I-VPN ye-Windows noma i-Cisco Secure Client: yikuphi okulungile?
Uphawu akulona igama lephrothokholi: i-Windows inikeza izinhlobo ezimbalwa zomdabu futhi i-Cisco client ithwala amaphrofayili emodi engaphezu kweyodwa. Funda iphrofayili.
Egangeni elifanayo kufika iziqondiso ezimbili: xhuma nge-VPN ye-Windows, noma fakela i-Cisco client. Akukho kuzo okusho ukushintshana okulindelwe yigede, ngoba i-Windows iveza izinhlobo ezimbalwa zokuxhumana zomdabu futhi i-Cisco client ithwala amaphrofayili emodi engaphezu kweyodwa. Womabili amalebula achaza isofthiwe, kuyilapho igede lixoxa ngephrothokholi, ukuqinisekisa kanye nenqubomgomo. Impendulo isephrofayilini, futhi ingafundwa ngaphandle kokuxhuma.
Ilebula lisho isofthiwe, hhayi ukushintshana
Uphawu nohlelo lokusebenza yizinto ezimbili ezihlukene, futhi akukho kuzo okukhetha ifomethi yocingo. I-Windows inikeza isethi yezinhlobo zomdabu, futhi i-Cisco client inikeza injini yamaphrofayili engaqhuba i-SSL noma i-IPsec/IKEv2. Ukuhlanganisa kokubili kukhiqiza amashadi aqhathanisa izinkampani esikhundleni sokushintshana.
Ithebula elingezansi lishintsha umbuzo womkhiqizo ngezindawo ezintathu zokufunda kanye nensimu egcinwa yileyo naleyo. Bhala lezo nsimu, futhi ukungaqondakali kuyanyamalala:
| Where to read it | Field name to record | What a mismatch looks like |
|---|---|---|
| Native Windows profile | TunnelType and AuthenticationMethod from Get-VpnConnection | The client offers IKEv2 while the gateway answers only on an SSL port |
| Vendor client profile | SSL or IPsec/IKEv2 mode, plus the client and headend version pair | The imported profile negotiates a mode this headend does not serve |
| Gateway configuration | Protocol, authentication policy and the certificate the headend presents | The client authenticates and then drops, because policy expects another method |
Isireferensi se-Microsoft sezinhlobo ze-VPN ze-Windows sibala i-IKEv2 ne-SSTP phakathi kwezinhlobo zomdabu, lokho kuqeda umqondo wokuthi iphrofayili yomdabu isho i-PPTP. Imibhalo yamaphrofayili ye-Cisco ichaza kokubili imodi ye-SSL nemodi ye-IPsec/IKEv2 ngenqubomgomo efanayo yekhanda. Umthengisi ngamunye unikeza izinketho ezimbalwa, ngakho alikho igama elikhomba iphrothokholi eyodwa.
Yini izinhlobo zomdabu ezikubeka ocingweni
I-IKEv2 ixoxa ngezinhlangano zokuphepha phezu kwe-UDP futhi ithwala ithrafikhi ngaphakathi kwe-IPsec, lokho kuyenza ilingane nezinye izinhlelo ze-IKEv2 hhayi idizayini ekhethekile ye-Microsoft. I-SSTP isonga i-PPP ngaphakathi kweseshini ye-HTTPS, ngakho idlula kumaproksi i-IKEv2 engakwazi ukuwadlula futhi ocingweni ibonakala njenge-TLS nakuba ingeyona iphrothokholi ye-TLS VPN. Lezi zinto ezimbili zichaza ingxenye enkulu yethikithi elibika ukuthi umhubhe uyasebenza kunethiwekhi eyodwa futhi uhluleke kwenye.
I-L2TP ne-IPsec kanye nokufakwa okudala kwe-PPTP kukumnu wokuhla ofanayo, futhi ukuba khona kwazo lapho akusho lutho ngokusekelwa kweseva. Umenu wokuhla uhlu lwalokho uhlelo lokusebenza olungakuzama, hhayi isitatimende samandla esivela egangeni. Ukulufunda njengohlu lokusekelwa yikho okuqala ukuzingela ubufakazi bemizuzu emibili.
Izinkambu ezibalulekile kuphrofayili yomdabu yizinhlobo zokuxhumana, indlela yokuqinisekisa kanye nobuwena beseva. Uhlobo olungalungile luhluleka esigabeni esihlukile kunephasiwedi embi, futhi lowo mehluko yiwona mkhondo ofanele ulandelwe.
Yini i-Cisco client eyengezayo: amaphrofayili, hhayi iphrothokholi
I-Cisco client iyisitsha samaphrofayili. Imodi ye-SSL nemodi ye-IPsec/IKEv2 iyahluka ekushintshaneni, ekulindeleni kwembobo kanye nombhalo wephutha, futhi iphrofayili engenisiwe ikhetha phakathi kwazo. Ngakho ukufakela i-client akufakazi lutho ngokufinyeleleka.
Izinguqulo zibhangqwa ngesizathu. Izici, imigudu yokuqinisekisa kanye nokuhlolwa kwesimo kuxoxwa phakathi kwe-client nekhanda, ngakho i-client endala ebhekene nekhanda elisha ingahluleka ngendlela efundeka njengokonakala kwenethiwekhi. Leyo mbhangqwana ingeyencazelo yokuxhumana, hhayi inothi lokuthuthukisa.
Iphrofayili ethunyelwe kwelinye inhlangano ayivamisile ukufana nekhanda lendawo, futhi ukuyingenisa kungashiya i-client inikeza imodi igede elingayisebenzi. Funda kuqala imodi kuphrofayili, bese uyiqhathanisa neprothokholi nenqubomgomo yokuqinisekisa ehlelwe egangeni. Kuphela lapho lezo zivumelana khona inethiwekhi iba umsolwa. Leyo ndlela yokulandelana yonga ukuthwebula iphakethe obekuzobonisa iseshini ye-TLS enempilo eqonde kunsebenzi ongafanele.
Funda iphrofayili yendawo ngaphambi kokushintsha noma yini
Ku-Windows ukuhlelwa komdabu kungafundwa ngaphandle kokushaya, futhi umphumela usho ngqo uhlobo nendlela yokuqinisekisa. Qhathanisa lawo manani nalokho umnikazi wegede akushoyo ukuthi ikhanda liyakwamukela. Uma uhlobo lungavumelani nethikithi, lungisa kuqala ithikithi, ngoba lokho kushibhe kunokufakela kabusha i-client engakaze ibe nephutha.
Le mitshoko emine ihlanganisa iphrofayili, imigudu yayo, umzamo wokuxhumana kanye nokufinyeleleka kwembobo. Yisebenzise ngalolo kulandelana emshinini osevele unephrofayili efakiwe:
Get-VpnConnection | Format-List Name,TunnelType,AuthenticationMethod,ServerAddress
Get-VpnConnection -Name 'Corp' | Select-Object -ExpandProperty Routes
rasdial
Test-NetConnection -ComputerName vpn.example.com -Port 443Ukuhlolwa kwembobo yikho okufundwa ngokweqile. Umsilaleli we-TCP 443 ohlinzeka ngekhasi lokungena kanye nomunye oqeda i-IKEv2 babonakala befana ngaphandle, ngoba imbobo iyindawo, hhayi iphrothokholi.
Bhala umphumela njengezinkambu ezintathu, i-client, imodi kanye negede, futhi uzibeke eceleni kwethikithi. Noma yini emfushane kushiya umuntu olandelayo ukuthi athole futhi ukungaqondakali okufanayo.