GCP HA VPN na kin FortiGate: nau’in ID na gida bai dace ba
Google na kwatanta asalin da FortiGate ke da’awa, ba wai kawai maɓallin da aka raba tukuna ba. ID na gida irin FQDN ya kasa wannan gwajin yayin da log ɗin har yanzu yana cewa tabbaci.
AUTHENTICATION_FAILED daga Google Cloud HA VPN yakan mayar da mutane zuwa maɓallin da aka raba tukuna, kuma maɓallin yakan zama daidai. Tunnel ɗin yana tsayawa a mataki na 1 saboda Google yana kwatanta wani abu kuma: asalin da abokin tarayya ke da’awa yayin musayar IKE. A kan FortiGate wannan asalin na iya canza nau’i ba tare da wani ya gyara adireshi ba. Karanta log ɗin a matsayin rashin daidaituwar asali da zarar an sake shigar da maɓallin sau biyu.
Kasawa ɗaya, gwaji biyu
IKE yana tabbatar da abokin tarayya a matakai biyu daban. Maɓallin da aka raba tukuna yana tabbatar da cewa ɓangarorin biyu suna da sirri ɗaya, kuma asalin da aka da’awa yana gaya wa mai amsa wanda abokin tarayya ke cewa shi ne. Google yana gwada wannan asalin da abokin tarayyar da aka saita shi da shi. Idan aka bar shi shi kaɗai, FortiGate yana aika asalin da ya dogara da adireshi wanda aka samo daga interface ɗinsa na fita, kuma kwatancen yana wucewa ba tare da wani ya lura ba.
Duk matakan biyu suna faɗawa cikin kwano ɗaya a cikin log ɗin, wanda ke bayyana sanannen zagaye na sake buga maɓallin sau huɗu kafin wani ya karanta nauyin asalin.
Abin da FortiGate ke sanyawa cikin nauyin asalin
Matsalar tana farawa lokacin da wani ya saita ID na gida domin ɓangarorin biyu su daidaita. Sabbin gine-ginen FortiOS suna yi wa wannan asalin alama a matsayin cikakken sunan yanki ko da kuwa ƙimar da aka buga adireshi ne mai ɗigo. Don haka Google yana karɓar asalin FQDN yayin da yake tsammanin adireshi, kuma yana ƙin zaman. Babu abin da ke cikin saƙon da ya ce wane rabi ya kasa, don haka rahoton ana karanta shi a matsayin gazawar tabbaci.
Sake haifar da shi sau ɗaya tare da kunna binciken IKE sannan ka karanta nauyin asalin da Firewall ɗin ke aikawa da gaske.
A cikin wannan zagayen, tabbatar da abubuwa uku masu sauƙi: sigar IKE da ɓangarorin biyu ke amfani da ita, ainihin maɓallin har da ɓoyayyun haruffa na ƙarshe, da adireshin abokin tarayyar da Google ke tsammani. Suna amsa tambayoyi daban-daban, kuma maɓalli mai dacewa bai ce komai ba game da asalin.
Zaɓuɓɓuka, da abin da kowanne ke ci
Kowace hanyar fita tana gyara wani Layer daban, kuma babu ɗaya da ke samuwa ga kowane turawa.
| Option | When it works | What it costs |
|---|---|---|
| Set an address identity on the firewall | Your firmware lets you choose the type | Behaviour you must retest per release |
| Put a public address on the negotiating interface | The firewall can hold a routable address | Not possible behind NAT |
| Terminate on a peer that accepts your identity | Another endpoint validates what you produce | A topology change |
Gyara asalin a kan Firewall shine amsa mafi tsafta inda firmware ke ba ka damar zaɓar nau’in da kuma riƙe ƙimar. Filin yana nan a wasu gine-gine kuma yana cika nau’in da kuskure a wasu, don haka gwada sigarka maimakon dogaro da bayanan saki.
Adireshin jama’a mai iya tafiya a kan interface ɗin tattaunawa shine hanyar da aka rubuta, saboda a lokacin asalin da aka saba da shi yana dacewa da abin da Google ke tsammani kuma ba a buƙatar wani maye gurbi. Nan ne yawancin turawa suke ƙarewa, idan Firewall ɗin zai iya riƙe irin wannan adireshi kwata-kwata.
Ƙarewa a kan abokin tarayya da ke tabbatar da abin da kake samarwa canjin topology ne. Ka ɗauke shi a matsayin shawarar ƙira ba wai hanyar wucin da kwatanci mai daɗi ba.
Lokacin da NAT ya cire zaɓi ɗaya
Bayan NAT hanyar fita ta adireshin jama’a tana ɓacewa, kuma abin da ya rage ya dogara da halin firmware da ba ka sarrafa shi. Wannan shine lokacin da za a zaɓa da gangan tsakanin haɓakawa, matsar da abokin tarayya, ko karɓar wani ƙarshen gajimare daban. Waɗannan kasafin kuɗi uku ne daban-daban, kuma zaɓar ɗaya bisa kuskure shine yadda hanyar wucin na ɗan lokaci ke zama gine-gine. Rubuta zaɓin da dalilinsa kusa da tunnel ɗin.
Kafin ka fassara kowane abu daga cikin waɗannan, tabbatar da yanayin tunnel ɗin a gefen Google da kuma cewa ba a yin watsi da IKE kawai a hanya ba. Fakitin da aka watsar yana ƙarewa; ba ya haifar da ƙi.
Abin da za a rubuta yayin da yake aiki
Rubuta nau’in asalin, ƙimarsa, sigar firmware da adireshin abokin tarayya waɗanda suke aiki lokacin da tunnel ɗin ya tashi na ƙarshe. Sabunta firmware na iya sake canza tsoho, kuma gazawar gaba za ta yi kama da rashin daidaituwar maɓalli. Da asalin da aka ajiye kusa da maɓallin da adireshin abokin tarayya, mutum na gaba zai fara daga gwaje-gwaje masu sauƙi.
Wannan rikodin kuma shine hanya ɗaya tilo ta sanin ko ana buƙatar hanyar wucin bayan haɓakawa na gaba.