Kungani i-SSL VPN ne-VPN yendawo-kuya-endawo kungekuphikisani
I-SSL VPN ne-VPN yendawo-kuya-endawo zichaza izimbazo ezihlukile: ubani ojoyina inethiwekhi nokuthi umhubhe wakhiwa kanjani. Ukubiza kokubili ndawonye iyiphutha lesigaba.
Cela abaphathi ababili ukuthi bachaze i-VPN eyodwa futhi omunye angaphendula ngokuthi “SSL VPN” kuyilapho omunye ethi “endawo-kuya-endawo”, sengathi yilezi zimbili izinketho eziqhudelanayo kumenyu. Lezi ziyizimpendulo zemibuzo ehlukile, futhi ukuzithatha njengezinye izindlela kukhiqiza ukuqhathanisa okungenakuxazululwa. Hlukanisa izimbazo bese ingxenye enkulu yengxabano iyanyamalala.
Amalebula amabili, imibuzo emibili ehlukene
I-topology iphendula ukuthi ubani ojoyina ini. Idizayini yokufinyelela kude ixhumanisa abasebenzisi noma amadivayisi ngamanye ne-gateway, ngokuvamile ngobunikazi bomsebenzisi ngamunye kanye neqoqo lamakheli. Idizayini yendawo-kuya-endawo ixhumanisa amanethiwekhi amabili ngama-gateway, ngakho ubunikazi obuthakazelisayo yi-gateway yakwakho hhayi umuntu ophambi kwekhibhodi. Lezi yizinkinga zokusebenza ezihlukile, kusukela ekuhleleni amakheli kuze kufike ekutheni ubani ongahoxisa ukufinyelela ngo-2 ebusuku.
Indlela iphendula ukuthi umhubhe wakhiwa futhi uqinisekiswa kanjani. I-IPsec ne-IKEv2, umkhiqizo osuselwe ku-TLS othwala i-IP ngaphakathi kuwo, kanye nengosi yezinhlelo zokusebenza ebheke kusiphequluli yizinketho zendlela, futhi ngayinye inezingxoxo zayo, amasethi okubhala kanye nezindlela zayo zokwehluleka. Akukho kuzo okusikisela i-topology, futhi i-topology ayikhethi indlela.
Beka izimbazo ezimbili etafuleni elilodwa futhi ukudideka kuyabonakala, ngoba yonke iseli yegridi ingagcwaliswa. Into i-grid engakwazi ukuyenza ukukutshela ukuthi iyiphi inhlanganisela umthengisi wakho ayithumele, ngoba amagama omkhiqizo ahlanganisa izimbazo ezimbili zibe umusho wokukhangisa owodwa.
Iphutha lesigaba livela kuphi
Amathengisi athengisa i-“SSL VPN” iminyaka eminingi njengokuphambene ne-“IPsec VPN”, okwenza ukuqhathanisa kwezindlela kubonakale njengokukhetha i-topology. Le nkulumo nayo isigugile kabi ngezimo zayo, ngoba amadizayini anamuhla asebenzisa izinguqulo ze-TLS ezisekelwe futhi igama i-SSL lihlala ikakhulukazi njengesigaba somkhiqizo.
| Axis | Question it settles | What it cannot tell you |
|---|---|---|
| Topology | Whether users join a gateway or two networks join each other | Which protocol carries the traffic, or how peers prove identity |
| Mechanism | Which protocol suite builds the tunnel and negotiates keys | Whether the endpoints are people, devices or routers |
| Access surface | Whether the client sees a routed network or a set of published applications | Which topology or mechanism is underneath the portal |
| Authentication | What proof each side presents, and to whom | Whether the traffic is later authorized per resource |
Izinganekwane ezimbili ezihlobene zilandelwa ukuhlangana okufanayo. Eyokuqala ukuthi i-IPsec isho indawo-kuya-endawo; i-IKEv2 yakhelwe futhi ubudlelwano beklayenti-kuya-gateway, ngakho ikhompuyutha ephathekayo eyodwa ingajoyina nge-IPsec. Eyesibili ukuthi umkhiqizo osuselwe ku-TLS usho ukufinyelela kude kuphela; OpenVPN isetshenziswa njalo ukuthwala ithrafikhi phakathi kwezindawo ezimbili, futhi ukusetshenziswa kwayo kwe-TLS kugxile ekushintshanisweni kokulawula nokuqinisekisa hhayi kuseshini yesiphequluli.
Isivivinyo esiwusizo sanoma yisiphi isincazelo: uma ukushintsha igama elilodwa kushintsha kokubili iziphetho neprotocol, umusho uhlanganisa izimbazo. I-“SSL VPN uma kuqhathaniswa nendawo-kuya-endawo” ayidluli leso sivivinyo, ngoba igama lokuqala libiza umndeni wendlela kanti elesibili libiza i-topology.
Chaza ukusetshenziswa ukuze kube nokuqhathanisa
Bhala izinkambu ezine futhi uzigcwalise: iziphetho, indlela, ukuqinisekisa kanye nendawo yokufinyelela. Isixhumanisi segatsha singafundwa njengepheya lama-gateway e-IKEv2 phakathi kwamaphrifiksi amabili aqanjiwe anokuqinisekisa ngesitifiketi futhi ngaphandle kwengosi yezinga lomsebenzisi. Insizakalo yokufinyelela kude ingafundwa njengeklayenti elisuselwe ku-TLS elaba amakheli kumsebenzisi ngamunye, elidinga isici sesibili lapho kungena futhi elishicilela kuphela indawo ye-DNS yangaphakathi.
Lemisho ingaqhathaniswa ngendlela amagama omkhiqizo angakwazi ngayo. Amadizayini amabili okufinyelela kude angalinganiswa nokugeleza komsebenzisi okufanayo nendlela yokuhoxisa efanayo, futhi amadizayini amabili aphakathi kwezindawo ngehlu lamaphrifiksi elifanayo, inqubomgomo yethrafikhi kanye nezidingo zokwehluleka. Amalebula ahlela ukuqhathanisa; awakubuyiseli esikhundleni.
Amagama anomumo osemthethweni oshicilelwe futhi. Idokhumenti yamagama ye-VPN ye-IETF ihlukanisa izinhlobo ezimbalwa zensizakalo, kuhlanganise ukufinyelela kude nendawo-kuya-endawo, kusukela ezindleleni ezisetshenziselwa ukuzakha, futhi yiwona kanye umehluko ohlala ulahleka.
Funda iprotocol okuxoxiswene ngayo, hhayi igama lomkhiqizo
Ilebula elisebhokisini aliqinisekisi ukuthi umhubhe osebenzayo uvumelene ngaini. Buza umlingani ngqo, ohlangothini lwe-TLS, futhi ufunde inguqulo yeprotocol nokubhala okukhiqizwe ukuxhawulana esandleni esikhundleni senguqulo esencwadini yokukhangisa.
openssl s_client -connect vpn.example.net:443 -tls1_3 -briefKu-gateway ye-IPsec ukubona okulinganayo kuvela kokuphuma kwesimo kokusetshenziswa uqobo, okubika iziphakamiso ze-IKE ne-ESP ezisetshenziswayo. Noma kunjalo, iphuzu liyafana: imbazo yendlela kufanele ifundwe kuseshini ephilayo, ngoba iklayenti ne-gateway bangaxoxisana behle baye entweni endala kunalokho abaphathi bobabili ababekulindele.
ipsec statusall | grep -E "IKE|ESP"Ngemva kwalokho, imibuzo esele yileyo okungekho lebula eliyiphendulayo. Yiziphi izinguqulo zeprotocol ezisamukelwayo, ubunikazi be-gateway buqinisekiswa kanjani, yiliphi isethi ye-algorithm evunyelwe, ubani ugunyaza umsebenzisi othile ngensiza ethile, futhi yini ehoxisa ukufinyelela lapho idivayisi ilahleka. Umdwebo we-topology negama lendlela kungukuqala kwalolo hlu, hhayi indawo yalo.
Ngakho gcina amalebula amabili, kodwa uwasebenzisele lokho ayikho: indlela emfushane yokusho ukuthi yiziphi iziphetho ezixhunyiwe nokuthi umhubhe wakhiwa kanjani. Ngesikhathi esisodwa lapho elinye lisetshenziselwa ukukhipha elinye, isincazelo siyeke ukuchaza noma yini.