomthombo nendawo okuyiwa kuyo zesixhumanisi sengane. Uhlangothi oluphendulayo luvunyelwe ukunciphisa leso siphakamiso, ngakho isixhumanisi esifakiwe singamboza okuncane kunalokho okubalwe kumiselo. Irekhodi elikopisha ukumisa lichaza inhloso, hhayi ububanzi bokuvikela lwamanje. Kokubili kuyahlukana buthule, futhi akukho lutho ekhasini lesimo somhubhe okukhomba lokho.

Gcina womabili amakholomu, kanye nosuku oyibonile. Isikhethi esimisiwe yilokho obukuhlosile; esixoxiwe yilokho kwekhoneni okugcizelelayo njengamanje. Uma kuhlukile, lowo mehluko uchaza ukwehluleka okungalindelekile izikhathi eziningi kakhulu kunephutha lokuhlela umzila.

Isixhumanisi esisodwa futhi asimeleli zonke izinkondlo ezimisiwe. Umhubhe onezinhlanganisela eziningi zezikhethi ungagcina unamaxhumanisi amaningi ezingane, futhi irekhodi elibala elilodwa lawo liwukuhluza okungaphelele. Zibale ngazinye esikhundleni sokuzifingqa.

Imihubhe esuselwe emizileni ikhetha ngendlela ehlukile

Ngokuxhumana kwesikhombisi okususelwe emzileni, ithebula lokuhlela umzila linquma okungena emhubheni futhi izikhethi zingaba banzi ngamabomu. Lokho kuwukuklama okusemthethweni hhayi ubudedengu, futhi irekhodi kufanele likuchaze kanjalo. Bhala umzila, isikhombisi okukhomba kuso, kanye nomgomo wodonga lomlilo olinganisa ukuthi yiziphi izinsizakalo ezingafinyeleleka. Ububanzi bokuvikela bukhulu ngamabomu, futhi ukunciphisa kwenza ububanzi bezinsizakalo.

Ukukopisha isifanekiso esisuselwe kumgomo kumhubhe osuselwe emzileni kukhiqiza idokhumenti echaza indlela ukusatshalaliswa okungayisebenzisi. Unjiniyela olandelayo ube esefuna izikhethi okwakungafanele zibe khona, futhi aphethe ngokuthi umhubhe umiswe kabi kanti ubhalwe kabi kuphela.

Ukuhumusha kungaphansi kwethebula elifanayo

Uma i-NAT yethula isigaba esihlukile kuhlango olulandelayo, rekhoda amaphrefikhi okuqala nawahunyushiwe ndawonye. Phawula isigaba lapho izikhethi nemithetho yokufinyelela zihambisana khona nazo, ngoba ukulandelana kunquma ukuthi uhlangothi olukude luzoke lulibone ikheli olibhalile. Ithebula elinesigaba esisodwa kuphela kwezimbili sibi kakhulu kunokungabi nethebula, ngoba libonakala liphelele.

Lena yimininingwane ephulela umhubhe osebenzayo ngemuva koshintsho lwe-NAT: isikhethi sisahambisana nephrefikhi yokuqala, uhlangothi olulandelayo manje luthola elihunyushiwe, futhi umzila walo wokubuyela ukhomba ekhelini elingasekho. Akukho okurekhoda iphutha ngesikhathi lapho kokubili kuyeka ukuvumelana.

I-DNS yangasese ingaphansi kwendawo efanayo. Igama elixazulula ekhelini elingasebenziseki kusuka endaweni efanele iyiphutha ledokhumenti elinekhithi yokusekelwa elinanyathiselwe, futhi icala lizobekwa emhubheni.

Namathisela isidingo sesevisi

Isigaba esivikelwe asiwona uhlu lwezimvume. Bhala ukuthi yiziphi izinsizakalo okufanele zifinyeleleke zisuka kuwuphi umthombo, nokuthi ubani ongumnikazi wohlelo olusemuva kwazo. Lezo zinkambu ezimbili ziphendula imibuzo ehlukile, futhi ukuzihlanganisa yikho okwenza ukubuyekezwa kwezokuphepha kuphethe ngokuphikisana ngokuhlela umzila esikhundleni sokufinyelela.

Bese usho umphathi wenethiwekhi ogcina umthetho. Uhlu lwezikhethi olungenamnini luguga buthule, futhi okugugile akukwazi ukwehlukaniswa nokungalungile lapho umhubhe wephuka ngehora lesibili ekuseni. Umnini futhi ungumuntu ongaqinisekisa ukuthi ushintsho lwaluhlosiwe.

Phendula irekhodi libe uhlelo lokuhlola

Komzila ngamunye odingekayo, khetha isiphathi somthombo nendawo okuyiwa kuyo esimelela futhi uphawule umzila, insizakalo kanye nesango lempendulo okulindelekile. Lokho kuphendula idokhumenti ibe uhlelo lokuhlola hhayi incazelo. Funda isixhumanisi esisebenzayo ngomyalo ongezansi, futhi usiqhathanise nomugqa oxoxiwe owubhalile.

swanctl --list-sas

Uhlaka lwemigqa emihlanu ngokuvamile lwanele ukugcina irekhodi lithembekile. Inguqulo engezansi ingena kukhithi yoshintsho ngaphandle kokunqunywa:

sites: office <-> dc1
configured selector: 10.10.0.0/16 <-> 10.20.0.0/16
negotiated selector: 10.10.4.0/22 <-> 10.20.0.0/16
translated range: 172.16.4.0/22 -> 10.10.4.0/22
service and owner: erp:443 / finance-netops

I-ping eya emasangweni kuphela akuwona umhlolo wokwamukela. Akuwusebenzisi umzila wokudlula, ngakho kungaphumelela kanti konke ukugeleza okudluliswayo kwehluleka. Hlola kusuka kusiphathi kolunye uhlangothi kuya ensizakalweni kolunye futhi uqinisekise ukuthi impendulo ifika ngomhubhe. Uma i-ping kuphela iphumelela, irekhodi lisanda kuthola inkinga yokudlulisa okwakufanele liyivimbe. Idokhumenti ye-strongSwan mayelana nokudlulisa ichaza ukuthi izikhethi, imizila nokudlulisa kusebenzisana kanjani ku-peer ye-Linux.