Windows VPN Group24 kuya ku-MODP3072: iyiphi iqembu oyidingayo?
Izinombolo zeqembu ziyizinto zokubhaliswa kwerejista, hhayi ukuhlelwa ngosayizi. Hlanganisa igama namapharamitha alo, bese uhlola ukuthi yimaphi amaqembu angavezwa ipharamitha ye-Windows.
I-Group24 ne-MODP3072 zombili zingamagama eqembu lokushintshana kokhiye, futhi azilona iqembu elifanayo elinamandla ahlukene. I-Group24 ihlanganisa i-modulus yamabhithi angu-2048 neqembu elincane lokuhleleka kokuqala okungamabhithi angu-256, kuyilapho i-MODP3072 iyiqembu 15 lamabhithi angu-3072. Ukukhetha elinye lapho okunye kucacisiwe kushintsha imfuneko esikhundleni sokuyifeza. Izinto ezine zinquma umphumela, futhi akukho nokukodwa kuzo okudinga ukwethemba igama elibonakala lifana.
Inombolo iyinto yokubhaliswa kwerejista, hhayi izinga
I-IANA inombola amaqembu okushintshana kokhiye ngokulandelana okubhaliswe ngakho, ngakho inombolo enkulu isho into yokubhaliswa kwerejista yakamuva hhayi iqembu elinamandla kakhulu. Iqembu 14 i-MODP yamabhithi angu-2048, iqembu 15 i-MODP yamabhithi angu-3072, futhi iqembu 24 lihlanganisa i-modulus yamabhithi angu-2048 neqembu elincane lokuhleleka kokuqala okungamabhithi angu-256. Ukufunda isihlonzi njengokuhlelwa kosayizi kukhiqiza kanye lelo phutha lokuthatha u-24 njengomkhulu kuno-15. Igama liyilebula, futhi amapharamitha angemuva kwalo yiwona asetshenziswa yizingxoxo ngempela.
| IANA group | What the group is | Expressible as Windows DHGroup | What a mismatch looks like |
|---|---|---|---|
| 14 | A 2048-bit finite-field modulus | Group14 | The gateway reports modp2048, which is the same group in other vocabulary |
| 15 | A 3072-bit finite-field modulus | Not in the documented enumeration | You cannot request it from this parameter; a gateway reporting modp3072 was configured elsewhere |
| 24 | A 2048-bit modulus with a 256-bit prime-order subgroup | Group24 | The gateway reports modp2048s256, so the two names differ while describing one group |
| 20 | The NIST P-384 curve | ECP384 | The gateway reports ecp384, and that 384 counts a field size rather than a modulus |
Amaqembu kumajika e-elliptic angeza ukudideka kwawo, ngoba inani lamabhithi ejika lichaza insimu hhayi i-modulus. Ukuqhathanisa i-P-384 neqembu lensimu elinganiselwe lamabhithi angu-3072 njengokungathi izinombolo zikala into eyodwa akukutsheli lutho.
Okuvezwa ukubalwa kwe-Windows
Irejista ye-IKE nepharamitha yeklayenti ye-Windows ziyizixhumanisi ezihlukene ezinamagama ahlukene. Incwadi yereferensi ye-cmdlet ye-VpnClient yakwa-Microsoft ibhala ukuthi i-DHGroup yamukela i-None, i-Group1, i-Group2, i-Group14, i-ECP256, i-ECP384 ne-Group24. I-Group15 ayiveli kulelo sethi elibhaliwe, okusho ukuthi ipharamitha ayikwazi ukuveza iqembu obuziwe ngalo. Lona umkhawulo wesixhumanisi, hhayi isitatimende mayelana nokuthi yimaphi amaqembu asekelwa i-protocol.
Ukuhlinzeka ngokupela okungafakiwe ohlwini, inombolo ephelele noma umucu wenqubomgomo okopishiwe akukhulisi ukubalwa. Hlola ireferensi yenguqulo ye-Windows oyisebenzisa ngempela, futhi uma iqembu lingatholakali, umphumela othembekile uwunye umgomo ogunyaziwe noma elinye iklayenti.
Hlukanisa i-DHGroup, i-PfsGroup nohlobo lwesitifiketi
I-DHGroup ikhetha iqembu lokushintshana kokhiye kwe-IKE, futhi i-PfsGroup ilawula ubumfihlo bokuya phambili kwezinhlangano zethrafikhi evikelwe ezilandelayo. Lezi zinkambu ezihlukene, ngakho ukusetha eyodwa ngendlela efanele akusho lutho ngenye. Ukhiye we-RSA noma we-ECDSA wesitifiketi uyisici sesithathu, futhi ungokweqiniso hhayi ukushintshana kwesikhashana. Ngakho iphrofayela eyodwa ingaba ilungile kwisendlalelo esisodwa futhi ingalungile kwesinye, futhi uxhumano oluphumelelayo ngeke lwembule ukuthi yikuphi.
Imibiko yokuthi uhlobo oluthile lwesitifiketi luphoqelele iqembu le-ECP kukho konke ukuxhumana kwe-IKEv2 ichaza inhlanganisela eyodwa yezilungiselelo. Ayisikhi isimiso se-protocol, futhi ukuzithatha njengesimiso yiyo indlela okungavamile kwendawo okuba umgomo ngayo.
Funda iqembu okwaxoxiswana ngalo yisango
Imojuli ye-VpnClient inikeza i-Set-VpnConnectionIPsecConfiguration njengesixhumanisi sokubhala kuphela, futhi akukho Get- cmdlet ehambisanayo efunda leyo nqubomgomo ibuyela kumphathi. Bhala amanani e-DHGroup ne-PfsGroup owawasebenzisa, bese ufunda esangweni ukuthi ukushintshana kwasebenzisa ini ngempela. Sebenzisa imiyalo ngemva koxhumano olusha hhayi ngemva kokuxhuma kabusha okusebenzise kabusha inhlangano endala.
swanctl --list-sas
ipsec statusallIphrofayela ebika i-Group24 kuyilapho isango libika i-modp2048s256 iyahambisana, ngoba bayiqembu elilodwa emagameni amabili. Isango elibika i-modp3072 kuyilapho iphrofayela ithi i-Group24 alihambisani, futhi uhlangothi olulodwa alugcini lokho okukholelwayo. Umugqa wesitifiketi uphendula umbuzo weqiniso ohlukile, futhi inkambu ye-PFS iphendula owesithathu. Qhathanisa zontathu ngaphambi kokubhala inothi lokuhambisana.
Bhala iqembu eliceliwe, iqembu okwaxoxiswana ngalo kanye nesixhumanisi esamukele noma esenqabile isilungiselelo. Lezi zinto zintathu yizo ezidingwa umhloli, futhi akukho lutho kuzo olungaqagulwa egameni lenqubomgomo.