Cloud VPN zuwa Cisco ASA: sake gini bayan rashin daidaiton shawara

NEGOTIATION_FAILURE a kan tunnel na Cloud VPN da Cisco ASA a ƙarshen nesa kusan koyaushe rashin daidaiton shawara ne ko masu zaɓi, kuma gaskiya ta farko mai amfani ita ce babu wani gyara da zai gyara shi. Cloud VPN yana ƙayyade shawarar IKE lokacin da aka ƙirƙiri abin tunnel. Babu fili don canza algorithm a wurin, don haka gyaran shi ne sharewa da sake ƙirƙira tare da rubuta wurin farawa. Dauke shi a matsayin sake gini kuma aikin ya zama jerin dubawa maimakon yini na hasashe.

Karanta gazawar kafin ka share wani abu

Gazawar tattaunawa matsala ce ta mataki, kuma log na abokin aiki yawanci yana ambaton matakin. Gazawar mataki 1 na nufin ƙarshen biyu ba su yarda a kan shawara ba ko ba su iya tabbatar da juna ba. Gazawar mataki 2 na nufin tunnel ya tashi kuma masu zaɓin da aka kare ba su dace ba. Waɗannan gyare-gyare ne daban-daban, kuma ya dace a fitar da layin log kafin wani ya taɓa saiti.

Gazawar kuma tana kawar da wasu abubuwa. Ba hanyar VPC ba ce, ba ƙa'idar firewall a kan fuskar tunnel ba, kuma ba kuskuren warware suna a cikin cibiyar sadarwa ba. Bin waɗannan yana haifar da canje-canje masu ƙarfin gaba waɗanda ba za su iya canza sakamakon ba, kuma suna sa gyaran ƙarshe ya fi wuya a danganta shi.

Ɗauki saitin biyu yayin da suke nan

Share tunnel yana ɗaukar rabin minti kuma yana lalata shaida ɗaya da kake da ita. Kafin haka, rubuta masu zaɓi na gida da na nesa, adireshin abokin aiki, wanda ya mallaki sirrin da aka raba, da crypto map ko bayanin IKEv2 na ASA. ASA yana amsa tambayoyi biyu daban: me aka saita da me ke aiki a yanzu:

show running-config crypto ikev2
show crypto ikev2 sa
show crypto ipsec sa | include local ident|remote ident|status

A ɓangaren Google, karanta abin tunnel maimakon taƙaitawar console, domin adireshin abokin aiki da filayen masu zaɓi su ne ƙimar da dole ka sake fitar da su daidai:

gcloud compute vpn-tunnels describe tunnel-to-asa --region europe-west1 \
  --format="yaml(peerIp,localTrafficSelector,remoteTrafficSelector,ikeVersion,sharedSecret)"

Saka waɗannan ƙimomin a cikin tikitin kafin sharewa ta farko. Sake ginin da ke ƙasa yana aiki ne kawai saboda za ka iya sake ƙirƙirar abin ɗaya da bambanci ɗaya da gangan.

Algorithms ɗin da ɓangare ɗaya ya ƙi yin shawarwari a kansu

Cloud VPN ba ya zaɓa daga jerin algorithms na IKEv1 kamar abokin aikin gargajiya. Saitunan abokin aikin da yake tsammani ƙayyadaddun ne: aes-cbc-128 don ɓoyewa, sha1-96 don aminci da PRF, rukunin Diffie-Hellman 2, 36,600 daƙiƙa don mataki 1 da 10,800 daƙiƙa don mataki 2. Manufar ASA dole ta bayar da wannan rukunin daidai. Shawara ta biyu a kan ASA ba ta cutarwa muddin wadda ta dace tana cikin jerin.

IKEv2 yana ba ɓangarorin biyu ƙarin sarari, amma ƙa'idojin suna riƙe siffar ɗaya: kunna PFS, zaɓi rukunin DH da tunnel ɗin ke goyon baya, ka kuma riƙe jerin shawarwarin gajere sosai don rashin daidaito ya bayyana. Abokin ASA a kan Cloud VPN kuma yana nufin tuƙi na tsaye, don haka dole a tsara da jera prefixes ɗin da aka kare maimakon barin su ga BGP.

Lokacin rayuwa da aka kwafa daga samfurin wani mai saya shi ne karkataccen juyi da aka saba a nan. Google yana wallafa waɗannan ƙimomin a matsayin saitunan abokin aiki da ake bukata, don haka saita su; ba a yin shawarwari a kan ƙaramin ƙima har zuwa abin da ASA yake so.

Share, sake ƙirƙira, kuma share tsohon yanayi

Share tunnel ɗin, ba ƙofar ba, kuma lura da sunan da Cloud VPN ke bayarwa ga maye gurbin, domin ana ba da sunaye ba a sake amfani da su ba. Sake ƙirƙirar shi da ƙimomin da aka rubuta da adireshin abokin aiki ɗaya, sannan ƙara shawarar da ta dace a jerin manufofin ASA.

Share ƙungiyoyin tsaro bayan canjin ASA da kafin ka karanta sakamakon. ASA na iya ci gaba da bayar da tsohuwar manufa har sai SA na yanzu ya ƙare, don haka ingantaccen saiti yana kama da karye tsawon tsohon lokacin rayuwa kuma mai lura ya yanke cewa sake ginin ya kasa yayin da bai fara ba:

clear crypto ikev2 sa
clear crypto ipsec sa

Tabbatar mataki 1 ya tashi kafin ka kalli mataki 2. Yayin da mataki 1 ke ƙasa, shawarar ko makullin da aka riga aka raba ba daidai ba ne, kuma aikin masu zaɓi ba zai canza hakan ba.

Masu zaɓi suna yin madubi, sannan masu ƙirga suna yanke hukunci

Mataki 2 yana aiki ne kawai lokacin da ƙarshen biyu suka yarda a kan adireshin da ake karewa, kuma yarjejeniyar madubi ce ba rabawa ba. Dole masu zaɓi na gida na Google su dace da masu zaɓin da ASA ke kira nesa, kuma masu zaɓi na nesa na Google su dace da abin da ASA ke kira na gida. Tunnel da ke da 0.0.0.0/0 a ɓangare ɗaya da ƙaramin cibiya ɗaya a ɗayan yana wuce mataki 1 sannan ya kasa mataki 2 da wannan babbar kuskure. Babu ɓangaren da zai iya faɗaɗa jerin ɗayan.

Don masu zaɓi bisa manufa, jera kowane nau'in prefix kuma riƙe jerin a cikin tikitin. Ƙaramin cibiyar da aka ƙara a wurin daga baya yana buƙatar gyara a ƙarshen biyu, domin sabuwar hanya a kan ASA ba ta faɗaɗa mai zaɓi ba, kuma sakamakon shi ne tunnel da ke aiki kuma yana wucewa da zirga-zirga kawai don prefixes ɗin da suka kasance a ranar farko.

Kammala da kwarara ɗaya daga mai masauki zuwa mai masauki kuma karanta masu ƙirga byte a ɓangarorin biyu. Masu ƙirgar da ke hawa a kan ASA yayin da suke tsaye a kan Google yawanci suna nufin amsar tana fita ta wata fuska, ko mai zaɓin bai rufe prefix ɗin dawowa ba. Rubuta algorithms, lokutan rayuwa, masu zaɓi da sabon sunan tunnel, domin canjin shawara na gaba yana maimaita wannan sake ginin kuma waɗannan ƙimomin suna mai da shi ɗan gajeren aiki.