ASA identity NAT da IOS NAT keɓewa don zirga-zirgar VPN

Wani reshe yana riƙe da PAT na intanet da VPN na site-to-site a kan ƙofa ɗaya ta Cisco, kuma VPN ɗin ya daina aiki da zarar an ƙara NAT. Adiresoshin da ke cikin ramin ba su dace da abin da crypto ACL ke karewa ba, ko kuma abokin ya ga adiresoshin da aka fassara wanda ba shi da hanya zuwa gare su. Cisco yana warware wannan a wurare biyu: ASA yana zaɓar dokar NAT da ke mai da adireshi zuwa kansa, yayin da IOS ke riƙe da kwararar a wajen dokar fassara ta hanyar deny a cikin ACL. Dukansu suna kiyaye ainihin adiresoshin, kuma babu ɗayansu da ke tsallake aikin NAT.

Yi rikodin kwararar kafin ka zaɓi doka

Fara da rubuta kwararar da kake tsammanin karewa: tushen LAN, makoman nesa da ainihin jerin adiresoshin da manufar IPsec ke karewa. Yi haka kafin ka gyara doka, domin wannan jerin yana nuna wace mai rarraba ko wace dokar NAT ya kamata ta dace.

Sa'an nan nemo dokar da ta dace da gaske, ba wadda ka yi niyya ba. A kan duka dandamali ana auna NAT cikin tsari, kuma dokar da ta gabata na iya yin nasara kafin a duba keɓewarka. Keɓewa da ta yi kama da daidai amma ta sha kaye ga wata doka ba ta taɓa ba da fakitin da ake tsammani ga manufar kariya ba. Alamar iri ɗaya ce da keɓewar da ba ta nan, don haka dole a karanta tsarin dokoki kafin a canza saitin.

ASA identity NAT doka ce, ba tsallakewa ba

A ASA, identity NAT dokar NAT ce wadda adireshinta da aka fassara yake daidai da na asali. Ana zaɓe ta kamar kowace doka kuma har yanzu tana saka shigarwar fassara, don haka fakitin ba ya tsallake aikin NAT. Abin da ke canzawa shi ne adiresoshin a kan waya suna zama ɗaya, kuma abin da manufar IPsec ke buƙata ke nan.

nat (inside,outside) source static LAN-NET LAN-NET destination static REMOTE-NET REMOTE-NET

Interfaces ɗin dokar da saitinta na route-lookup dole su dace da tsarin tura. Dokar da ke mai da adireshi daidai amma aka yi amfani da ita a kan interface biyu marasa kyau ba za a zaɓe ta don kwarararka ba. Route-lookup yana yanke hukunci ko za a yi wa fakitin da aka fassara hanya ko a yi amfani da makomar asali, kuma hakan yana yanke hukuncin ko zirga-zirgar dawowa za ta dawo ta ramin.

Shiga na gudanarwa zuwa ASA kanta wani lamari ne daban. Idan kana amfani da identity NAT don zirga-zirgar gudanarwa, buƙatar route-lookup da ta danganta da fitowar tana aiki, kuma keɓewar faɗi da aka kwafa daga misalin VPN ba za ta gyara SSH ba.

Deny a cikin NAT ACL na IOS yana nufin ba a zaɓe shi a nan ba

A IOS, ana tafiyar da NAT na intanet da jerin tushe, kuma wannan ACL mai rarraba ne, ba tacewa ba. Layin permit yana zaɓar zirga-zirga don fassara; layin deny yana nufin ba a zaɓi fakitin a nan ba. Wannan deny ba umarnin jefar da fakitin ba ne kamar deny a cikin ACL na interface.

Ba a zaɓe shi a nan kuma ya fi ƙunci fiye da ba a taɓa fassara shi a ko'ina ba. Wata dokar NAT, wani interface ko route-map na iya yin fassarar kwararar har yanzu, don haka dole a karanta dukan teburin NAT. Fakitin kuma yana buƙatar hanya, crypto ACL da ya dace, da izini a ainihin iyakokin sarrafa shiga.

Tsarin IOS mafi ƙanƙanta yana ajiye deny a sama da permit a cikin jeri ɗaya kuma yana nuna dokar overload zuwa wannan jerin. Sannan crypto ACL yana kare jerin da deny ya keɓe daga fassara.

ip access-list extended NAT-ACL
 deny ip 10.10.0.0 0.0.0.255 192.0.2.0 0.0.0.255
 permit ip 10.10.0.0 0.0.0.255 any
ip nat inside source list NAT-ACL interface GigabitEthernet0/1 overload

Tambaya ɗaya da za a iya gwadawa ga duka samfuran

Duka samfuran suna amsa tambaya ɗaya: wace doka ta dace da wannan kwararar, kuma waɗanne adiresoshi suka bar interface? Ka ɗauki hoto a interface na waje ka kwatanta adireshin tushe kafin da bayan ƙofar. Sannan ka duba yadda abokin yake ganin ramin, domin SA na iya kasancewa a tsaye yayin da ake fassara kwararar da aka kare a wani wuri.

A ASA nuna nat detail da teburin fassara; a IOS nuna ip nat translations da ma'aunin ACL da suka dace. Dokar da ba ta taɓa ƙaruwa ba ba a taɓa zaɓe ta ba, kuma hakan yana nuni ga tsari, interface ko alkibla maimakon saitin crypto.

Inda saitin yakan yi kuskure

Kuskuren da suka zama ruwan dare na inji ne. Deny yana ƙasan permit kuma ba ya taɓa dacewa. Ana amfani da mai rarraba a alkibla marar kyau, don haka ana fassara kwararar dawowa. Dokar identity tana rufe adiresoshi daidai amma interface biyu marasa kyau. Crypto ACL yana kare yankin da bai dace da abin da dokar NAT ke gabatarwa ba.

Yi rikodin jerin adiresoshin asali da wanda aka gabatar kusa da mai dokar, domin injiniya na gaba ya ga dalilin da mai rarraba ke ƙin fassara yayin da katangar wuta ke ba da izinin aikace-aikacen. Ka riƙe wannan a tikitin canji, ba a bayanin sirri ba. Sannan sake gudanar da kwararar bayan kowane canjin NAT, domin tsarin dokoki wani ɓangare ne na saitin ko da rubutun dokar bai canza ba. Ramin da ya tashi ba hujja ba ce cewa adiresoshin sun tsira; sai fakitin da aka ɗauka da kallon abokin bayan cire rufin.