Canza IP na jama'a na ƙofar VPN ta Azure da matsar da rajista

A Azure abubuwa uku daban-daban ake kira adireshin ƙofa. Ana ba da adireshin sirri daga GatewaySubnet. Adireshin jama'a wani ɗanyen IP na jama'a ne daban wanda tsarin IP na ƙofar ke nuni zuwa gare shi. Rajista da yanayin girgije su ne mahallin da shell ɗinka ke amfani da shi wajen samun ɗaya. Ka canza ɗaya sauran biyun za su tsaya inda suke, shi ya sa aikin adireshi yakan tsaya a tsakiya.

Ina yin waɗannan canje-canje a matakai huɗu: lissafa abubuwan, yanke shawara ko IP na jama'a zai motsa a kan ƙofar da take ko kuma a sake gina ƙofar, aiwatar da canjin yayin da tsohon adireshin ke hannu, sannan a tabbatar da kowane rami daga ɓangarorin biyu kafin a share komai. Matakin da mutane suka tsallake shi ne lissafi.

Wanene daga cikin abubuwan ukun da kake canzawa da gaske

Ba abin suna kafin ka buɗe tashar. Ƙofar VPN tana ɗaukar adireshinta na sirri daga wani yankin da dole a kira shi daidai GatewaySubnet, kuma Azure yana ba da shi daga wannan prefix; babu wani fili na gama-gari don liƙa shi. Adireshin yana kama da tsayayye ne kawai saboda yankin yana tsayayye. Ka canza adireshin yankin ko ka sake gina ƙofar sai ya motsa tare da su.

Ana iya gyara adireshin jama'a, amma dokokin SKU suna yanke shawara ko gyaran ya halatta. Ƙofar Basic tana haɗe da IP na jama'a mai motsi na Basic, SKU na VpnGw suna buƙatar Standard tsayayye, kuma ƙofar da ke da ƙarin zone tana buƙatar IP na jama'a Standard mai ɗauke da zones ɗin. Ana ƙin SKU mara kyau kafin rami ya faɗi.

Lissafi kafin komai ya motsa

Tabbatar da rajista da farko, domin ba tare da ita ba sauran lissafin ba su da amfani. Rubuta ƙofar, tsare-tsaren IP ɗinta da kowane haɗi da ke ƙarewa a kanta, ka ajiye fitarwa kusa da rikodin canjin.

Get-AzContext | Select-Object Subscription, Tenant, Environment
Get-AzVirtualNetworkGateway -ResourceGroupName rg-hub -Name gw-hub |
  Select-Object Name, Sku, EnableActiveActive, IpConfigurations
Get-AzVirtualNetworkGatewayConnection -ResourceGroupName rg-hub |
  Select-Object Name, ConnectionStatus, ConnectionType

ID na albarkatu sun fi sunaye muhimmanci. Haɗi yana riƙe da nuni zuwa ƙofar da zuwa ƙofar cibiyar sadarwa ta gida, kuma waɗannan ID suna bayyana a cikin scripts, faɗakarwa da sanya manufofi waɗanda babu wanda ke tunawa. Lissafa abin da ke wajen Azure ma: sunan DNS da ke kaiwa ga adireshin, jerin izinin abokin tarayya, da katangar reshe da ke liƙa tsohon IP.

Maye gurbin IP na jama'a a kan ƙofar da ke aiki

Ƙirƙiri adireshin maye gurbin da farko, a cikin yanki ɗaya kuma da tsarin zone da ya dace da ƙofar, ka bar tsohon ɗanyen a wurinsa. Sai ka sake gina tsarin IP ka tura sabuntawa a kira ɗaya. Wannan kiran yana maye gurbin dukan tarin tsare-tsare, don haka ƙofar aiki-aiki tana buƙatar duka biyun, in ba haka ba za ka riƙe rami ɗaya ka rasa ɗayan.

$gw = Get-AzVirtualNetworkGateway -ResourceGroupName rg-hub -Name gw-hub
$pip = New-AzPublicIpAddress -Name pip-gw-hub-2 -ResourceGroupName rg-hub `
  -Location westeurope -AllocationMethod Static -Sku Standard
$conf = New-AzVirtualNetworkGatewayIpConfig -Name gwipconfig1 `
  -SubnetId $gw.IpConfigurations[0].Subnet.Id -PublicIpAddressId $pip.Id
Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw -IpConfigurations $conf

Ramuka suna faɗuwa yayin da ake sake shirya ƙofar. Ɓangaren nesa yana buƙatar jadawali: katangar abokin tarayya tana ci gaba da bayar da tsohon adireshin har sai wani ya gyara ta, kuma haɗin da ƙarshensa na nesa ke tsammanin IP ɗin da ya gabata zai kasance a ƙasa komai Azure ya yi kyau. Rage TTL na DNS kafin taga.

Abokan cinikin point-to-site suna buƙatar sabon bayanin martaba, domin fakitin da aka sauke yana ɗauke da ƙarshen. Sunan DNS na musamman a gaban ƙofar yana cetonka rarrabawa: ka riƙe sunan, ka canza rikodin.

Matsar da ƙofar zuwa wata rajista

Matsar da albarkatu yana motsa saiti, kuma ƙofar ita kaɗai ita ce mafi ƙarancin amfani. Cibiyar sadarwar kama-da-wane, albarkatun IP na jama'a, ƙofofin cibiyar sadarwa na gida da haɗe-haɗe suna tafiya tare domin kowanne yana riƙe da nuni ga wani. Rajistar manufa dole ta kasance a cikin tenant ɗaya, Microsoft.Network dole a yi rajista a can, kuma kana buƙatar izinin rubutu a ɓangarorin biyu.

Tabbatarwa tana gudana kafin komai ya canza, don haka matsar da aka ƙi tana barin albarkatun a wurinsu. Shi ya sa matsar ta cancanci ƙoƙari kafin sake ginawa: nasarar matsar tana ɗauke da IP na jama'a, saboda haka abokan tarayya da jerin izini suna ci gaba da aiki, yayin da ƙofar da aka sake ginawa ba safai take dawo da adireshin ɗaya ba.

az resource move --destination-group rg-hub `
  --destination-subscription-id 00000000-0000-0000-0000-000000000000 `
  --ids /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-hub/providers/Microsoft.Network/virtualNetworkGateways/gw-hub

Karanta gazawar tabbatarwa maimakon maimaita ta. Abubuwan da suka fi yawa sune dogaro da aka bari a baya, nau'in albarkatu da ba zai iya motsawa, ko kulle a ɗaya daga cikin ƙungiyoyin albarkatu. Idan matsar ba ta yiwu ba, sake gina a manufa ka tsallake: tabbatar da turawa da tantancewa daga yankin gwaji, dakatar da tsoffin haɗe maimakon share su, sannan cire tsohuwar hanya a wata taga daga baya.

Idan ƙofar ta yi kama da ɓacewa, duba mahallin

Kuskuren ba a samu yawanci kuskuren iyaka ne. Asusu mai rajista da yawa yana tura cmdlet zuwa wanda bai dace ba, kuma saƙon yana zargin albarkatar. Nemo abin da cikakken ID na albarkatarsa: ID ɗin yana ɗauke da rajistarsa, don haka idan ya warware, babu abin da ya ɓace kuma mahallin ka na asali ba daidai ba ne.

Wasu rashin daidaituwa biyu ana karanta su haka. Ƙofar girgijen kasuwanci ba ta wanzu a zaman da aka nufa ga yanayin gwamnati ko na China, kuma tsofaffin sigar module suna rasa siffofin albarkatu da API ke riga ya dawo da su. Liƙa rajistar, daidaita yanayin, sannan buɗe harka.

Set-AzContext -SubscriptionId 11111111-1111-1111-1111-111111111111
Get-AzResource -ResourceId /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-hub/providers/Microsoft.Network/virtualNetworkGateways/gw-hub

Tabbatar daga ɓangarorin biyu kafin tsaftacewa

An haɗa yanayi ne, ba hujja ba. Duba matsayin rami ga kowane haɗi, matsayin BGP idan kana amfani da turawa mai motsi, da ingantattun hanyoyi a yankin aiki. Sannan tura buƙatu ta gaske ta hanyar manhaja da ta dogara da ramin. Haɗi na iya bayar da rahoton an haɗa shi yayin da prefix ɗin da kake buƙata ba ya cikin teburin hanyoyi.

Get-AzVirtualNetworkGatewayBGPPeerStatus -VirtualNetworkGatewayName gw-hub -ResourceGroupName rg-hub
Get-AzEffectiveRouteTable -NetworkInterfaceName nic-app -ResourceGroupName rg-app

Riƙe tsohon IP na jama'a a raba maimakon sharewa har taga dawowa ta rufe, ka rubuta gyare-gyaren abokin tarayya da katangar domin a iya juyar da su cikin tsari.

• An liƙa mahalli ga rajistar da ta mallaki ƙofar
• An riƙe tsohon IP na jama'a, an rubuta dogarorinsa
• Kowane haɗi kore da buƙatu ta gaske ɗaya ta cikinsa
• An matsar da masu amfani da point-to-site zuwa sabon bayanin martaba
• An canza rikodin DNS kuma an rubuta ƙimar da ya gabata