GCP HA VPN: zaman BGP ya tsaya a Waiting for peer, musayar nau'in adireshi
Zaman BGP na Cloud VPN da ya tsaya a Waiting for peer yawanci an musanya adireshin tunnel da na peer. A duba nau'in kafin ka sake gina wani abu.
Zaman BGP da ba ya taba isa Established a kan tunnel na Cloud VPN yawanci ba matsalar turawa ba ce. Matsalar waya ce: an shigar da adireshi biyu da suka kamata su yi kama da juna a cikin kishiyar tsari, ko an sake amfani da nau'in tunnel na farko a na biyu. Tunnel din kansa na iya zama lafiya sosai yayin da zaman yake tsaye a Waiting for peer, domin IPsec da BGP tattaunawa ne daban a tsakanin wadannan mashigai biyu. Yanke shawara wanne ne a cikin su biyu ya lalace kafin ka sake gina wani abu.
Tambaya daya tana warware yawancin lokuta: shin na'urar peer tana ganin adireshin Cloud Router kwata-kwata?
Yanayin tunnel da yanayin zaman duba ne daban-daban
IKE da ESP ne suka fara. Idan tunnel din bai kafu ba, babu wani abu a cikinsa da ke da muhimmanci kuma maganar adireshin BGP ta yi farko. Karanta yanayin tunnel din da cikakken yanayi, sannan ka karanta yanayin peer na BGP na na'urar don wannan tunnel din.
Tunnel da ke aiki yayin da peer din BGP ya tsaya yana takaita kuskuren ga zaman: adireshin peer, ASN, ko TCP 179 da ke isa adireshin ciki. Tunnel yana aiki, zaman yana aiki, kuma har yanzu babu hanyoyi a cikin VPC shi ne na uku. Canza adireshi ba zai taimaka a nan ba, domin zaman yana aiki tuni kuma ana kawai rashin sanar da prefix din ko ba a fifita shi ba. Raba wadannan lokuta uku shi ne mafi yawan aikin.
Kowane tunnel yana bukatar /30 nasa, da cika duka bangarorin biyu
Kowane tunnel na HA VPN yana samun link-local /30 daga 169.254.0.0/16, adireshi daya a fuskar Cloud Router dayan kuma a kan peer dinka. Filin peer dole ya ambaci bangaren nesa, ba adireshin na'urar da kanta ba.
Tunnels biyu na nufin fuskoki biyu a kan Cloud Router, kowanne da /30 daban. Sake amfani da nau'in tunnel 0 a tunnel 1 shine kuskuren da ke kama da tsari a teburin taƙaitawa kuma ya mutu a cikin fakitin OPEN.
| Tunnel | Router interface | Peer address | What a swap produces |
|---|---|---|---|
| tunnel 0 | 169.254.1.1/30 | 169.254.1.2 | OPEN sent to itself or to nothing; session waits |
| tunnel 1 | 169.254.1.5/30 | 169.254.1.6 | same failure on the second session |
| both | one pair reused | one address reused | one session up, the other never leaves waiting |
Karanta nau'in daga albarkar na'urar ba daga taƙaitawar console ba. Taƙaitawar tana lissafin adireshin peer a ginshikin da ke da sauƙin karantawa ba daidai ba, kuma ipRange na fuska tare da peerIpAddress na peer dole su bayyana bangarorin da suka saba wa juna na /30 daya.
Musayar yawanci tana faruwa yayin sake ginawa
Lokacin sake gina tunnel ne nau'ikan ke haduwa. Ana kwafin adireshin peer na tsohon tunnel cikin filin fuska na sabon, ko kuma a nuna sabon zaman ga peer din zaman da ya gabata. Ko ta yaya Cloud Router yana aika fakitin OPEN zuwa adireshin da yanzu shi kansa ne ko adireshin da babu tunnel a bayansa.
Rubuta nau'ikan kafin ka bude console: sunan tunnel, fuska, adireshin na'urar, adireshin peer, ASN na peer. Sannan ka kirkiro tunnels biyu a lokaci daya, domin kada a cika na biyu da ragowar na farko.
Wasu dalilai uku da ke sa zaman jira
ASN na peer shine na farko: kowane bangare dole a saita shi da ASN na dayan, kuma rashin daidaito yana isa ga peer amma ba ya taba kafuwa. Na biyu shine firewall na peer din kansa, wanda dole ya yarda da TCP 179 a fuskar tunnel; dokar IKE ko ESP ba ta rufe hakan. Na uku shine peer da ke amsa daga wani adireshin tushe daban da wanda aka saita a matsayin makwabcinsa.
Log na peer din kansa shine mai rarrabewa. Idan taƙaitawar BGP nasa ba ta lissafa wani makwabci ga wannan adireshin ba, fakitin ba sa zuwa kuma nau'in ko hanyar ba daidai ba ce. Idan makwabcin yana cikin Active ko Connect, fakitin suna zuwa kuma sigogin zaman ba su daidaita ba.
A duba cikin tsarin da fakitin ke tafiya
Yi aiki zuwa waje: yanayin tunnel, sannan yanayin peer na BGP na na'urar, sannan taƙaitawar BGP ta peer, sannan hanyoyin. Idan biyun farko suna lafiya, daina gyara bangaren Cloud VPN ka yi aiki a kan na'urar peer. Idan na'urar ta bayar da rahoton peer a matsayin a tsaye kuma na'urarka ba ta da makwabci, nau'in ba daidai ba ne ko kuma an tace tashar BGP. Kama fakitin a fuskar tunnel na peer yana warware shi da kallo daya, domin fakitin OPEN ko suna isa can ko kuma ba sa isa kwata-kwata.
gcloud compute routers get-status ROUTER --region=REGION yana buga yanayin peer kusa da adireshin da yake amfani da shi, kuma shine ainihin nau'in da kake bukatar kwatantawa.
Da zarar zaman ya kafu, tabbatar cewa prefix din da aka koya ya bayyana a teburin hanyoyin VPC kuma mai masauki daya a kowane bangare yana amsawa. Sannan ka rubuta nau'ikan karshe kusa da sunayen tunnels, domin sake ginawa na gaba ya fara daga tebur da aka tabbatar ba daga taƙaitawar console ba.