Inethiwekhi ye-Advanced Mesh VPN: Umhlahlandlela Ophelele Wamabhizinisi

Informatec Digital » Izinsiza » Inethiwekhi ye-Advanced Mesh VPN: Umhlahlandlela Ophelele Wamabhizinisi

Uma inkampani ikhula futhi isakazeka emahhovisi amaningi, kumasayithi amafu, kanye nezisebenzi ezikude , ukuxhuma konke ngokuphephile nangokushesha kuyayeka ukuba yinto yokuzikhethela futhi kuba yinto ebalulekile ebhizinisini. Ubuchwepheshe bendabuko be-VPN obuqondile buhluleka ekuguquguqukeni nasekubekezeleleni amaphutha, futhi yilapho i-VPN ethuthukisiwe ingena khona.

Lolu hlobo lokwakha luvumela isayithi ngalinye noma umthombo wethrafikhi ukuthi usungule imigudu ebethelwe ngqo nazo zonke ezinye izindawo , ugwema izithiyo endaweni eyodwa futhi unikeze ukutholakala okuphezulu, ukusebenza okuthuthukisiwe, kanye nokuhlanganiswa okungenamthungo nezindlela zesimanje ezifana nokungathembeki noma izindawo ezihlanganisiwe (ezindaweni + efwini). Kuyo yonke le ndatshana, sizochaza ukuthi la manethiwekhi asebenza kanjani, izidingo zawo zobuchwepheshe (i-IPsec, i-IKE, i-BGP, ama-router, kanye nama-firewall), nokuthi ahambisana kanjani nezixazululo ze-Wi-Fi zamanje kanye nezinsizakalo eziphethwe.

Iyini inethiwekhi ye-VPN ye-mesh ethuthukisiwe futhi ihluke kanjani kwamanye amamodeli?

I-VPN ye-mesh ethuthukisiwe iyi-topology lapho isayithi ngalinye lisungula khona imigudu ye-VPN nayo yonke enye isayithi , ngakho ukuxhumana phakathi kwanoma yimaphi amaphuzu amabili akuxhomekile ekutheni umuntu wesithathu atholakale noma asebenze njengomlamuleli. Lokhu kulungiselelwa kwaziwa nangokuthi i-mesh ephelele noma i-VPN ehlukanisiwe.

Esikhundleni somklamo we-hub-and-spoke wakudala (zonke izindawo zilenga kusuka ku-central hub), i-mesh ethuthukisiwe ikhetha ukwakheka okusatshalaliswe , okulungele uma izinsiza zisakazeke ezindaweni eziningana noma lapho kufiswa izinqubo zebhizinisi eziqinile eziqhubeka nokusebenza noma ngabe indawo eyodwa inezinkinga zokuxhumeka.

Esimweni esivamile, i-firewall ngayinye noma idivayisi yokuphepha—isibonelo, i -Firebox kusayithi ngalinye —idala imigudu ye-IPsec kwezinye. Uma ihhovisi lenkampani liwa, ihhovisi legatsha kanye nesikhungo sokusabalalisa ziyaqhubeka nokuxhumana ngqo nge-VPN, ngaphandle kokudlula endlunkulu.

Le ndlela ifanelana kahle namasu e-Zero Trust Network , lapho ukuphepha kuklanywe khona uma kucatshangelwa ukuthi noma iyiphi ingxenye yenethiwekhi ingahluleka noma ibe sengozini, futhi lapho ukubethela kusukela ekuqaleni kuya ekugcineni, ukuhlukaniswa, kanye nokuqina kubekwa phambili.

Amacala okusetshenziswa: kusukela ebhizinisini elinamasayithi amaningi kuya endaweni ehlanganisiwe enefu

Icala elivame kakhulu lokusetshenziswa kwe-VPN ye-mesh ethuthukisiwe yileso senhlangano enezindawo eziningi: isibonelo, indawo yokubeka indawo (i-Colo), indlunkulu yenkampani (i-Corp), isikhungo sokusabalalisa (i-Dist), kanye nehhovisi elincane elikude (i-RMT). Kulesi simo, isayithi ngalinye lidinga ukufinyelela okuqondile nokuphephile ezinsizeni zabanye.

Kulolu hlobo lomklamo, izinsiza ezihlukile zingaba khona kwenye yezindawo (isibonelo, i-ERP ebalulekile endlunkulu noma iseva yamafayela ebhizinisi ), ngakho-ke ukuxhumana okuthembekile phakathi kwazo zonke izingosi kubalulekile. Uma kunezelwa amahhovisi akude kakhulu, kuba kubaluleke kakhulu ukuthi uhlelo lusekele ukwengeza ama-node amasha ngaphandle kokuhlela kabusha konke.

Uma izinsiza eziningi zigxile endaweni eyodwa, ukwakheka okujwayelekile okuphakathi kusengaba nomqondo . Kodwa-ke, uma idatha nezinhlelo zokusebenza zisatshalaliswa, noma uma kunezinqubo zebhizinisi ezidinga ukuxhumana okuqondile phakathi kwamasayithi (isibonelo, ukuvumelanisa okuqhubekayo phakathi kwezikhungo zezokuthutha), inethiwekhi ehlanganiswe ngokugcwele inikeza ukuguquguquka okukhulu nokubekezelela amaphutha.

Isimo esivame kakhulu ukuhlanganiswa kwamanethiwekhi asezindaweni kanye nefu , isibonelo, ngokuxhuma amanethiwekhi asezindaweni ku-Azure nge-VPN Gateway kanye nokudala ukuxhumana kwenethiwekhi ebonakalayo yenethiwekhi-kuya-ebonakalayo (i-VNet-kuya-VNet). Kulezi zimo ezihlanganisiwe, ama-topologies e-mesh kanye nezindlela ezithuthukisiwe zokuphindaphinda kubalulekile ekuqinisekiseni ukuqhubeka kwesevisi.

Izingxenye ezibalulekile zobuchwepheshe zenethiwekhi ye-VPN ye-mesh ethuthukisiwe

Ngemuva kwelebula elithi “mesh VPN” kulele uchungechunge lwezingxenye zobuchwepheshe ezithile ezenza umlingo ube nokwenzeka. Ngokubanzi, sikhuluma ngezici zokuphepha ze-VPN ezithuthukisiwe njenge-IPsec yokubethela idatha kanye ne-IKE (Internet Key Exchange) yokushintshana ngokhiye kanye nokuxoxisana ngamapharamitha okuphepha phakathi kwama-endpoints.

Ku-Firebox evamile noma olunye ulungiselelo lwe-firewall lwesizukulwane esilandelayo, isayithi ngalinye lichaza amasango amagatsha kanye nemigudu exhuma kumanethiwekhi amanye amasayithi. Isibonelo, enhlanganweni enezindawo ezine, isayithi ngalinye lizoba namasango amathathu e-VPN amagatsha kanye nemigudu emithathu ehlobene (eyodwa kuya kwesinye isayithi).

Ukucushwa kuvame ukuphathwa ngamathuluzi athile (njenge-Policy Manager ku-Fireware), lapho ungabuka futhi ulungise khona amasango egatsha kanye nemigudu ye-VPN yegatsha , kanye nemizila yemigudu edingekayo ukuze ithrafikhi ihambe phakathi kwama-subnet endawo nakude.

Imininingwane ebaluleke kakhulu ezimweni zokuxhumana nge-mesh ukusetshenziswa kwama -subnet ahlanganisiwe lapho kuchazwe imizila yemigudu esikhundleni sokufaka uhlu lwenethiwekhi ngayinye yendawo ngokwahlukana. Isibonelo, umhubhe "we-Colo kuya ku-RMT" ungachazwa ngokusebenzisa i-subnet engu-172.16.0.0/16 ukumela wonke amanethiwekhi angaphakathi e-Colo (isb., 172.16.1.0 kanye no-172.16.2.0), ukuze umbhangqwana owodwa wemizila yemigudu ukwazi ukumboza izingxenye eziningi esikhundleni sokudinga imigudu eminingi.

Lokhu kunciphisa kakhulu inani lemizila yemigudu edingekayo, ikakhulukazi emahhovisi amancane adinga kuphela ukufinyelela isethi elinganiselwe yama-subnet akude. Kodwa-ke, uma kudingeka ukulawulwa kwethrafikhi okuncane kakhulu , amanethiwekhi ngamanye angachazwa, ngezindleko zomsebenzi owengeziwe wokucushwa kanye nokuphatha.

Izidingo zengqalasizinda: i-bandwidth, ihadiwe, kanye nokuthembeka

I-VPN ye-mesh ethuthukisiwe, ngokwencazelo, ifuna kakhulu kunokusetha okulula. Umhubhe ngamunye uhilela izinqubo zokubethela kanye nokufaka i-capsulation , ngakho-ke i-bandwidth esebenzisekayo ye-VPN izohlala ingaphansi kancane kwesivinini esibonakalayo sesixhumanisi.

Ngakho-ke, izinkampani kumele ziqinisekise ukuthi izixhumanisi phakathi kwamasayithi (i-fiber, i-MPLS, i-inthanethi enamandla aphezulu, njll.) zine -bandwidth eyanele ukusekela ithrafikhi ebethelwe ezogeleza ngemigudu. Lokhu kubaluleke kakhulu ezindaweni ezinezinsiza ezihlukile noma ezisebenza njengezindawo zokuxhumana.

Uhlobo lwedivayisi yokuphepha esetshenziswa endaweni ngayinye (isibonelo, i-Firebox efanele usayizi wesayithi; bheka amabhukwana e-router kanye nama-datasheet ) lubaluleke ngokulinganayo. Imodeli ngayinye inikeza isivinini esiphezulu se-VPN kanye nomthamo womhubhe ngesikhathi esisodwa, ngakho-ke ukuncisha lo mshini akunconywa uma kufanele kugwenywe izithiyo.

Ngokwezinto ezingokoqobo, inani lemigudu ye-VPN ngokuvamile lincike enanini lamanethiwekhi endawo nawakude okumele axhunywe (njengoba kuchaziwe emizileni yemigudu). Ehhovisi elijwayelekile, ukubalwa kulinganisa inani lamanethiwekhi endawo aphindaphindwe ngenani lamanethiwekhi akude, ngaphandle kokuthi kusetshenziswa ama-subnet ahlanganisiwe.

Kubalulekile futhi ukuqinisekisa ukuxhumana okuthembekile kumasayithi aphethe izinsizakalo ezibalulekile. Nakuba ukwakheka kwe-mesh kubekezelela ukwehluleka kwe-node ehlukanisiwe, uma leyo node iqukethe izinhlelo zokusebenza ezibalulekile noma idatha, noma iyiphi inkinga yokuxhumana ngaleso sikhathi izoholela ekunqamukeni kwesevisi kwezinye izindawo.

Amaphrofayili e-IPsec, i-IKE kanye nokuphepha: inhliziyo ye-VPN

Inethiwekhi ye-VPN ye-mesh ethuthukisiwe incike, ezingeni lephrothokholi, ekuhlanganisweni kwe- IPsec yokubethela idatha kanye ne-IKE (Internet Key Exchange) yokushintshaniswa kwezihluthulelo kanye nokuxoxisana ngamapharamitha okuphepha phakathi kwama-endpoints.

I-IKE yiphrothokholi esungula i-Security Association (SA) phakathi kwamaphuzu amabili; okungukuthi, isivumelwano esivumelanayo sokuthi ithrafikhi izobethelwa futhi iqinisekiswe kanjani. Ukuze i-VPN isebenze ngokwethembeka, izinqubomgomo ze-IKE zazo zombili izinhlangothi kumele zifane kuzo zonke izinhlaka ezifanele (indlela yokuqinisekisa, ama-algorithms okubethela kanye nokuqinisekisa, amaqembu e-Diffie-Hellman, isikhathi sokuphila, njll.).

Kuma-router afana ne-Cisco RV110W, inqubomgomo ye-IKE ichazwa, phakathi kwezinye izinto, imodi yokushintshana (eyinhloko noma ebukhali), i-algorithm yokubethela (i-DES, i-3DES, i-AES-128, i-AES-192, i-AES-256), i-algorithm yokuqinisekisa (i-MD5, i-SHA-1, i-SHA2-256), ukhiye owabiwe ngaphambilini, kanye neqembu le-Diffie-Hellman (isibonelo, iqembu 1 lama-bits angu-768, iqembu 2 lama-bits angu-1024, noma iqembu 5 lama-bits angu-1536).

Ngaphezu kwenqubomgomo ye-IKE, kuchazwa izinqubomgomo ze-VPN ezinquma ukuthi iyiphi ithrafikhi evikelwe ngomhubhe, yiziphi izihlonzi zenethiwekhi ezisetshenziselwa iziphetho zendawo nezikude (ikheli elilodwa le-IP noma i-subnet), nokuthi ngabe inqubomgomo izenzakalelayo (ngokuxoxisana kwe-IKE ngezihluthulelo namapharamitha) noma ngesandla (zonke izihluthulelo ne-SPI kulungiselelwe ngesandla kuzo zombili iziphetho).

Izinqubomgomo ezenziwe ngesandla zichaza amanani e-hexadecimal e-SPI engenayo nephumayo, okhiye bokubethela (Ukungena Nokungena Nokungena) kanye nama-algorithms obuqotho (MD5, SHA1, SHA2-256), okuqinisekisa ukuthi idivayisi ekude isebenzisa amanani afanayo ukuze umhubhe usungulwe kahle.

Amaphrofayili athuthukile: “Kudingeka i-IPsec”, “i-IPsec ongayikhetha” kanye nokususa ithrafikhi

Ezindaweni zenethiwekhi ye-mesh eziyinkimbinkimbi kakhulu, ngaphezu kokucushwa okuvamile kwemigudu phakathi kwamasayithi, amaphrofayili okuxhumana athuthukisiwe avame ukudalwa anquma ukuthi ukusetshenziswa kwe-IPsec kuyimpoqo nini nokuthi kuvunyelwe nini ithrafikhi ecacile.

Isibonelo, amaphrofayili amathathu angachazwa: elilodwa lapho i-IPsec iyimpoqo (kuvunyelwe ithrafikhi ebethelwe kuphela), elinye lapho ukubethela kungakhethwa khona (kungaba ukubethela noma ithrafikhi ecacile yamukelwa kuye ngokuthi uya kuphi), kanye nelesithathu elivumela kuphela ithrafikhi engabethelwe . Ezinhlelweni ezisekelwe ku-ipsec.conf, la maphrofayili achazwa ngamabhulokhi okuxhumana (conn) achaza uhlobo lokuxhumana (ukudlula noma ukuthutha), imodi yokuqinisekisa (isb., i-rsasig enezitifiketi), amapharamitha e-shunt uma kwenzeka ukwehluleka (ukulahla noma ukudlula), kanye nezinkomba eziya ezitifiketini ze-RSA kanye nezikhiye.

Isibonelo esijwayelekile ukuba nokuxhumeka kokudlula ngaphandle kokuqinisekiswa kwephrofayili ethi "Akukho IPsec", okunye ukuxhumana kokuthutha okunezinqubomgomo zokuqinisekisa isignesha ye-RSA kanye nokuqeda ukwehluleka kokuthi "kuyadingeka i-IPsec", kanye nokuxhumeka kokuthutha kwesithathu okunezignesha ze-RSA kodwa okunokuziphatha okuvumelekile (ukudlula) uma kwenzeka ukwehluleka "kwe-IPsec okukhethwayo".

Ukuhlanganisa la maphrofayili nemizila efanele kuvumela ukusetshenziswa kwamasu okuphepha aguquguqukayo , lapho ukugeleza okuthile okubalulekile kufanele kubhalwe ngemfihlo ngaso sonke isikhathi, kuyilapho okunye kungasakazwa ngombhalo ocacile kumanethiwekhi angaphakathi athembekile kakhulu, noma kusetshenziswe i-IPsec ngendlela enenzuzo lapho zombili izinhlangothi zikuvumela.

Ukucushwa kwenqubomgomo ye-VPN ngokuningiliziwe

Kunqubomgomo ngayinye ye-VPN, ngaphezu kwamapharamitha e-IKE, kuyadingeka ukucacisa ukuthi iyiphi ithrafikhi ezofakwa emhubheni . Amanethiwekhi omthombo nendawo okuyo avame ukukhethwa kusetshenziswa izihlonzi ezifana ne-"Single" (i-single host) noma i-"Subnet".

Uma kukhethwe "Okukodwa", inqubomgomo isebenza ekhelini elithile le-IP (isibonelo, iseva ethile). Uma kuchazwa "i-Subnet", inqubomgomo ihlanganisa uhla lwamakheli olunqunywa ukuhlanganiswa kwe -IP yenethiwekhi kanye ne-subnet mask ; amadivayisi avikelwe yi-VPN uma i-IP yawo iwela ngaphakathi kwalelo banga.

Uma kwenzeka izinqubomgomo ezenzakalelayo , ngaphezu kwesikhathi sokuphila se-Security Association (ngemizuzwana), kukhethwa ama-algorithm okubethela kanye nobuqotho, futhi i-Perfect Forward Secrecy (PFS) ivunyelwe ngokuzithandela ngeqembu elengeziwe le-Diffie-Hellman. Lokhu kunezela ungqimba lokuphepha ngokukhiqiza okhiye abasha beseshini abangaxhomekile kuphela kukhiye oyinhloko.

Kunoma yisiphi isimo, kumele kuqinisekiswe ukuthi izikhathi zokuphila, ama-algorithm okubethela, ama-algorithm obuqotho, amaqembu e-PFS, ngisho nenqubomgomo ye-IKE ekhethiwe iyahambisana kuzo zombili iziphetho zomhubhe. Ngaphandle kwalokho, ingxoxo izohluleka, noma umhubhe uzophahlazeka lapho i-SA iphelelwa yisikhathi futhi kwenziwa umzamo wokuxoxisana kabusha.

Ama-router asezingeni lochwepheshe avame ukunikeza izici ezengeziwe, njenge- Dead Peer Detection (DPD) , eqapha ukuthi untanga usasebenza yini futhi isuse okufakiwe okudala ukuze ikhulule izinsiza. I-DPD ngokuvamile ikuvumela ukuthi ulungise imvamisa yokuhlolwa kanye nesikhathi sokuvala ngaphambi kokucabangela untanga "ofile."

Ukutholakala okuphezulu efwini: I-Azure VPN Gateway ku-mesh ethuthukisiwe

Uma i-VPN ene-mesh ethuthukisiwe ixhuma amanethiwekhi asendaweni nengqalasizinda ye-Azure , i-Azure VPN Gateway kanye nezinketho zayo ezahlukene zokungasebenzi kahle kuyasetshenziswa. Ngokuzenzakalelayo, isibonelo ngasinye se-Azure VPN Gateway siqukethe izimo ezimbili ekucushweni okusebenzayo kokuma.

Uma kwenzeka ukulungiswa okuhleliwe noma izehlakalo ezingalindelekile, uma isenzakalo esisebenzayo singatholakali, isenzakalo sokulinda sithatha izintambo, bese imigudu yesayithi-kuya-endaweni (S2S) noma inethiwekhi ebonakalayo-kuya-endaweni ebonakalayo (V2N) ibuyiselwa ngokuzenzakalelayo. Uma kunqamuka okuhleliwe, ukululama kuvame ukuthatha imizuzwana eyi-10-15; uma kuhluleka okungahleliwe, kungathatha imizuzu eyi-1-3. Uma kuxhunywana namakhasimende e-VPN akhomba-kuya-endaweni (P2S), amaseshini ayanqanyulwa, futhi abasebenzisi kumele baxhumane kabusha.

Ukuze kuthuthukiswe ukutholakala kokuxhumana phakathi kwenethiwekhi yendawo ne-Azure, kungakhetha izinhlelo eziningana: kusetshenziswa amadivayisi amaningi e-VPN endawo (isibonelo, ukuba nama-VPN amabili afakiwe ), ukumisa izimo ze-VPN Gateway kwimodi esebenzayo ku-Azure, noma ukuhlanganisa kokubili ukuze kuphindwe kabili okuhambisana kahle ne-topology ye-mesh.

Ngamadivayisi amaningi e-VPN asendaweni, kwakhiwa ukuxhumana okuningana kwe-S2S kusuka kudivayisi ngayinye kuya ku-Azure gateway, okuchaza isango lenethiwekhi elihlukile lendawo ngedivayisi ngayinye, ngalinye linekheli le-IP lomphakathi elihlukile kanye nekheli lontanga le-BGP . Kusetshenziswa i-BGP kanye ne-Equal Cost Per Mechanism (ECMP), ithrafikhi isatshalaliswa emihubheni eminingi esebenzayo ngesikhathi esifanayo.

Kumodi ye-Azure VPN Gateway esebenzayo, instance ngayinye yesango inekheli layo le-IP lomphakathi futhi isungula umhubhe we-S2S IPsec/IKE kudivayisi ye-VPN esesimeni, yakha imihubhe emibili ehlobene noxhumano olufanayo. Kusukela ku-Azure, yomibili imihubhe isetshenziswa ngesikhathi esisodwa, okwandisa ukutholakala futhi kuvumela ukusatshalaliswa okungcono kwethrafikhi.

I-mesh ephelele phakathi kwendawo kanye ne-Azure: ukuphindaphinda okuphindwe kabili

Inketho eqinile kakhulu ye-VPN ye-mesh ethuthukisiwe ehlanganisa izindawo zamafu nezendawo ukuze usethe ukuphindaphindeka okubili : amasango asebenzayo e-Azure kanye, ngasikhathi sinye, amadivayisi amaningi e-VPN kunethiwekhi yezindawo. Umphumela uwuhlobo lwe-mesh ephelele enemigudu emine ye-IPsec phakathi kwenethiwekhi ebonakalayo ye-Azure kanye nendawo yezindawo.

Kulo mklamo, wonke amasango kanye nemigudu igcinwa isebenza ohlangothini lwe-Azure, futhi ithrafikhi isatshalaliswa kuzo zonke izixhumanisi ezine . Ukugeleza ngakunye kwe-TCP/UDP kuvame ukulandela umhubhe ofanayo ngokombono we-Azure, kodwa ukugeleza okuhlangene kusatshalaliswa kuzo zonke ezine, okuthuthukisa kancane ukusebenza okuphelele futhi, okubaluleke kakhulu, kunikeza ukubekezelelana kwamaphutha okuphezulu kakhulu.

Ukuze kusetshenziswe le topology, kudingeka amasango amabili enethiwekhi yendawo kanye nokuxhumeka okubili okuhlukene kwamadivayisi amabili e-VPN endawo, okuhlala kusekelwa yi- BGP ukuvumela ukuxhumana ngasikhathi sinye kunethiwekhi efanayo yasendaweni ngokuxhumeka okuningi.

Indlela efanayo ingasetshenziswa ekuxhumaneni kwenethiwekhi ebonakalayo phakathi kwenethiwekhi ebonakalayo ngaphakathi kwe-Azure: amasango asebenzayo adalwa kunethiwekhi ngayinye ebonakalayo futhi axhunywe komunye nomunye ukuze kutholakale nemigudu emine esebenzayo phakathi kwe-VNets. Kulesi simo, i-BGP ayiphoqelekile, ngaphandle kokuthi ithrafikhi yezokuthutha idinga ukuhanjiswa ngaleyo nethiwekhi.

Ngalolu hlobo lokwakha, amanethiwekhi amafu ayayeka ukuba amasathelayithi nje enethiwekhi yendawo futhi abe ama-node agcwele ngokugcwele ku-VPN mesh , enikeza ukuguquguquka okukhulu lapho kuhanjiswa umthwalo womsebenzi, kulinganiswa izinhlelo zokusebenza, kanye nokuklama izinhlelo zokuqhubeka kwebhizinisi.

I-Mesh Wi-Fi ne-VPN: inhlanganisela ephelele kunethiwekhi yebhizinisi

Umqondo we-"mesh" awugcini kuma-VPN kuphela. Emkhakheni we-Wi-Fi, izixazululo ezifana ne-eero kanye nobuchwepheshe bayo be-TrueMesh zikhombisile ukuthi ukusebenzisa izindawo zokufinyelela eziningi ezixhumene kuyindlela ephumelela kakhulu yokuqeda izindawo ezifile, ukunciphisa ukuyeka, kanye nokunciphisa ukuvinjelwa okwesabekayo ezindaweni zasekhaya kanye nehhovisi elincane.

Esikhundleni se-router eyodwa ye-Wi-Fi ezama ukumboza yonke indlu noma ihhovisi, inethiwekhi ye-Wi-Fi ene-mesh isabalalisa amadivayisi amaningi e-eero kuyo yonke indawo, okuvumela amaklayenti ukuthi ahlale exhumeka endaweni yokufinyelela eseduze futhi ezinzile kakhulu . I-TrueMesh iqondisa kabusha ngobuhlakani ithrafikhi ngokusekelwe ezicini ezifana nokuhlelwa okungokoqobo kwama-node, ukuphazamiseka okuvela kumanethiwekhi angomakhelwane, kanye nomthwalo wamadivayisi axhunyiwe.

Kuye ngokusetshenziswa kwe-inthanethi, kunconywa amamodeli ahlukene: i-eero 6+ njengohlelo lwe-gigabit olungabizi, i-eero Pro 6E yokuxhumeka okufika ku-2 Gbps kanye namadivayisi amaningi ngesikhathi esisodwa, noma i-eero Max 7 yabasebenzisi abathuthukile abane- wifi 7, amakhulu amadivayisi kanye nezidingo zokusebenza eziphezulu kokubili okunezintambo kanye nokungenantambo.

Zonke lezi divayisi ziyahambisana nabahlinzeki be-inthanethi abakhulu kanye nomunye nomunye, okuvumela ukwanda kancane kancane noma ukuthuthukiswa kwenethiwekhi ye-Wi-Fi . Ngaphezu kwalokho, zithola izibuyekezo zesofthiwe ezenzakalelayo ezinama-patches okuphepha kanye nokuthuthukiswa kwezici—iphuzu elibalulekile lapho i-Wi-Fi iyindawo yokufinyelela eyinhloko ye-VPN yenkampani.

Ikhaya ledijithali, ukuphepha kanye nokuphathwa okuphakathi nge-eero

Ngaphandle kokuxhumana okuyisisekelo, izinhlelo zesimanje ze-eero zihlanganisa izici zekhaya elihlakaniphile ngenxa yokuhambisana ne-Thread, Zigbee, kanye ne-Matter (kusetshenziswa i-Alexa njengesilawuli). Empeleni, lokhu kusho ukuthi amadivayisi amaningi ekhaya elihlakaniphile angaxhuma ngqo kunethiwekhi ye-eero ngaphandle kwesidingo sama-hub engeziwe.

Uhlelo lokusebenza lwe-eero likuvumela ukuthi ulungiselele idivayisi ye-Thread, isibonelo, ngokuvula inketho kuzilungiselelo zenethiwekhi → i-Thread , noma ukusebenzisa i-Zigbee hub ngokuhlanganisa ama-akhawunti akho e-eero kanye ne-Amazon ngaphansi kwesigaba se-Amazon Connected Home. Uma lokhu sekuqediwe, ungangeza amadivayisi ahambisanayo usebenzisa uhlelo lokusebenza lwe-Alexa noma yisiphi isipikha se-Echo kunethiwekhi.

Ukuphathwa kwansuku zonke, i-eero yenza ukuphathwa kwamadivayisi kube lula: ungabela amadivayisi kumaphrofayili ngamanye (ukuqoqa, isibonelo, amadivayisi elungu ngalinye lomndeni), usebenzise amashejuli okumisa i-wifi (awusizo kakhulu ekukhawuleleni ukusetshenziswa ngezikhathi ezithile) futhi uqambe kabusha kalula idivayisi ngayinye ukuze uyibone ngaphandle kokuhlanya.

Kungenzeka futhi ukuthi izaziso zikwazi ukuthola izexwayiso lapho idivayisi entsha ijoyina inethiwekhi, futhi kudalwe inethiwekhi yezivakashi ehlukile enegama layo nephasiwedi, ngaleyo ndlela kugcinwe inethiwekhi eyinhloko ihlukanisiwe futhi ilawulwa kakhudlwana.

Ngokuhambisana nezinsizakalo ze-VPN—njengokufinyelela kwe-VPN okufakiwe nge-Guardian ngaphakathi kokubhaliselwe kwe-eero Plus—umsebenzisi unesendlalelo esengeziwe sokubethela lapho exhuma kusuka kufoni yakhe ephathekayo noma kuthebhulethi kumanethiwekhi angaphandle, okuhambisana kahle nama-VPN amaningi ezinkampani.

Izinsizakalo zokuphepha ezengeziwe: i-eero Plus kanye ne-VPN yabasebenzisi bokugcina

Ukubhalisela i-eero Plus kunezela izici zokuphepha ezithuthukisiwe eziqondiswe kubasebenzisi kanye nezinhlangano ezincane: ukuvikelwa okuthuthukisiwe, izilawuli zabazali, i-inthanethi yokusekelayo , kanye nokuhlanganiswa nezinhlelo zokusebenza ezintathu ezaziwayo: i-1Password (umphathi wephasiwedi), i-Malwarebytes (ukuvikelwa kwe-malware), kanye ne-Guardian (isevisi ye-VPN).

Ngezihlungi zokuqukethwe, abazali bangachaza imikhawulo ngezigaba—ukuthenga, izinkundla zokuxhumana, izingxoxo kanye nemiyalezo, ukusakaza—ukuze amadivayisi athile abe nokufinyelela kokuqukethwe okufanele kuphela. Lolu hlobo lokulawula lusebenza kahle kakhulu ezindaweni lapho inethiwekhi ye-Wi-Fi mesh kanye ne-VPN yenkampani yabelana ngengqalasizinda efanayo yasekhaya.

Isici se-Backup Internet sivumela i-eero ukuthi ixhumeke ngokuzenzakalelayo ku-hotspot yeselula noma kwenye inethiwekhi etholakalayo lapho umhlinzeki oyinhloko evala, futhi ungakhetha ukuthi yimaphi amadivayisi ahlala exhunyiwe ngesikhathi sokungasebenzi ukuze uthuthukise i-bandwidth etholakalayo.

Endabeni yokuphepha komuntu siqu, ukuhlanganiswa ne-Malwarebytes kunikeza isivikelo ezinsongweni eziku-inthanethi kumadivayisi ahambisanayo afinyelela kwamathathu, kuyilapho i-1Password ihlinzeka ngokuphathwa okuphephile nokugcinwa kweziqinisekiso , okubalulekile lapho usebenza nokufinyelela kwe-VPN yenkampani, amaphaneli okuphatha, kanye nezinsizakalo zamafu.

Okokugcina, i-Guardian inikeza i -VPN egxile kumsebenzisi wokugcina , efinyeleleka ngqo kusuka kuhlelo lokusebenza lwe-eero, ebethela ithrafikhi kusuka kudivayisi (eselula noma ithebhulethi) kuya ku-inthanethi, ilungele ukuxhumana kusuka kumanethiwekhi e-Wi-Fi omphakathi noma angathembekile. Nakuba lolu hlobo lwe-VPN lungathathi indawo yenethiwekhi ye-mesh yenkampani ethuthukisiwe, luhambisana kahle nokuvikelwa komsebenzisi wokugcina.

I-VPN yesayithi nesayithi: izinsika zomklamo oqinile

Esimweni senkampani, yonke inethiwekhi ye-VPN ethuthukisiwe yakhiwe ngokuyisisekelo ngama -VPN amaningi ukusuka endaweni kuya kwenye . Ukuze lokhu kuxhumana kube okuqinile futhi kube lula ukusebenza ngezinga elikhulu, kubalulekile ukunakekela izingxenye ezinhlanu ezibalulekile.

Okokuqala ukuphepha kwezobuchwepheshe ezinkampanini : ukusetshenziswa kwama-algorithms aqinile e-cryptographic (i-AES enezinkinobho ze-128/192/256 bit, i-SHA-2), ukuphathwa kahle kwezinkinobho, i-PFS, i-DPD kanye nemikhuba emihle yokuqinisa kumadivayisi azungezile.

Insika yesibili kulula ukusebenza : izinqubomgomo ezihambisanayo kuzo zonke izindawo, amathempulethi okucushwa angasetshenziswa kabusha, amathuluzi okuphatha kanye nokuqapha ahlanganisiwe, kanye nezinqubo ezicacile zokwengeza izindawo ezintsha noma ukushintsha amapharamitha.

Okwesithathu ukukwazi ukukhulisa idatha kalula futhi ngokuphephile , okusho ukukwazi ukwengeza izindawo ngaphandle kokuklama kabusha yonke i-topology, ukusebenzisa amasu anjengokuhlanganiswa kwe-subnet, ukusetshenziswa kwe-BGP kokuhambisa idatha ngendlela enamandla, kanye nokwenza okuzenzakalelayo kokuthunyelwa kwedatha.

Izinsika ezimbili zokugcina ukuqhubeka kwebhizinisi — ukuqinisekisa ukuthi i-node noma ukwehluleka kwesixhumanisi akushiyi amasayithi ehlukanisiwe — kanye nokusetshenziswa okuguquguqukayo , okungukuthi, ikhono lokusebenzisa i-VPN ezindaweni ezahlukene (esimweni, efwini lomphakathi, emafwini amaningi) ngenkathi kugcinwa izinqubomgomo zokuphepha ezihambisanayo.

Izinsizakalo ze-VPN eziphethwe kanye nemikhiqizo yokuphepha ezinikele

Ezinhlanganweni eziningi, ikakhulukazi lezo ezingenalo iqembu elikhulu lokuxhumana kanye nezokuphepha ngaphakathi, ukusebenzisa izinsizakalo ze-VPN eziphethwe kungaba yisinqumo esinengqondo kakhulu. Lezi zinsizakalo zinikeza ezinye zezinkimbinkimbi: ukwakheka kwe-topology, ukukhethwa kwehadiwe, ukucushwa kwenqubomgomo ye-IPsec/IKE, ukuqapha amahora angama-24 ngosuku, impendulo yezehlakalo, kanye nokulungiswa okuqhubekayo.

Abathengisi bezokuphepha abafana neFortinet banikeza imikhiqizo nezinsizakalo ezizinikele zokwakha nokuphatha ama-VPN asuka endaweni eyodwa kuya kwenye kanye namanethiwekhi e-mesh athuthukile, ukuhlanganisa ama-firewall, i-SD-WAN, ukuhlolwa kwephakethe okujulile, ukuhlunga iwebhu, kanye nezinye izendlalelo zokuvikela. Ngale ndlela, i-VPN ayibe "ngumhubhe obethelwe" olula futhi iba yingxenye eyodwa yokwakheka kokuphepha okunezendlalelo.

Kumanethiwekhi amakhulu, anamasayithi amaningi noma amakhulu, lezi zixazululo zinciphisa kakhulu umthwalo wokusebenza: zikuvumela ukuthi uchaze izinqubomgomo zomhlaba wonke , uzisebenzise kumadivayisi amaningi, uphathe izitifiketi, izibuyekezo ze-firmware kanye nezinguquko zokucushwa ngendlela ehlelekile, futhi uthole ukubonakala okuphakathi kwesimo sawo wonke ama-tunnel.

Kungakhathaliseki ukuthi ukhetha ukuphathwa kwangaphakathi noma isevisi yangaphandle, isihluthulelo ukuthi i-mesh VPN ihambisane nenhlangano: ukusekela izindawo ezintsha, izinsizakalo ezintsha zamafu, ukwanda kwethrafikhi, kanye nezinguquko ezidingweni zokuphepha ngaphandle kokuba yisithiyo ebhizinisini.

Ukuklama nokusebenzisa i -VPN ye-mesh ethuthukisiwe kuhilela ukuhlanganisa ukwakheka okusatshalaliswe kumasayithi amaningi, ukucushwa okucophelelayo kwe-IPsec/IKE, amasu okutholakala kakhulu (kokubili endaweni kanye nasefwini), isisekelo se-Wi-Fi ye-mesh esithembekile, futhi, ezimweni eziningi, izinsizakalo zokuphepha ezengeziwe kanye nokuphatha. Ngokuhlanganisa zonke lezi zinto—kusukela kumaphrofayili “adingekayo/ongawakhetha e-IPsec” kanye nokuphindaphinda okusebenzayo kuya ku-BGP, izixazululo ezifana ne-eero Plus, kanye namapulatifomu ochwepheshe e-firewall—izinhlangano zingakha amanethiwekhi aphephile, anwebekayo, futhi abekezelela amaphutha axhumanisa amahhovisi, amakhaya, namafu ngaphandle kokudela ukusebenza noma ukuguquguquka.