Kusuka ku-strongSwan kuye ku-AWS Site-to-Site: kungani i-Child SA ingakhethi lutho

I-IKE tunnel ingase isebenze kuyilapho inhlangano yengane ikhipha amasubneti akho. Qala ngokuqhathanisa i-CIDR yasendaweni neyakude ye-AWS ne-leftsubnet ne-rightsubnet.

Ikhonsoli ikhombisa up, i-strongSwan ibika inhlangano ye-IKE esunguliwe, futhi amaphakethe awafiki. Into elandelayo okufanele iqhathaniswe akusiyo ukhiye owabiwe ngaphambili, kodwa umbhangqwana wama-prefix ohlangothi ngalunye olucabanga ukuthi i-tunnel iwavikela. Landela izivivinyo ezingezansi ngokulandelana, ngoba ezimbili zokuqala zinquma ukuthi i-tunnel ingakwazi yini ukuthwala ithrafikhi yakho nhlobo.

Humusha amagama e-AWS abe ngamagama e-strongSwan

I-AWS ichaza ukuxhumana ngasohlangothini lwekhasimende: ikheli lesango lekhasimende ne-CIDR yasendaweni ngeyakho, kanti i-CIDR yakude ngeye-VPC. I-strongSwan ibiza iziphetho ezimbili ngokuthi left kanye no-right, i-prefix yakho ise-leftsubnet kanti i-prefix ye-VPC ise-rightsubnet. Ukuphendula umbhangqwana owodwa kwenza i-tunnel exoxisana futhi ikhethe ithrafikhi engalungile.

Landa ukumiswa okukhiqizwa yi-AWS kukuxhumana futhi kukuthathe njengereferensi yalokho kuxhumana uqobo, kufaka namakheli ne-prefix ye-tunnel. Uma ushiya zombili izinkambu ze-CIDR zingenalutho ngesikhathi wakha, isevisi isebenzisa i-0.0.0.0/0 ezenzakalelayo ohlangothini ngalunye. Umzila ohlelwe nge-prefix emincane awusoze wafanisa nayo, ngakho-ke gcwalisa izinkambu noma wandise isikhethi ngamabomu.

Ukungafani lapha kubonakala njengokwehluleka komzila kodwa akunjalo.

Gxilisa ikheli i-AWS elibona ngempela

Umzila ongemuva kwe-NAT ungathumela i-IKE kusuka ku-interface umhlangothi wesibili ongakaze wazi ngayo. Ikheli lesango elirekhodwe ku-AWS kufanele kube yilelo i-AWS elibona kunethiwekhi, futhi umzila kufanele ugxiliswe kulelo kheli lendawo elilodwa esikhundleni sokulandela umzila wawo ozenzakalelayo.

conn %default
    local_addrs = 203.0.113.10

Ku-strongSwan i-local_addrs ikhetha ikheli lomthombo le-IKE, kanti ukumiswa kwakudala kwe-OpenSwan kubhala umqondo ofanayo ngokuthi left. Kuqondise ku-interface ephethe ikheli lomphakathi, bese uqinisekisa kudivayisi ye-NAT uqobo ukuthi i-UDP 500 kanye ne-4500 zifinyelela kuleyo host, ngoba umthetho osele kusuka kumzila wangaphambili uwalahla buthule. Umbhangqwana wokukhetha olungile onokheli lomthombo olungalungile usahluleka, futhi ilogi izosola isiphakamiso. Yikho lokho kuduka okwenza ikheli lomthombo lifanele ukuhlolwa kwalo.

Qinisekisa umthetho wokudlulisela esikhundleni sokuwucabangela, ngoba umthetho owawulungile kumzila wangaphambili uvame ukusala.

Phatha isigaba 1 nesigaba 2 ngokwehlukana

I-AWS ikhombisa izinketho ze-IKE ne-ESP njengezinhlu ezihlukene. Isethi ye-IKE eyamukelwa yizinhlangothi zombili ayisho lutho ngesiphakamiso se-ESP, ngoba lezi zinhlu ezimbili zizimele. Funda zombili kukumiswa okukhiqiziwe bese uziqhathanisa ngayinye ngayinye.

conn aws
    ike = aes256-sha1-modp1024
    esp = aes256gcm16

Isintaksi ayihambi phakathi kokuqaliswa. Umbhangqwana osebenza ku-OpenSwan, isibonelo i-phase2alg=aes_gcm kanye ne-ike=aes256-sha1;modp1024, udinga ukuhunyushelwa esimweni se-esp= ne-ike= se-strongSwan, futhi amagama e-algorithm ayahluka. Njengoba i-GCM iqinisekisa ngesikhathi ibhala ngokufihla, ayidingi ukuguqulwa kobuqotho okuhlukile, ngokungafani nesethi ye-CBC ehlanganiswe ne-SHA. Umugqa wesigaba 2 onamatheliswe kusuka kudemon eyodwa kuya kwelinye ngaphandle kokuhunyushwa wenza ukwenqatshwa okufundeka njengokungafani kwesikhethi.

Hlola inhlangano yengane, hhayi inkomba ye-tunnel

Uma ukuxhumana kulayishiwe kodwa kungekho nhlangano yengane evelayo, kwenqatshiwe isiphakamiso noma izikhethi. Uma ingane ivela futhi izikhethi zayo zikhipha ama-prefix akho, amaphakethe ayahlungwa ngaphambi kokufika ku-tunnel. Inkomba yekhonsoli ihlanganisa izinga le-IKE kuphela, ngakho-ke ayikwazi ukukutshela ukuthi yikuphi kwalokhu okubili okwenzekile.

ipsec statusall

Thola inhlangano yokuphepha yengane bese ufunda izikhethi zethrafikhi ezinyathelisiwe eceleni kwayo, bese uziqhathanisa nama-prefix avela kukumiswa okukhiqiziwe.

Hlola kusuka kuhost engaphakathi kwe-prefix yasendaweni kuya kuhost engaphakathi kwe-prefix ye-VPC, futhi uhlole indlela yokubuya kanye nanoma yiliphi iqembu lokuphepha noma i-ACL yenethiwekhi ohlangothini lwe-AWS. Izikhethi ezilungile azivikeli iphakethe ekulahlweni kamuva.

Uma kusahluleka ngemva kokufanisa kwezikhethi

Qinisekisa ukuthi umzila ezinhlangothini zombili ukhomba ku-tunnel, bese uqinisekisa ukuthi idivayisi ye-NAT ayibhali kabusha ithrafikhi ngendlela inqubomgomo engayilindele. I-tunnel esekelwe kunqubomgomo ifanisa amakheli amaphakethe, ngakho-ke ukuhunyushwa okusetshenziswe ngemva kwesinqumo senqubomgomo kushintsha umphumela.

Rekhoda iphakethe elilodwa elingayo nelilodwa eliphumayo ohlangothini ngalunye ngaphambi kokushintsha esinye isiphakamiso.

Kurekhode ku-tikithi izikhethi, iziphakamiso zesigaba 1 nesigaba 2 kanye nekheli lomthombo. Lawa manani amane achaza iningi lokwehluleka kwe-site-to-site ngaphandle kocingo.

Izihloko ezihlobene