vpnc ngokumelene ne-Check Point noma i-Nortel: kungani ilenga

Isibonakaliso silula ukusifunda kabi: i-vpnc iyaqala, icela iphasiwedi yeqembu, bese ihamba isima esinyathelweni sokuxoxisana ize ibike ukuthi akukho mpendulo evela kumgomo. Akukho lutho emiphumeleni okhuluma ngomkhiqizo wesango, futhi i-akhawunti iyasebenza kusiphequluli, ngakho isiphetho esisobala iphasiwedi engalungile noma imbobo evinjiwe. Ezimweni eziningi zalezi isango aliyona neze i-IPsec osebenza nayo, ngakho ukushintshana akufinyeleli ekuhloleni ubufakazi. Kufanele kuhlolwe lolu hlobo ngaphambi kokushintsha okunye kuphrofayela.

Hlonza umkhiqizo ngaphambi kokuhlela enye inkambu yephrofayela.

Ukwehluleka kubukeka njengobufakazi obungalungile

I-vpnc iqala ngokuthumela i-IKE ku-UDP 500 futhi, uma kunikezwa ukudlula kwe-NAT, ku-UDP 4500. Isango eliphetha i-SSL esikhundleni se-IPsec aliphenduli kukho kokubili, ngakho iklayenti liyaphinda lizame futhi ekugcineni liyayeka ngephutha elijwayelekile. Uma leyo akhawunti isebenza ngesango lesiphequluli elilayisha uhlelo oluncane losizo, lokho kuyisibonakaliso esiqinile sokuthi ithumbu lisekelwe ku-SSL nokuthi iklayenti libuza umbuzo ongalungile.

Umzamo ohlulekile lapha awusho lutho ngakhawunti yomsebenzisi, ngoba abukho ubufakazi obake bethulwa esangweni.

Hlola ukuthi isango linikeza iphrothokholi iphi

Amaminithi amabili okuhlola ahlukanisa i-IPsec osebenza nayo nesango le-SSL. Ziqhube kwinethiwekhi efanayo ezosetshenziswa iklayenti, futhi ufunde ukuthi imiphi imigodi ephendulayo, hhayi ukuthi imiphi ebalwe embhalweni. Gcina umphumela, ngoba leyo migodi efanayo iyona enquma ukuthi iklayenti liphi okufanele lisatshwe umnikazi wesango. Hlola usuka kunethiwekhi yeklayenti hhayi kusuka kusibambi esiseduze nesango.

nc -zvu gw.example.com 500
nc -zvu gw.example.com 4500
nc -zvt gw.example.com 443
curl -sI https://gw.example.com/ | head -5
openssl s_client -connect gw.example.com:443 -servername gw.example.com </dev/null | head -20

Umgede 443 ovulekile onokudluliselwa ekhasini lokungena nokuthula ku-500 no-4500 kukhombisa SSL VPN. Ukuba ku-500 no-4500 kuvulekile nesitifiketi esinikezwa ku-443 kusikisela isango le-IPsec eliphinde liqhube ingaphambili lewebhu, futhi leso yisimo i-vpnc eyakhelwe sona.

I-SSL Network Extender yakwa-Check Point neklayenti le-Aventail lakwa-Nortel zombili zisekhathegini yesibili, futhi akukho okwamukela imfihlo yeqembu le-IKEv1.

Okungashiwo yiphrofayela ye-vpnc nokungashiwo

Ngaphakathi i-vpnc iqhuba i-IKEv1 ngokumelene nokhiye weqembu owabiwe ngaphambili, bese ithumela ubufakazi bomsebenzisi ngamunye nge-XAuth. Konke okusefayeleni layo lokumisa kungokwalokho kushintshana: isango, igama leqembu, imfihlo yeqembu, igama lomsebenzisi nephasiwedi yomsebenzisi. Lezo nkambu zichaza iphrothokholi eyodwa, futhi akukho nhlanganisela yazo engenza iklayenti likhulume enye.

Yingakho ukunweba uhlu lwamakhodi noma ukucisha ukuhlolwa kwezitifiketi kungalokothi kulungise lolu hlobo lokwehluleka. Lezo zinguquko zenza buthaka ukuxoxisana isango elingakulaleli.

Ukukhetha iklayenti elihambisana nesango

Esangweni le-Check Point sebenzisa iphakethe le-SNX elakhelwe leso sikhathi sesango, elishicilelwa umthengisi kanye nemibhalo yakhe yokufinyelela kude. Izakhiwo ezindala ze-SNX zivame ukwehluleka kumadistribhushini amanje ngoba zilindele amalabhulali angu-32-bit angasafakiwe, futhi ukuxazulula iphakethe elahliwe ngokuvamile kubi kakhulu kunokugijima iklayenti elisekelwe endaweni esekelwe.

Amaklayenti e-Aventail alahlekelwa ukusekelwa kudala. Lapho isango elinjalo lisasebenza khona, izinqumo ezingokoqobo isango lesiphequluli uma inhlangano ilihlanganisa, noma iklayenti elisekelwe lomthengisi kusistimu yokusebenza esekelwe.

Buza umnikazi wesango ngomkhiqizo nangenguqulo, ngeklayenti abalisekelayo ku-Linux, nangokuthi ngabe ikhona yini iphrofayela ye-IPsec. Uma ikhona, cela isihlonzi seqembu nemfihlo yeqembu njengezinto ezimbili ezihlukene, ngoba lezo akulona iphasiwedi yomsebenzisi futhi umbhangqwana oshintshiwe ungenye imbangela ejwayelekile yethumbu elihlulekile. Uma ukuxhumana kuphumelela ekugcineni, bhala ukuthi iyiphi iphrothokholi okwavunyelwana ngayo ukuze umuntu olandelayo aqale eqinisweni esikhundleni sokuphinda ukuqagela okufanayo.