I-Windows ne-strongSwan: ukufanisa izinguquko ezine kusiphakamiso se-IKE
Isicikici esabiwe asanele lapho izinhlangothi zingavumelani ngeqembu lokushintshisana kokhiye. Qhathanisa zonke izinguquko ezine, bese usebenzisa inqubomgomo eyodwa yephrofayela enomkhawulo.
Izinhlangothi zombili zisekela i-AES, zombili zamukela i-SHA-256, futhi umhubhe awukhuphuki. Isiphakamiso sehlulekile engxenyeni okungekho owayiqhathanisayo, ngokuvamile iqembu lokushintshisana kokhiye. Le ncwadi yokuhola ifunda ukushintshisana kwangempela ngaphambi kokushintsha noma yini, isebenzisa inqubomgomo eyodwa enomkhawulo futhi ishiya indlela yokubuyela emuva ebuyisela amapharamitha angaphambili.
Funda ukwehluleka ngaphambi kokushintsha iqembu
«Iphutha lokufaniswa kwenqubomgomo» liyisifinyezo, hhayi ukuxilongwa. Kusho ukuthi asitholakalanga isiphakamiso esamukelekayo yizinhlangothi zombili, futhi akusho lutho mayelana nokuthi iyiphi ingxenye enqatshiwe. Kubheke njengesiqalo sophenyo hhayi njengobufakazi mayelana neqembu elithile.
Impendulo ivamise ukuba ohlangothini lweseva. Ilogi ye-strongSwan ezingeni elifanele ibala isiphakamiso esatholwa kuklayenti kanye nesiphakamiso esilungiselelwe ukusamukela, futhi umehluko phakathi kwezinhlu zombili usho ingxenye ehlulekile.
Ungacabangi ukuthi iklayenti linikela ngokushiwo iposi lakudala lesithangami. Iphrofayela esebenzayo kanye nenqubomgomo yayo efakiwe kunquma uhlu olunikelwayo, futhi ukwakhiwa kwe-Windows okubuyekeziwe kungase kunikeze isethi ehlukile kunaleya esesithombeni sesikrini osikopishayo.
Bhala zombili izinhlu phansi. Izikhundla ezine zenguquko neqembu elilodwa kuwuhlu olufushane, futhi ukuluqhathanisa umugqa ngomugqa kuthatha isikhathi esingaphansi kunanoma yisiphi isilingo. Izikhundla ezine kulula ukuzigcina emehlweni. Ifayela lelogi akunjalo.
Qhathanisa yonke inguquko, hhayi igama elilodwa elijwayelekile
Isiphakamiso se-IKE siqoqwana sezinqumo okumele zivumelane zonke. Ukubethela kuvikela ukuxoxisana, ubuqotho noma i-PRF kuyakuqinisekisa, futhi iqembu le-Diffie-Hellman lisungula impahla entsha yokhiye. Isiphakamiso esivumelana kwezimbili zokuqala futhi sehluke kwesithathu sisengamukeleki kuzinhlangothi zombili.
Izinkambu ezimbili ze-Windows ezididaniswa lapha zingezigaba ezihlukene. I-DHGroup isebenza ekushintshisaneni kokhiye kwe-IKE, kanti i-PfsGroup isebenza emfelandawonyeni wengane ovikela ithrafikhi. Ukushintsha eyesibili akukwazi ukulungisa ukwehluleka kweyokuqala.
Amagama amaqembu ayahluka phakathi kokusetshenziswa, futhi lokho kuwumthombo wodideki ohlukile. I-strongSwan ibhala i-modp2048 ne-ecp256 kanti i-Windows isebenzisa amagama okubala afana ne-Group14 ne-ECP256, ngakho ukuqhathanisa kumele kuhumushe ngaphambi kokuqhathanisa. Gcina inothi elamakholomu amabili anamagama womabili. Ngaleso sikhathi ukungafani okulandelayo kuzohlukaniswa ngemizuzwana.
| Transform | Windows parameter | strongSwan name | Failure it causes |
|---|---|---|---|
| Encryption | CipherTransformConstants | aes, aes256gcm and similar | No common proposal at all |
| Integrity or PRF | AuthenticationTransformConstants | sha256, sha512 and similar | Proposal rejected after encryption matches |
| Key-exchange group | DHGroup | modp2048, ecp256 | Exchange fails during key establishment |
| Child SA protection | PfsGroup | esp proposal groups | Tunnel negotiates, data association does not |
Sebenzisa inqubomgomo eyodwa ephelele nenomkhawulo
Ithuluzi elisekelwayo lephrofayela ye-IKEv2 yomdabu inqubomgomo ye-IPsec kuxhumano ngalunye, ebekwa njengento eyodwa hhayi inkambu ngenkambu. Yibuke kuqala, bese uyisebenzisa, futhi gcina amapharamitha angaphambili kurekhodi loshintsho.
Set-VpnConnectionIPsecConfiguration -ConnectionName "Northwind IKEv2" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -DHGroup ECP256 -PfsGroup ECP256 -WhatIfIsishintshi se--WhatIf sibuka ushintsho lwasekhaya kusengaphambili futhi asisebenzisi lutho. Lokho kuyasiza futhi ngesikhathi esifanayo kuwugibe oluvamile, ngoba ukubuka kuqala kufakazela kuphela ukuthi amapharamitha amukelekile ngokwesakhiwo solimi ku-cmdlet yasekhaya. Akusho lutho mayelana nokuthi isango lizosamukela yini isiphakamiso esivelayo.
Fanisa nobubanzi ngesikhathi usulapho. Uxhumano olusesitolo sabo bonke abasebenzisi ludinga ipharamitha efanele yabo bonke abasebenzisi, futhi ukuhlela iphrofayela yomsebenzisi ngamunye ngegama elifanayo lokubonisa kushintsha enye into umhubhe ongayisebenzisi.
Bese, ngaphambi kokuhlola, letha uhlangothi lwe-strongSwan esethini efanayo. Ushintsho oludidiyelwe ezinhlangothini zombili yilona kuphela uhlobo lwalokhu oluhlangana; ukushintsha uhlangothi olulodwa nokuphinda uzame kaningi kuveza ilogi egcwele ukwenqatshwa okufanayo.
Qinisekisa ukushintshisana nokuvuselelwa kokhiye ngokwehlukana
Uxhumano oluphumelelayo kuwukubona okukodwa, futhi ukuvuselelwa kokhiye kungenye. Ukuxoxisana kokuqala kwe-IKE kusebenzisa isethi eyodwa yamapharamitha, futhi umfelandawonye wengane othwala ithrafikhi ungase uxoxisane kabusha kamuva ngenqubomgomo yawo. Isimo esixhumayo bese siwa ngemuva kwesikhathi sivamise ukuba yicala lesibili.
ipsec statusall | grep -A6 "Northwind"
Get-VpnConnection -Name "Northwind IKEv2" | Format-List *Umyalo wokuqala ukhombisa umbono weseva ngemifelandawonye esunguliwe, kufaka phakathi i-SA yengane nempilo yayo esele. Owesibili ukhombisa lokho iphrofayela yeklayenti ekubambile manje, futhi yilona kuphela indlela yokuqinisekisa ukuthi inqubomgomo oyibekile yiyo inqubomgomo esebenzayo.
Qaphela ukuvuselelwa kokhiye okuphelele ngaphambi kokumemezela impumelelo. Lokho kusho ukushiya uxhumano lukhuphukile isikhathi esanele ukuze umfelandawonye wengane ushintshwe, bese uqinisekisa ukuthi ithrafikhi iyaqhubeka. Iningi lokungafani kwenqubomgomo licashe kuleso sinyathelo, ngoba ukuxoxisana kokuqala kungaphumelela ngesethi ukuvuselelwa okungayamukeli.
Ukubuyela emuva yisethi yamapharamitha yangaphambili, hhayi indlela yokugcina evumelayo. Uma iklayenti linikele kuphela ngeqembu lakudala elibuthakathaka, impendulo iwukuthuthukisa inqubomgomo ehlanganyelwe yeklayenti neseva, hhayi ukwengeza lelo qembu esangweni lapho zonke izinhlangothi zesikhathi esizayo zingaxoxisana zehle kuze kufike kulo.
Rekhoda amapharamitha amane, iqembu, ububanzi boxhumano kanye nomphumela wokuvuselelwa kokhiye. Leli inothi elifushane, futhi yilo umehluko phakathi kwencwadi yokuhola nendaba yokuthi umhubhe wakhuphuka kanjani ngolunye usuku.