ASA hairpin: hanyar fita intanet ko ƙafar VPN tsakanin wurare?

Masu amfani biyu na isa daga nesa a bayan ASA ɗaya na iya aika zirga-zirga daga wajen waje ɗaya kuma su sami kulawa daban-daban. Ɗaya yana zuwa wani gidan yanar gizo na jama’a, don haka fakitin yana buƙatar fassarar tushe da hanyar intanet. Ɗayan kuma yana zuwa uwar garke a bayan ramin tsakanin wurare wanda shi ma yana ƙarewa a wannan wajen, don haka fakitin yana buƙatar asali, mai zaɓe na rami da ya dace da hanyar dawowa zuwa rukunin abokan ciniki. Izinin wajen ɗaya shine sharadi ga duka biyu kuma ba magani ga kowane ba.

Ƙafafu biyu, waje ɗaya

Yanke shawara wace ƙafa kuke ginawa kafin rubuta dokar NAT, domin dokokin ba sa musanya. Ƙafa A ita ce abokin ciniki zuwa intanet: adireshin rukuni yana shiga, adireshin jama’a da aka fassara yana fita, dawowa ta wannan wajen. Ƙafa B ita ce abokin ciniki zuwa wani prefix na sirri a wancan gefen wani abokin IPsec: ana kiyaye adireshin rukuni, ana sake rufewa, ana kaiwa ga abokin da ya san yadda zai amsa rukunin.

Abin da duka biyu suke buƙata da farko shine izinin wajen ɗaya. Idan babu shi ASA ta ƙi tura fakitin daga wajen da ya shigo, kuma gazawar tana kama da matsalar hanya maimakon matsalar manufa:

same-security-traffic permit intra-interface

Wannan layi ɗaya yana ba da izinin tsarin turawa, kamar yadda bayanin NAT na ASA ya bayyana don hanyoyin wajen ɗaya. Ba ya ƙara hanyar abokin ciniki, ba ya ba da izinin albarkatu, ba ya fassara adireshi kuma ba ya yin shawara kan mai zaɓe na IPsec, don haka yi tsammanin ƙara wasu abubuwa uku ko huɗu bayansa kuma kada ka karanta karɓarsa a matsayin ci gaba.

Ƙafa A: abokin ciniki yana son intanet

Don fitar intanet adireshin rukuni dole ya daina zama na sirri kafin fakitin ya bar na’urar. A tsarin PAT na yau da kullum doka tana fassara rukunin zuwa adireshin wajen waje, kuma yanayin dawowa yana maido da kwararar zuwa abokin ciniki:

object network VPN_POOL
 subnet 10.80.0.0 255.255.255.0
nat (outside,outside) after-auto source dynamic VPN_POOL interface route-lookup

Sannan tabbatar abokin ciniki ya nemi ASA da gaske ta ɗauki wannan zirga-zirga. Ƙin split-tunnel yana aika makomar jama’a ta hanyar haɗin wayar kanta, wadda ba ta taɓa isa ASA ba, kuma babu dokar NAT da za ta gyara fakitin da ba a taɓa aika ba. Kwatanta jerin split-tunnel na manufar rukuni da makomar da kuke gwadawa.

Sauran ƙafar na yau da kullum ne: hanyar da za a iya amfani da ita ta asali ko ta musamman daga wajen waje, manufar shiga da ke ba da izinin kwarara, da DNS da ake sarrafawa bisa manufar mai warware da kuka zaɓa. Ƙara route-lookup a nan don dalili ɗaya kamar yadda ke ƙasa, tunda wajen shiga da wajen fita ɗaya ne.

Ƙafa B: abokin ciniki yana son wuri na sirri

Wannan ƙafar tana gazawa a wurare da yawa, don haka rubuta ta cikin tsari. Da farko hanyar abokin ciniki: prefix ɗin makoma dole ya kasance cikin jerin split-tunnel, in ba haka ba abokin ciniki ba zai saka shi cikin rami ba. Na biyu mai zaɓe na rami: ACL na ɓoyewa tsakanin wurare dole ya rufe adireshin rukuni zuwa prefix mai nisa, ba kawai LAN na gida zuwa prefix mai nisa ba. Na uku asali, don kada a fassara adireshin rukuni cikin PAT na intanet a hanya.

nat (outside,outside) source static VPN_POOL VPN_POOL
    destination static SITE_PREFIX SITE_PREFIX route-lookup

Gefen nesa shine ɓangaren da mutane suke manta gwadawa. Abokin yana buƙatar hanya ta dawowa zuwa rukunin da mai zaɓe wanda ya haɗa da shi, kuma manufarsa dole ta ba da izinin adireshin tushe da zai gani. Idan ana amfani da wurin ta hanyar kallo da aka fassara, wannan ingantaccen tsari ne, amma sai duka abokan biyu, duka masu zaɓe biyu da duka teburin hanya biyu dole su yarda kan adireshin da aka fassara.

Duba tsarin dokoki kuma. Wata faffadan dokar PAT sama da dokar asali za ta fassara musayar sirri kafin a ma auna dokar asali, kuma alamar ita ce ramin wuri ba tare da SA da ya dace ba maimakon kuskuren NAT.

Gwajin da ke gaya muku wace ƙafa kuka gina

Yi amfani da kimanta hanyar ASA kanta maimakon karanta tsarin da fatan alheri. packet-tracer input outside tcp 10.80.0.25 40000 203.0.113.10 443 detailed yana nuna shawarar NAT, hanya da sakamakon ACL na kwarara ɗaya; maimaita da makoma ta sirri. Idan matakin NAT ya sake rubuta kwarara daga sirri zuwa sirri, kun gina ƙafa A don fakitin da ke buƙatar ƙafa B.

Wasu umarni biyu sun rufe rata. show nat detail yana buga tsarin dokokin da packet-tracer ya bi, kuma show crypto ipsec sa yana nuna ko akwai mai zaɓe don ma’auratan da kuke tsammani. Rashin SA batu ne na tsarin mai zaɓe ko abokin, ba wani abu da dokar NAT za ta iya gyara ba.

Tabbatar da kowace ƙafa da zirga-zirgar da take hidima

Karɓi ƙafa A da buƙatar jama’a ta yau da kullum daga abokin ciniki, kuma karɓi ƙafa B da buƙata zuwa albarkatun sirri da ke wanzu da gaske. Sannan maimaita kowace da albarkatun da aka ƙi, domin “an yarda” da “an amince da manufar shiga” ba shaida ɗaya ba ce, kuma ping da ke tasowa a cibiyar ba ya gwada ɗaya daga hanyoyin abokin ciniki.

Ka raba rikodin gwaji biyu a cikin tikitin: adireshin tushe, makoma, dokar NAT da ta dace, da sakamako. Lokacin da rahoto na gaba ya ce “VPN ya lalace”, wannan ma’aurata zai gaya muku cikin minti ɗaya wace ƙafa ta koma baya, kuma amsar yawanci hanya ce ko mai zaɓe maimakon layin wajen ɗaya da kowa ke zargi da farko.