Ukwehlukanisa ukuhlukaniswa kwe-IKEv2 nenkinga yochunge lwezitifiketi

Umhubhe wawusebenza kunethiwekhi yasehhovisi futhi uyama ekhaya, futhi ilogi ibonisa ukushintshana kokuqala kuqedwa ngaphambi kokuba kwenzeke okunye. Lelo phatheni likhomba ekushintshaneni kokuqinisekisa, hhayi emininingwaneni yokungena: uchunge lwezitifiketi lwenza lowo myalezo mkhulu kakhulu kunowodlule, futhi indlela engayithandi idathagramu enkulu izowulahla buthule. Kunemikhakha emibili ehlukene yokuhlukanisa ehilelekile, futhi ukwazi ukuthi ubheka iyiphi kunquma ukulungisa.

Imikhakha emibili yokuhlukanisa, uphawu olulodwa

I-IKEv2 inesandiso sayo sokuhlukanisa, esichazwe ku-RFC 7383, esihlukanisa imiyalezo ye-IKE evikelwe ibe imiyalezo emincane ye-IKE. Izinhlangothi zixoxisana ngalelo khono, futhi umyalezo uhlanganiswa kabusha ukuqaliswa kwe-IKE hhayi isendlalelo se-IP.

Ukuhlukanisa kwe-IP okuvamile kuyindlela ehlukile enendlela ehlukile yokwehluleka. Umzila phakathi kwezinhlangothi uhlukanisa idathagramu enkulu, noma uyilahle futhi ubuyisele umyalezo we-ICMP ongase ungafiki nhlobo kumthumeli. Amanye amanethiwekhi alahla izingcezu buthule, futhi amanye amadivayisi aphakathi asebenza ngengcezu yokuqala kodwa hhayi ezinye. Ngokombono wohlelo lokusebenza, zombili lezi zimo zibonakala zifana.

Ukudlula kwe-NAT kwengeza ukuhluka kwesithathu, ngoba lapho i-ESP isongwa ku-UDP futhi iphakethe langaphandle likhula ngenkathi libonakala njengethrafikhi evamile ye-UDP embundwini ongu-4500. Indlela evumela i-UDP ukuba idlule kahle isengahluleka kudathagramu engasasifanelanga.

Funda ukushintshana okwahlulekayo

Bheka ushintsho hhayi iphutha. Ilogi ebonisa ukushintshana kokuqala kuthunyelwe futhi kwaphendulwa, bese kungabikho lutho, ikutshela ukuthi umyalezo olandelayo awuzange uqedwe. Phakamisa izinga lelogi okwesikhashana futhi uqhathanise osayizi abikwe ezinhlangothini zombili.

Lokho ofuna ukukuthola ukuthi umphenduli wawubona yini umbuzo nhlobo. Uma umqalisi wathumela okuthile futhi umphenduli akanalo nhlobo irekhodi ngalokho, inkinga isekulethweni. Uma umphenduli wahlaziya isicelo futhi wasenqaba, inkinga isesitifiketini uqobo, futhi ukuhlukanisa kuyaphazamisa. Lowo mehluko ubaluleke kakhulu kunekhasi lemilayezo yesikhathi esiphelile.

Shintsha indlela, hhayi isitifiketi

Hlola iklayenti elifanayo, isitifiketi esifanayo nokuhlelwa okufanayo kusuka kunethiwekhi ehlukile. I-hotspot yeselula ngokuvamile iyindlela yesibili eshibhile, futhi ihluke ngempela kuxhumano lwasehhovisi, hhayi ngegama kuphela.

Uma ukuxhawana kuqedwa endleleni yesibili, uchunge lwezitifiketi lukahle futhi indlela yokuqala iwukuhluka. Uma kwehluleka ngendlela efanayo kuzo zombili, yeka ukuhlola amanethiwekhi futhi ubheke imiyalezo uqobo. Lokho kuqhathanisa okukodwa kususa cishe uhhafu wezincazelo ezingaba khona.

Linganisa ukushintshana ngaphambi kokuhlela noma yini

Thola usayizi wochunge nosayizi wendlela. Zombili lezi zinombolo zikhawulela okungathunyelwa ukuxhawana, futhi zombili zishibhile ukuzilinganisa:

openssl crl2pkcs7 -nocrl -certfile chain.pem | openssl pkcs7 -print_certs -noout | grep -c subject
ls -l chain.pem
ping -M do -s 1400 198.51.100.7
ip -s link show eth0 | sed -n '1,6p'

Ezimbili zokuqala zinikeza inani lezitifiketi nosayizi wefayela, okuyisikhombisi esinengqondo sokuthi umyalezo wokuqinisekisa uzoba mkhulu kangakanani. Ukuhlolwa kwe-ping kubika ukuthi idathagramu yalelo sayizi iyasinda yini endleleni, futhi izibali zesixhumi zibonisa ukuthi izingcezu zalahlwa yini ohlangothini lwakho. Ku-Windows, ukuhlolwa okulinganayo i-ping enefulegi ye-do-not-fragment nosayizi ocacile womthwalo.

Phinda ukuhlolwa kwehle kuze kuphumelele. Usayizi omkhulu kakhulu odlulayo uyisabelomali somsebenzi sale ndlela, futhi uwusizo kunanoma yiliphi inani elizenzakalelayo elishicilelwe.

Lungisa isendlalelo esiphukile ngempela

Uma indlela ilahla amadathagramu amakhulu, nika amandla ukuhlukanisa kwe-IKE ezinhlangothini zombili futhi uqinisekise ukuthi isandiso saxoxiswana ngaso hhayi ukuthi sanikezwa nje. Uma indlela iphatha izingcezu kabi ezingeni le-IP, ukulungisa kungokwalapho noma kwi-MTU yesixhumi sangaphandle, hhayi esitolo sezitifiketi.

Uma uchunge lude ngokungadingekile, lunqamule lube yizitifiketi eziphakathi ezidingeka ngempela ohlangothini. Ukususa impande iklayenti elivele liyithemba kuwukugcinwa okunengqondo; ukususa esiphakathi akunjalo, futhi ukucisha ukuqinisekisa ukuze kuncishiswe umyalezo kushintshanisa inkinga yokulethwa nenkinga yokuphepha.

Bhala ukuthi yimuphi umkhakha oyishintshile nokuthi ukuxhawana kwakubonakala kanjani ngemuva kwalokho. Isigameko esilandelayo ngokuvamile sisenethiwekhi ehlukile enophawu olufanayo, futhi inothi liyilona eliguqula amahora amabili abe yimizuzu eyishumi.