Kungani umgomo wokuphepha we-IPsec ungeyona ingxenye ohlwini lwemizila
Umzila osebenzayo awufakazi lutho nge-IPsec. Funda ukusesha komzila kanye nezinketho zomgomo womkhondo ofanayo, bese uqinisekisa ukuthi inhlangano iwumboza.
Thumela i-ping ku-10.20.0.5 ngomhubhe futhi akukho okubuyayo, kuyilapho uhlu lwemizila lugcizelela ukuthi leyo sethi encane iyafinyeleleka. Ukuhambisa imizila ne-IPsec kuphendula imibuzo ehlukene, futhi eyodwa kuphela ekhuluma ngokufinyeleleka. Ukusesha phambili kukhetha umzila, bese isizindalwazi somgomo wokuphepha sinquma ukuthi lowo mzila kufanele uvikelwe, ushiywe njengoba unjalo noma wenqatshwe. Lapho kokubili kungavumelani, iphakethe lifa buthule, ngakho-ke zifunde ngalolo hlelo.
Qala ngokusesha, hhayi ngohlu
Buza i-kernel ukuthi izokwenzani ngempela: ip route get 10.20.0.5 iphrinta umzila okhethiwe, i-interface yokuphuma kanye nekheli lomthombo elizolisebenzisa. Isiqalo, umthetho womgomo, uphawu noma umthombo okhethwayo konke kungashintsha leyo mpendulo, yingakho ukusesha bukhoma kudlula ukufunda uhlu ngamehlo.
Hlola indawo ekuyiwa kuyo ngaphakathi kwebanga elivikelwe, hhayi ikheli lesango. Ukufinyelela esangweni kolunye uhlangothi kufakazela kuphela ukuthi kukhona umzila; akusho lutho ngesethi encane oyidingayo ngempela. Bese uqinisekisa ukuthi i-interface ekhethwe ukusesha iyona oyilindele ukuthi umhubhe uyisebenzise.
Qondanisa izikhethi ezinhlangothini zombili
Isizindalwazi somgomo sinezingxenye zaso, futhi ngayinye isho isiqondiso, umthombo, indawo ekuyiwa kuyo nephrothokholi, bese isho ukuthi kufanele kwenzeke ini ngamaphakethe ahambisanayo. Sebenzisa ip xfrm policy ukuwabala; amafulegi akhombisa ukuthi isenzo siwukuvikela, ukweqa noma ukuvimba. Umgomo onezikhethi ezibanzi noma ezincane kunomkhondo wakho wokuhlola ngeke uhambisane nawo, futhi iphakethe liphuma lingavikelwe. Leyo yinkinga oyifunayo, hhayi umzila ongekho.
Qhathanisa amanani angempela: umthombo, indawo ekuyiwa kuyo, iphrothokholi namachweba. Uma ukusesha kuxazulule ipheya elilodwa lamakheli kuyilapho ingxenye yomgomo imboza elinye, imibono emibili ichaza ithrafikhi ehlukene. Phinda usebenzise kokubili nge-tuple efanayo ngaphambi kokuphetha, kungenjalo uzohlela umgomo ongakaze ube semzileni.
Ukuhambisana komgomo akusona isimo esifakiwe
Umgomo ohambisanayo usho kuphela ukuthi iphakethe kufanele livikelwe; i-kernel isadinga inhlangano yokuphepha ukuze yenze ukuvikela. Zibale nge-ip xfrm state, noma nge-swanctl --list-sas lapho i-strongSwan yenza izingxoxo, futhi ufunde izikhethi nezibali engxenyeni ngayinye.
Lapho umgomo uhambisana futhi kungekho nhlangano ehlanganisa lezo zikhethi, iphakethe liyaphonswa esikhundleni sokuthi lithunyelwe ngombhalo ocacile. Lokho kungukulahla okufanele ukufune lapho umhubhe uphakeme kodwa isethi encane eyodwa yehluleka. Izibali zisho okunye: inhlangano engakhuli neze ayikaze ikhethwe, kuyilapho leyo ekhulayo futhi egcina iphele ngokulahla ikhomba ohlangothini olukude. Ukulungisa izikhethi nokuvuselela okhiye kungukulungisa okuhlukene, ngakho-ke nquma ukuthi iyiphi oyidingayo ngaphambi kokuthinta ukuhlelwa.
Yini umhubhe osekelwe emzileni esayidinga
I-interface ye-XFRM yenza umhubhe ubonakale njengedivayisi ongahambisa imizila kuyo, futhi lokho kuyasiza ngempela. Kepha ayisusi umgomo nesimo esinquma okwenzekayo lapho iphakethe lifika lapho. Umzila unikeza igxathu elilandelayo futhi akukho okunye.
Uma idivayisi ikhona futhi umzila ukhomba kuyo kuyilapho kungekho nhlangano ehambisana nezikhethi zangaphakathi, iphakethe liyalahlwa, futhi akukho nani lokuhlela umzila elikhiqiza okhiye noma izikhethi. Hlola i-interface ngomthombo nendawo ekuyiwa kuyo efanayo naleyo oyihambisile, bese uqhathanisa lokho nohlu lwesimo.
Cacisa ubunikazi ngaphambi kokuhlela noma yini
Udonga lomlilo lomsingathi lwengeza isinqumo sesithathu esingaziwa yizizindalwazi zombili. Umzila ofanele kanye nomgomo ohambisanayo kanye nenhlangano efakiwe kusengaphelela ephaketheni elilahlwayo, futhi uhlelo lubika isikhathi sokuphela kuphela. Qinisekisa ukuthi udonga lomlilo luvumela ithrafikhi evikelwe ngaphambi kokusola i-IPsec. Ukubamba kudivayisi yomhubhe nakwi-interface yomzimba kukhombisa ukuthi iphakethe lanyamalala ohlangothini luni lokubethela.
Ubunikazi bokuhlelwa bunquma ukuthi ukulungisa kwakho kuzosinda ekubuyiselweni yini. Ingxenye eyodwa ingafaka isimo kuyilapho enye ilawula imizila, futhi ukuhlela ngesandla kwesibili kuyasuswa lapho umhubhe ukhwela ngokuzayo. Shintsha ukuhlelwa komnikazi, bese ufunda futhi imibono yomibili; RFC 4301 igcina izizindalwazi ezimbili zihlukene lapho kufanele uchaze lokho kwehlukaniswa komunye umuntu.