I-strongSwan ihlala phansi ngemuva kokuqalisa kabusha i-peer: buyisela umhubhe owodwa

I-gateway ekude iyaqalisa kabusha, ibuya phakathi komzuzu, futhi i-daemon yasekhaya ye-strongSwan iqhubeka nokusebenza ngenkathi umhubhe usephansi. Umsebenzi we-cron ohlola i-ESTABLISHED futhi uqalise kabusha i-daemon ekugcineni uzokufihla lokho, futhi uzophinde unqamule wonke umhubhe ongahlobene emshinini ngenkathi kungenzeka uphuthe lowo ohlulekile. Ukubuyisela kungokwasekuxhumaneni okufanele kubuye, okuchazwe ezilungiselelweni ezisinda i-reload. Le runbook ihlela lokho kuxhumano olulodwa futhi ifakazela umphumela ngegama.

Shiya ukuqalisa kabusha okujwayelekile, gcina ubufakazi bakho

Ukuqalisa kabusha i-daemon kunamaphutha amabili aqondile: kubhubhisa isimo sonke isixhumano, futhi akukutsheli lutho mayelana nokuthi yisiphi isigameko esihlulekile ngempela. Umbhalo wesimo ohlolile kungenzeka ukuthi wavela kwesinye isixhumano, ngenkathi i-child edingekayo ihlezi ingenzi lutho ngoba akukho okwayiqalisa.

Funda izixhumano ezilayishiwe kanye nezinhlangano ezisebenzayo ngaphambi kokushintsha noma yini, ukuze ube nesithombe sangaphambilini ozosiqhathanisa naso lapho i-peer ibuye.

swanctl --list-conns
swanctl --list-sas

Beka ukuqala kanye nokuzama kabusha kuxhumano olubuyayo

Ekufakweni kwe-swanctl.conf lezi zilungiselelo zihlala ezingeni lesixhumano ne-child hhayi kunqubomgomo yonke. Ingxenye engezansi iyisibonelo sohlangothi lomqalisi esicabanga ukuthi iziphakamiso, ukuqinisekiswa kanye nezikhethi sezilungile kakade.

connections {
    branch {
        keyingtries = 0
        dpd_delay = 30s
        children {
            private-lan {
                start_action = trap|start
                dpd_action = restart
            }
        }
    }
}

I-start_action inquma ukuthi kwenzekani lapho i-child ilayishwa: i-start iqala ngokushesha, kanti i-trap ifaka inqubomgomo eqalisa ukuqala lapho kuvela ithrafikhi ehambisanayo. Ukubhala i-trap|start kudinga i-strongSwan 5.9.6 noma entsha, ngakho hlola inguqulo ngaphambi kokukopisha umugqa. I-dpd_action=restart icela ukuxoxisana okusha lapho i-peer isimenyezelwe ifile, futhi i-keyingtries=0 ezingeni lesixhumano ivumela eminye imizamo kuze kube impumelelo noma iphutha elihlala njalo. Ngaphansi kwe-IKEv2 i-dpd_timeout ayinamphumela nhlobo, ngoba ukuthunyelwa kabusha okuvamile yikho okunquma ukuthi i-peer ayiphenduli nini.

Ukubambezeleka kuleso sibonelo kuyisiqalo futhi akusona isikhathi sokugcina esijwayelekile. Khetha kuye ngokuthi ukuqalisa kabusha kwe-peer kuthatha isikhathi esingakanani futhi nokuthi ukuthunyelwa kabusha okungakanani ozimisele ukukubekezelela.

Yazi ukuthi ubuyisela kusiphi isigameko

Amaphutha amathathu abonakala efana kudashibhodi futhi adinga izilungiselelo ezahlukene. Isixhumano sokuqala esingakaze sikhwele siyinkinga yokucushwa noma yokufinyeleleka. I-peer eye yayeka ukuphendula iyicala le-DPD. I-child i-peer eyivala ngokucacile isigameko senqubomgomo esine-close_action yaso, i-DPD engasoke isibone. Ukufunda ilogi ezungeze ukuphazamiseka kukutshela ukuthi iyiphi kwezintathu onayo, futhi impendulo ishintsha ukulungisa.

Unganezeli ukuqalisa kabusha okunolaka kuxhumano abasebenzi abaluvala ngamabomu ukuze balungise, kungenjalo umhubhe uzophinde uvele phakathi newindi. Emiklamweni engena ngesicelo i-trap egciniwe yanele, ngoba ithrafikhi ehambisanayo iphinda isungule i-child ngaphandle kwesikhathi.

Qinisekisa ngegama, hhayi ngesimo se-daemon

Funda isixhumano ne-child yaso ngegama ngenkathi i-peer isephansi, bese uphinda uma ibuya; umehluko phakathi kwalokho kuphuma okubili ubufakazi.

swanctl --initiate --child private-lan
swanctl --terminate --ike branch

Bese uqinisekisa insizakalo hhayi inhlangano. Inhlangano entsha yezokuphepha ye-child kanye nesicelo esiphumelelayo esiya endaweni eyimfihlo ngemuva kwayo yizinto ezimbili ezibalulekile, futhi i-daemon esebenzayo enomhubhe ophilile ongahlobene ayifakazeli noma yikuphi kwalokho.

Uma i-child ingakaze iqale, hlola ukuthi ithrafikhi yokuhlola ihambisana ngqo nezikhethi ezicushwe, kuhlanganise iphrotokholi nechweba. Uma iqala yehluleka, funda iphutha lokuqinisekisa noma lesiphakamiso esikhundleni sokulifihla ngemuva komjikelezo ongenasiphetho, ngoba i-keyingtries=0 izophinda ukwenqatshwa okuhlala njalo ingunaphakade.

Layisha ushintsho ewindi bese uhlola futhi

I-reload iphephile kunokuqalisa kabusha i-daemon, futhi noma kunjalo ayimahhala: ukushintsha noma ukukhipha i-child kungavala inhlangano eqaliwe noma kulahle i-trap yayo.

Layisha phakathi newindi lokulungisa, gcina ifayela langaphambilini, futhi uqinisekise ukuthi isixhumano sivela nezilungiselelo obuzimisele ngazo hhayi ezizenzakalelayo.

swanctl --load-conns
swanctl --list-conns

Buyela emuva ngokubuyisela ifayela langaphambilini nokulilayisha futhi, bese uphinda leyo miyalo emibili. Umhubhe obuya kuphela ngemuva kokuqalisa kabusha i-daemon awukalungiswa, ususetwa kabusha.