Azure wuri-zuwa-wuri yana haɗuwa amma babu wani ɓoyayyen albarkatu da ke amsawa

Haɗuwa yanayi ne na ramin, ba magana ba ce game da isa. Abokin ciniki na wuri-zuwa-wuri na iya kammala IKE, ya karɓi adireshi, kuma har yanzu bai isa komai ba, domin ƙofar tana tura zirga-zirga ne kawai don cibiyoyin da VNet ya riga ya sani. Yi waɗannan dubawa biyar a jere kuma tsaya a gazawar farko. Yin tsalle gaba shine yadda ake ɗaukar matsalar DNS a matsayin matsalar bangon wuta na awa ɗaya.

Jerin yafi muhimmanci fiye da lissafin.

Duba 1: yanke shawara abin da ramin zai ɗauka

Azure VPN Gateway yana ƙare ramin kuma yana tura zirga-zirgar da ta shafi VNet; bababbar hanyar fita ta intanet ba ce. Idan masu amfani suna tsammanin bincikensu zai fita ta Azure, ƙirar ba daidai ba ce kafin kowane saitin abokin ciniki ya shiga. Kunna split tunneling domin intanet na gida ya ci gaba da amfani da hanyar gida, kuma yi amfani da NAT instance ko ramin wuri-zuwa-wuri lokacin da ake buƙatar adireshin fita na dindindin da gaske.

Rubuta abin da abokin ciniki zai isa kafin ka gwada komai. Idan babu wannan lissafin, kowane sakamako na ɓangare yana kama da ci gaba.

Duba 2: kwatanta wuraren adireshi kafin takaddun shaida

Ana yin hukunci kan rikicewa ta mafi faffadan jeri, don haka cibiyoyi biyu da suka bambanta a matakin subnet har yanzu suna karo idan manyan tubalan suka zo tare. Subnet ɗin ƙofar dole ne ya zama na musamman kuma ya isa girma ga SKU, kuma tafkin adireshin abokin ciniki ba dole ba ne ya karo da VNet ko da wani abu da ake iya isa ta hanyar peering. Canza shirin kuma sake turawa, domin ƙara hanyoyi don ramawa yana haifar da ramin da ke aiki ga wasu wurare kuma ba tare da bayani ba ga wasu. Samarwa tana gazawa da ƙarfi a nan, wanda shine kyakkyawan yanayi.

Tabbatarwa ita ce ƙofa ta gaba. Bayanan takardar shaida, RADIUS da Entra ID ba sa musanya, kuma fakitin abokin ciniki ya bambanta ga kowanne.

Duba 3: warware suna na sirri daga ciki

Abokin ciniki yana riƙe da nasa mai warwarewa sai dai idan bayanin da aka sauke ya ɗauki sabar DNS na VNet, kuma ana saka wannan lissafin a lokacin saukewa. Ƙara forwarder a cikin VNet, saita shi a matsayin sabar DNS ta VNet, sannan sake saukewa da shigo da fakitin abokin ciniki. Sake amfani da tsohon fakitin yana gwada tsohon lissafin mai warwarewa ne kawai.

Gwada adireshi da farko, domin yana raba turawa da suna a mataki ɗaya: Test-NetConnection 10.20.1.4 -Port 3389.

Idan adireshin ya amsa kuma sunan bai amsa ba, tambayi mai warwarewa kai tsaye da Resolve-DnsName files.corp.example -Server 10.20.0.4. Idan duka biyu sun kasa, laifin ba na DNS ba ne kuma ya kamata ka daina gyara saitunan DNS. DNS na dandalin Azure a 168.63.129.16 yana amsa ne kawai daga cikin VNet, don haka abokin ciniki da ke waje ba zai iya amfani da wannan adireshin a matsayin mai warwarewa ba.

Duba 4: gwada sabis ɗin da ke bayan ramin

Rami mai lafiya da tashar jiragen ruwa da aka rufe suna kama da juna daga wajen abokin ciniki. Duba bangon wutar baƙo, sannan ƙungiyar tsaron cibiyar a subnet ko NIC, sannan ko sabis ɗin yana saurare a adireshin sirri maimakon loopback kawai. Ba da izinin tafkin abokin ciniki a matsayin tushe maimakon buɗe ƙa'ida zuwa intanet, kuma ka tuna cewa SMB zuwa Azure Files yana buƙatar hanyar ƙarshen sirri da aka tura ta cikin ramin. Lokacin da albarkatu ta amsa da IP amma ba da suna ba, koma zuwa dubawa 3 maimakon taɓa ƙofar.

Tebur ɗaya yana raba yadudduka yayin da kake aiki:

Duba 5: rubuta bayanin kafin ka ɗaukaka

Saka nau'in ƙofar, nau'in ramin, hanyar tabbatarwa da tsarin aiki na abokin ciniki a cikin tikitin. Bayanin IKEv2 na takardar shaida da bayanin RADIUS suna gazawa saboda dalilai daban-daban, kuma abokin ciniki da aka gina don wani nau'in rami yana haɗuwa ne kawai lokacin da ƙofar ta bayar da yarjejeniya mai dacewa.

Ga ƙaramin ƙungiya, ƙirar da za ta daɗe ita ce VNet ɗaya, forwarder DNS ɗaya da abokin ciniki na split-tunnel da aka rubuta. Idan buƙatar ita ce fitarwar jama'a ta dindindin, ƙare ramin wuri-zuwa-wuri a kan bangon wuta da kuke sarrafawa kuma ku tura zirga-zirgar intanet zuwa can, maimakon neman ƙofar wuri-zuwa-wuri wani abu da ba a taɓa gina ta don shi ba.