Azure VPN na sirri ta IP a kan ExpressRoute ba tare da NVA ba

Tatsuniya ita ce ɓoyar da zirga-zirga a kan peering na sirri na ExpressRoute yana buƙatar na'urar cibiyar sadarwa ta kama-da-wane. Ba haka ba. Azure yana goyon bayan Site-to-Site VPN Gateway wanda ƙarshen ramin sa adireshi ne na sirri na RFC1918 da ake ɗauka a kan da'irar, kuma na'urar zaɓi ne ba tsari ba. Abin da tatsuniyar na'urar ke ɓoyewa shi ne ɓangaren da ke ciwo da gaske: kunna ƙarshen sirri a kan abu ɗaya maimakon biyu, da barin hanyar peering kai tsaye ta yi nasara a shiru a kan hanyar da aka ɓoye.

Inda tatsuniyar ta fito

Maganar tana da asali mai daraja. Shekaru da yawa ainihin hanyar IPsec a kan peering na sirri ita ce NVA, domin ƙofar da ake sarrafawa tana bayyana ƙarshen jama'a kawai. Wannan ya canza, kuma amsoshin da aka rubuta kafin canjin har yanzu ana ambaton su a cikin zaren da babu wanda ke duba kwanan wata. Gyaran ɗan ƙarami ne: akwai ƙofar VPN mai adireshin sirri, kuma tana canza ƙarshen, ba dabarar turawa da ke kewaye da ita ba.

Babu ɗaya daga cikin waɗannan da ke mai da NVA hutu. Yana mai da hutu zaton cewa na'ura ita ce hanya ɗaya zuwa buƙatar.

Kunna ƙarshen sirri a matakai biyu

Fara daga haɗin peering na sirri na ExpressRoute mai aiki wanda aka haɗa da VNet da ke ɗauke da ƙofar VPN. Dole bangaren gida ya riga ya isa adiresoshin sirri masu dacewa a kan wannan da'irar, domin ramin zai yi amfani da waɗannan adiresoshin a matsayin jigila. Sannan sharadi na ƙofar: tsarin Microsoft na VPN na IP na sirri yana buƙatar ƙofar da aka gina a kan albarkatun IP na jama'a na Standard. Adireshin rami na sirri ba ya kawar da wannan buƙatar, wanda ke ba mutanen da suke zaton „sirri“ na nufin „babu IP na jama'a a ko'ina“ mamaki.

Yanzu kunna tuta a wurare biyu. Tsarin ƙofar yana da nasa maɓallin don IP na sirri, kuma haɗin Site-to-Site ɗaya yana da na biyu wanda ke sa wannan haɗin ya yi amfani da adireshin sirri. Sanya ɗaya ba tare da ɗayan ba ita ce mafi yawan rashin cikakkiyar tsari; ramin ko dai ba ya tashi ko ya tashi zuwa ƙarshen da ba daidai ba.

az network vnet-gateway update -g rg-net -n vpngw-prod --set enablePrivateIpAddress=true
az network vpn-connection update -g rg-net -n conn-onprem --set enablePrivateIpAddress=true
az network vnet-gateway show -g rg-net -n vpngw-prod \
  --query '{sku:sku,priv:enablePrivateIpAddress,active:activeActive}'

Tabbatar da sunayen kaddarorin da sigar CLI da ka shigar, domin alamun portal da kaddarorin CLI ba koyaushe suke da magana ɗaya ba. Ƙofar aiki-aiki tana bayyana adiresoshin rami biyu na sirri, kuma na'urar gida tana buƙatar duka abokan haɗin biyu an tsara su idan kana son wannan yawan ya zama da ma'ana. Ba a buƙatar BGP kawai don tayar da wannan rami mai adireshin sirri, ko da yake yawanci yana cikin yadda kake rarraba prefixes.

Tatsuniya ta biyu: ramin da aka kafa yana ɓoye zirga-zirgarka

Hanyoyi biyu yanzu suna isa cibiyar sadarwar aikace-aikace: hanyar peering na sirri kai tsaye da hanyar ta VPN. Dukansu suna aiki. Ɗaya ne kawai ke amfani da wannan Layer na IPsec. Microsoft ya rubuta cewa idan an sanar da prefixes iri ɗaya a kan ExpressRoute da kuma a kan VPN, Azure yana fifita hanyar ExpressRoute kai tsaye, don haka rami lafiyayye da ƙididdiga lafiyayyu ba su tabbatar da komai game da inda fakitin aikace-aikacen suka tafi ba.

Hanyoyin turawa da aka rubuta su ne kewayon rufewa a kan ExpressRoute tare da takamaiman yanki mai kariya a kan VPN, ko prefixes daban-daban a kan hanyoyin biyu. Misali, peering na sirri zai iya ɗaukar 10.40.0.0/16 yayin da VPN ke sanar da 10.40.12.0/24. Ƙarin takamaiman prefix yana yin nasara kuma sauran kewayon ya kasance kai tsaye.

az network vnet-gateway list-advertised-routes -g rg-net -n vpngw-prod
az network vnet-gateway list-learned-routes -g rg-net -n vpngw-prod
az network vpn-connection show -g rg-net -n conn-onprem --query connectionStatus

Yi wannan dubawa a bangaren gida, tunda fifikon na'urar turawa taka ce ke yanke shawarar inda zirga-zirgar fita ke fita. Kuma riƙe jigilar ramin kanta a kan hanyar ExpressRoute; hanyar da ta ja ƙarshen sirri na ƙofar cikin ramin tana sa ramin ya dogara da kansa.

Yanke shawara abin da ke faruwa idan ramin ya faɗi

Ƙarin takamaiman hanyar VPN tana ɓacewa idan ramin ya faɗi, yayin da faffadan hanyar kai tsaye ta kasance. Zirga-zirga sai ya gudana ba tare da ɓoyewa ba kuma komai ya yi kama da lafiya, wanda shine mafi munin yanayin gazawa ga buƙatar da ta wanzu don tabbatar da ɓoyewa. Idan buƙatar ta hana wannan koma baya, turawa da manufofin shiga dole su faɗi haka a fili maimakon dogaro da samuwar ramin.

Rubuta waɗanne prefixes za su iya kasancewa kai tsaye ana isa da waɗanne dole su tsaya idan babu hanyar ɓoyayyiya. Sannan gwada yanayin da aka yarda da shi da ainihin zirga-zirga kuma kwatanta ƙididdigar haɗin, domin teburin hanya shi kaɗai ba zai gaya maka ko buƙatar ɓoyewa tana nan daram ba.

Wannan tsarin yana kuma ba ka damar kimanta NVA bisa ainihin fasalullukansa, kamar ramuka da yawa, iya wucewa ko binciken mai siyarwa, maimakon saya ɗaya saboda ƙarshen sirri ne.