ASA VPN hairpin: tafiyar da tunnels biyu ta hanyar interface ɗaya

Wani mai amfani mai nisa yana haɗawa da ASA, yana neman host a bayan reshe, kuma ASA na aika wannan buƙatar ta interface ɗin da mai amfanin ya shigo da ita. Babu wani abu a cikin haka da ke buƙatar tashar jiragen ruwa ta biyu ta zahiri. Abin da yake buƙata shi ne shawara huɗu masu zaman kansu waɗanda mutane sukan haɗa su zuwa ɗaya: izinin yin hairpin, tunnel da ke kare adiresoshin da suka dace, manufar NAT da ke kiyaye tushen da ka yi alkawari, da manufar shiga da ke ba da izinin sabis ɗin.

Fakiti ɗaya, tunnels biyu

Bi hanyar kuma tsarin ayyukan ya daina zama abin asiri. Fakiti ɗin yana shiga cikin tunnel ɗin shiga mai nisa, ana buɗe shi daga ɓoye, kuma ya zama fakiti na IP na yau da kullum wanda tushensa daga rukunin abokan ciniki ne. Sannan ASA na tafiyar da shi, yana daidaita shi da crypto ACL na site-to-site, yana sake ɓoye shi kuma yana aika shi ta interface ɗin waje zuwa reshe.

Adiresoshin da ke ƙasa misalai ne, amma siffar tana da muhimmanci: tushen shine rukunin, ba LAN na cikin ASA ba.

remote client 10.77.0.20
  -> remote-access tunnel, terminated on ASA outside
  -> decrypted, routed, matched against site-to-site policy
  -> site-to-site tunnel, sent from ASA outside
  -> branch host 10.60.20.10

Abubuwa biyu suna biyo baya. Abokin ciniki yana buƙatar hanya don prefix na reshe ta hanyar haɗin shiga mai nisa, wanda ke nufin split-tunnel ko jerin hanyoyin da aka tura dole su haɗa da ita. Kuma reshen dole ya san yadda zai mayar da harkar zuwa 10.77.0.20 ko zuwa adireshin da tsarin NAT ɗinka ya maye gurbinsa.

Izinin hairpin na duniya ne

Umarnin da mutane suke nema shine same-security-traffic permit intra-interface. Yana ba da izinin harkar shiga da fita ta interface ɗaya, wanda shine ainihin abin da wannan hanyar take buƙata. Hakanan saitin duniya ne: kunna shi yana canza halayen wasu magudanan ruwa waɗanda suka isa su bi interface ɗaya sau biyu.

Shi ya sa ya dace da rikodin canji maimakon zaman gyara kuskure. Tambayi menene kuma a cikin na'urar da zai iya bin hanyar interface ɗaya yanzu, kuma ko wani abu daga cikinsa ya kamata. A gefen da ke da cunkoso tare da cibiyoyin baƙi ko tunnels na abokan tarayya masu haɗuwa, amsar ba ta zama a'a kai tsaye ba. Rubuta dalilin kusa da saitin, domin injiniyan na gaba zai sami umarnin ba tattaunawar ba.

Iyakar kariya da NAT daban suke

Tunnel ɗin site-to-site yana kare duk abin da crypto ACL ɗinsa ya zaɓa. Idan wannan ACL ya ambaci subnet na cikin ASA a matsayin tushe, ba a kare rukunin shiga mai nisa ba kuma za a jefar da fakiti ɗin ko a aika shi a fili, gwargwadon halin dandalin ga harkar da ba ta dace ba. Ƙara rukunin cikin harkar da aka kare lokacin da tsarin ke kiyaye adiresoshin rukuni.

Sannan NAT yana yanke shawara ko adireshin rukuni zai tsira. Identity NAT yana kiyaye shi, kuma reshen yana ganin 10.77.0.20 a matsayin tushe. Fassarar tana canza yarjejeniyar: yanzu reshen yana mayar da harka zuwa adireshin da aka fassara, kuma dole ne manufarsa ta yarda da shi. Tsarin dokoki yana yanke shawara ko crypto ACL ya dace kafin ko bayan fassarar, don haka karanta hanyar da take aiki maimakon ɗauka wanda zai yi nasara.

Kada ka share ka'idojin PAT na intanet gabaɗaya don yin aiki ɗaya na wucewa. Keɓancewar da aka yi niyya ko dokar identity da aka yi da gangan ya fi sauƙin bayyanawa da janyewa fiye da rami a manufar fita.

Ɓoye ba izini bane

Tunnel ɗin da ke aiki yana tabbatar da cewa ɓangarori biyu sun yarda kan maɓallai da masu zaɓe kawai. Bai ce komai ba game da ko wannan mai amfani zai iya isa wancan sabis ɗin. Har yanzu tacewar VPN ko manufar ƙungiya da ke manne da haɗin shiga mai nisa dole su ba da izinin makomar reshe da tashar, kuma ACL ɗin interface a hanyar waje har yanzu yana aiki.

Gwada amsar a duka hanyoyi biyu. Haɗin da ya yi nasara yayin da sabis ɗin maƙwabta ya kamata ya kasa yana da ƙarin bayani fiye da ping ɗaya da ya yi nasara, domin yana nuna manufar zaɓaɓɓiya ce ba buɗaɗɗiya ba. Idan gwajin da ya kamata a ƙi ya yi nasara, ba tunnel ɗin ke da laifi ba; manufar ce. Ajiye duka sakamakon biyu a rikodin canji domin na gaba ya san wace hali aka yi niyya.

Hairpin ko interface na biyu

Hairpin transit yana kiyaye tsarin ƙanƙane kuma yana kashe saiti ɗaya na duniya. Wani interface daban, ko tunnel na tushen hanya da ke da nasa interface ɗin kama-da-wane, yana keɓe hanyar wucewa kuma yana ba ka manufa ta kowane interface, a kan farashin adireshi da wani crypto map ko profile. Babu wanda ya fi daidai; suna kasawa daban.

Tsare-tsaren tushen hanya wani tsari ne daban, ba akwatin zaɓi a cikin wannan saitin ba. Idan ka koma ɗaya, tattaunawar crypto ACL ta tushen manufa da ke sama ta daina aiki kuma teburin tafiyar da hanya ya fara yin aikin zaɓi.

Tabbatar daga ainihin abokin ciniki

Binciken da aka fara daga ASA yana da adireshin tushe daban kuma ba zai bi hanyar daga rukuni zuwa reshe ba. Yi amfani da packet-tracer don duba biyar-tuple, sannan buɗe ainihin haɗi daga ainihin abokin ciniki mai nisa, domin mai bin diddigin yana kwaikwayo kuma baya maye gurbin tafiyar da hanyar abokin ciniki da manufarsa.

Bayan canjin da aka tsara, haɗa da sabis ɗin da ya kamata ya yi aiki, sannan da wanda ya kamata a ƙi, sannan tabbatar da hanyar dawowa ta reshe. misalan Cisco na VPN hairpin NAT suna kiyaye izinin intra-interface, NAT da ACL a bayyane daban, kuma wannan shine tsarin tunani da ya cancanci yin kwafi.