AWS Site-to-Site VPN: waje, ciki da prefix na LAN

Rabe-rabe uku na adireshi suna rikicewa a VPN ɗaya ta AWS: abokan waje, hanyar /30 ta ciki da prefixes ɗin LAN da aka kare. Karanta su daga saitin da aka sauke.

Yawancin kurakurai a AWS Site-to-Site VPN kurakuran adireshi ne, kuma ana yin su kafin kowane fakiti ya motsa. Adireshin waje na tunel suna isa ga abokan IPsec, adireshin ciki suna samar da hanyar tafiyar da ke tsakanin su, kuma prefixes ɗin da aka kare su ne abin da wannan hanyar take domin shi. Kwafi wata rawa cikin wata, tunel zai tashi alhali babu abin da ake tafiyar da shi. Ga jerin karanta-duba-saita da nake amfani da su a ƙofar abokin ciniki ta BGP, tare da ƙimar da aka ɗauka daga saitin na'urar da aka sauke, ba daga ƙwaƙwalwar ajiya ba.

Rabe-rabe uku na adireshi, tunel ɗaya

Adireshin waje jama'a ne kuma na abokan IPsec ne: ɗaya ga kowane tunel a gefen AWS, da kuma asalin da ake iya samu na ƙofar abokin ciniki a gefenku, wanda aka daidaita da duk tsarin NAT da kuke da shi. Adireshin ciki na sirri ne kuma na hanyar tunani ne, wanda AWS ke rubuta shi a matsayin /30 wanda aka ɗauko daga 169.254.0.0/16. Waɗannan prefixes da aka kare su ne hanyoyin VPC, na gida ko na wucewa waɗanda kuke tafiyar da su kuma kuke sanar da su ta wannan hanyar.

Sanya prefix na LAN a matsayin adireshin fuskar tunel shi ne nau'i na gargajiya na wannan kuskure. Fuskar tana kama da an saita ta, ba a sanar da LAN ba, kuma ɓangaren gaba ba shi da hanya zuwa gare shi. Tunel ɗin ma yana iya wuce ping na cikinsa yayin da kowace sunan manhaja ke ƙarewa. Tushen zaɓuɓɓukan tunel ya lissafa ƙayyadaddun CIDR na ciki, har da adadin adireshin da dole ya fito daga gare shi.

Karanta ƙimar daga saitin da aka sauke

Sauke saitin don ƙirar na'urarka ta musamman daga haɗin, sannan ɗauki teburin adireshinta a matsayin tushen gaskiya. Console tana nuna ƙimar iri ɗaya ga kowane tunel: IP na waje, CIDR na ciki, da adireshin abokin BGP a gefen AWS. Tunel ɗin biyu abubuwa ne daban tare da ƙarshen waje daban da /30 na ciki daban, duk da cewa duka biyu suna ɗaukar hanyoyin da aka kare iri ɗaya.

aws ec2 describe-vpn-connections --vpn-connection-ids vpn-0123456789abcdef0 \
  --query 'VpnConnections[0].Options.TunnelOptions[].[OutsideIpAddress,TunnelInsideCidr]'
aws ec2 describe-customer-gateways --customer-gateway-ids cgw-0123456789abcdef0 \
  --query 'CustomerGateways[0].[IpAddress,BgpAsn]'

Idan fayil ɗin da aka sauke da console mai rai ba su daidaita, fayil ɗin ya tsufa. Sake saukewa maimakon gyara adireshi da hannu, domin rashin daidaituwa tsakanin ma'auratan ciki da maƙwabcin da aka saita na abokin, gazawar BGP ce ta shiru.

Gina hanyar tare da adireshin da ya dace a kanta

A ƙofar Linux tunel ɗin fuska ce ta VTI ko XFRM, kuma /30 na ciki yana kan wannan fuskar. Tunel biyu na nufin fuska biyu da maƙwabta BGP biyu, ɗaya ga kowane ƙarshen AWS. Ƙa'idar da AWS ke bugawa a cikin saitin na'urar da aka sauke tana sanya ƙofar sirri ta fatalwa a kan adireshin farko na kowane /30 na ciki kuma ƙofar abokin cinikinku a kan na biyu, don haka kuna ɗaukar adireshin mafi girma kuma kuna haɗin gwiwa da mafi ƙarami. Babu abin da ke buƙatar adireshin LAN a nan.

ip tunnel add tun0 mode vti local 203.0.113.10 remote 18.230.1.1 key 42
ip addr add 169.254.10.2/30 dev tun0
ip link set tun0 up mtu 1400
ip tunnel add tun1 mode vti local 203.0.113.10 remote 18.230.2.1 key 43
ip addr add 169.254.10.6/30 dev tun1
ip link set tun1 up mtu 1400

Idan fayil ɗin ƙirar na'urarka yana buga ma'aurata akasin haka, yi amfani da lambobinsa kuma ka riƙe ƙa'idar: adireshin da ke kan fuskar naka ne, adireshin abokin na AWS ne. Yin haka a juye yana samar da tunel wanda ba zai taɓa kaiwa Established ba, domin maƙwabcin da ka saita shi ne adireshin da fuskarka take da shi tuni.

Riƙe alama da maɓallin VTI daidai da abin da IKE daemon ke amfani da shi wajen ɗaure SA na yaro ga fuskar, in ba haka ba zirga-zirga na isowa kan tunel ba tare da fuskar da za ta sauka ba. Duba MTU da hanyar da kuma saitunan IKE daemon kanta maimakon kwafin lamba daga wani wuri.

Tabbatar da BGP kafin ka tabbatar da hanyoyi

Tashin IPsec yana tabbatar da cewa abokan sun amince da ƙungiyar tsaro kuma ba wani abu ba. Zaman BGP tattaunawa ce daban a kan hanyar ciki, don haka karanta yanayin maƙwabci da ƙididdigar prefixes, sannan ka kwatanta su da abin da ka yi niyyar sanarwa.

ip -s addr show dev tun0
vtysh -c 'show bgp summary'
vtysh -c 'show bgp neighbors 169.254.10.1'
vtysh -c 'show ip bgp neighbors 169.254.10.1 advertised-routes'

Yanayin Established tare da sifili prefixes da aka karɓa matsalar manufa ce ko sanarwa, ba matsalar tunel ba. Maimaita dukan binciken a tunel na biyu; tunel na farko mai aiki yana gaya muku cewa adireshin suna da tabbas, ba cewa an saita tunel na biyu ba kwata-kwata.

Bi fakiti da aka tafiyar da shi sannan ka tsaya

Da zarar zaman yana ɗaukar prefixes ɗin, gwada hanyar a duka biyun kwatance daga ƙofar: adireshin tushe, mataki na gaba, da manufar tsaro da ke ba da izinin zirga-zirga. Zaman BGP na iya tashi alhali takamaiman prefix ɗin da manhajarka ke buƙata an tace shi, an taƙaita shi, ko an nuna shi ga fuskar da ba daidai ba.

Reachability Analyzer kayan aiki ne na gefen AWS wanda ke ɗaukar tushe, wuri da hanya, kuma yana ba da rahoton wane ɓangare a cikin saitin da aka goyi bayan ya toshe shi. Yi amfani da shi don gwada hanyar daga VPC zuwa adireshin ƙofar abokin cinikinka, ba daga mai masaukin manhaja ba. Yana nazarin saiti kuma baya aika fakiti ta wata wutar bango ta gida, don haka ka raba hukuncinsa da ƙididdigar fuskarka da rikodin fakiti naka.

Rubuta ma'auratan waje, /30 na ciki, da prefixes ɗin da aka sanar ga kowane tunel a tebur ɗaya. Wannan tebur ne ke sa canji na gaba ya zama abin dubawa.

Labarai masu alaƙa