Abokan cinikin VPN na ASA suna samun adireshi daga tafkin DHCP mara daidai

Karanta dhcp-server da dhcp-network-scope na ASA a matsayin filaye biyu daban, saita scope a kan adireshin da za a iya turawa a wajen tafkin, sannan tabbatar da hanyar.

Abokan cinikin AnyConnect suna fitowa a kan yankin da bai dace ba, ko uwar garken DHCP ya ƙi bayar da komai kwata-kwata, alhali manufofin rukuni suna kama da daidai a kallon farko. A kan ASA akwai filaye biyu a wurare biyu waɗanda dukansu suke kama da «daga ina adireshin ke zuwa», kuma saita wanda bai dace ba yana haifar da daidai wannan. Bayanin haɗin yana faɗin sunan uwar garken DHCP; manufofin rukuni suna faɗin yankin da wannan uwar garken zai zaɓa daga gare shi. Babu ɗaya daga cikinsu da ke ƙirƙirar tafki.

Abubuwa uku, tambayoyi uku

Da farko raba tsarin rabawa daga tafkin, domin tsarin biyu ba su raba saiti. Idan ASA da kansa yana raba adireshi, kuna ayyana tafki na gida kuma ku nuna manufofin rukuni zuwa gare shi. Idan uwar garken DHCP na waje yana raba su, bayanin haɗin yana faɗin sunan wannan uwar garken kuma manufofin rukuni suna ba da alamar scope. Haɗa su biyu shine dalilin da aka saba da shi na adireshin rashin bayyana.

IntentObjects involved
ASA allocates from its own poolip local pool plus the group policy's address-pool
External DHCP allocatesdhcp-server on the tunnel group, dhcp-network-scope on the group policy

Karanta ƙimar da ke aiki kafin canza ɗaya

Layin da aka tsallake ba daidai yake da none bayyananne ba. Saitin da ke gudana yana nuna abin da ka buga; show run all group-policy yana nuna abin da manufar ke warwarewa da gaske, gami da tsoffin ƙima da aka gada. Bincika duka biyu kafin ka yanke shawarar cewa scope ba daidai ba ne, domin manufofin rukuni da ke gado daga manufar tsoho na iya bayar da ƙimar da ba ta taɓa bayyana a cikin gajeren jeri ba.

show running-config group-policy RemoteStaff
show run all group-policy RemoteStaff
show running-config tunnel-group RemoteStaff
group-policy RemoteStaff attributes
 dhcp-network-scope ?

? ya cancanci karantawa a sigar da ka shigar, domin ƙimar da aka karɓa da rubutun taimakonsu sun bambanta tsakanin sigogi. Littafin jagora na Cisco ASA 9.24 don manufofin rukuni yana bayyana sifar a matsayin adireshin da za a iya turawa a yankin da ake so, a wajen tafkin rabawa, tare da fifita adireshin mu'amala. Ba iyakar tafkin ba ne, kuma ba lambar cibiyar sadarwa ba ce.

Saita scope a kan adireshi, ba a kan iyaka ba

A ce tafkin da kake so uwar garken ta yi amfani da shi shine 10.50.30.50 zuwa 10.50.30.200 a kan /24, kuma mu'amalar ASA a wannan sashe ita ce 10.50.30.1. Ƙimar scope ita ce 10.50.30.1. Rubuta 10.50.30.0 yana kasa domin ita ce lambar cibiyar sadarwa, kuma rubuta iyakar yana kasa domin sifar tana ɗaukar adireshi ɗaya. Idan adireshin da ka zaɓa ba adireshin mu'amala ba ne, yana buƙatar hanya ta tsaye domin amsar uwar garken DHCP ta isa gare shi.

group-policy RemoteStaff attributes
 dhcp-network-scope 10.50.30.1

Wannan guntun yana yin abu ɗaya kawai. Ba ya saita uwar garken DHCP, ba ya ƙirƙirar tafki a can, kuma ba ya mai da wani ɓangaren bayanin shiga nesa ya zama mai aiki. Halin da aka rubuta a nan IPv4 ne kawai; kada ka yi tsammanin zai jagoranci DHCPv6 ko ba da izinin prefix.

Canza shi da wurin juyawa

Ɗauki snapshot da farko, domin juyawa ya zama umarni maimakon sake ginawa. Ajiye saitunan da suka dace a cikin fayil kafin ka gyara, kuma ka san abin da no yake mayarwa a sigarka: yana mayar da sifar zuwa ƙimar tsoho ko wadda aka gada, wadda za ta iya kasancewa none maimakon manufar da ke samanta.

copy running-config flash:pre-dhcp-scope.cfg
conf t
 group-policy RemoteStaff attributes
  no dhcp-network-scope
  dhcp-network-scope 10.50.30.1
 end
write memory

Cire sifar mataki ne na ganowa kuma. Idan babu scope da aka ayyana, uwar garken DHCP tana neman adireshin da ba a raba ba a cikin tafkinta, don haka abokin ciniki na iya sauka a wani wuri da ba a zata ba amma aƙalla yana haɗi. Wannan sakamakon yana gaya maka cewa hanyar buƙatar tana aiki kuma zaɓin tafki ne ke kasa.

Tabbatar da adireshin, hanyar da izini

Karanta rabawa daga teburin zama ba daga tattaunawar abokin ciniki ba, sannan tabbatar cewa adireshin ana iya turawa zuwa ramin, kuma matatun manufofin rukuni suna ba da izinin zirga-zirgar da kake tsammani. Shawarar rabawa ba shawara ce ta turawa ba, kuma abokin cinikin da ya sami adireshi daga tafki mai kyau na iya kasa a kowace buƙata.

show vpn-sessiondb detail anyconnect filter name testuser
show ip local pool
show route | include 10.50.30
ping 10.50.30.61 source inside

Idan zaman yana nuna adireshin da ka nufa amma zirga-zirga ya mutu, scope ya ƙare a matsayin wanda ake zargi. Duba hanyar dawowa, saitunan split-tunnel ko matatun manufofin rukuni, da ko scope ɗin DHCP yana kan sashen da ASA ke turawa da gaske.

Labarai masu alaƙa